GDPR & Data Processing

WorkflowPlus processes personal data in different roles depending on the context in which the platform is used.

For account registration, subscription administration, authentication, support communication, billing administration, and service operation, WorkflowPlus typically acts as a data controller because it determines the purposes and means of processing personal data necessary to operate the service.

Where users upload files, manage projects, create groups, assign roles, or collaborate within an organization or team workspace, WorkflowPlus may act as a data processor on behalf of the organization or user controlling that data.

In processor scenarios, the organization or account administrator typically determines how user-generated content, files, or project data are managed, shared, or deleted within the platform.

WorkflowPlus processes such data only to provide the service, maintain platform functionality, protect system integrity, and comply with legal obligations.

WorkflowPlus processes personal data only where there is a valid legal basis under applicable data protection laws, including the General Data Protection Regulation (GDPR).

Depending on the situation, processing may rely on one or more of the following lawful bases:

• Contract performance — where processing is necessary to provide the WorkflowPlus service or fulfill obligations related to user accounts, subscriptions, or platform functionality.
• Legal obligations — where processing is required to comply with applicable law, regulatory obligations, or lawful requests from authorities.
• Legitimate interests — where processing is necessary for the operation, security, improvement, and protection of the service and its users.
• Consent — where consent is required by law, for example in connection with certain cookies or optional communications.

WorkflowPlus evaluates the legal basis for processing based on the nature of the data involved and the context in which it is processed.

When WorkflowPlus acts as a data processor on behalf of a user, team, or organization, personal data contained in uploaded files, project content, group information, or collaboration data is processed solely for the purpose of providing the service.

Processing activities may include storing, transmitting, organizing, displaying, backing up, and securing the data in accordance with platform functionality and user instructions.

WorkflowPlus does not access, review, or use user content for purposes unrelated to providing the service except where necessary to comply with legal obligations, investigate misuse, address security incidents, or enforce applicable legal terms.

Organizations using WorkflowPlus remain responsible for ensuring that they have a lawful basis for processing any personal data they upload or manage through the platform.

WorkflowPlus may rely on carefully selected third-party service providers to support the operation of the platform. These providers may process personal data on behalf of WorkflowPlus in order to provide infrastructure, communications, analytics, security, or operational support.

Where such providers process personal data on behalf of WorkflowPlus, they act as subprocessors and are subject to contractual safeguards designed to ensure that personal data is processed only for authorized purposes and in accordance with applicable data protection requirements.

For example, WorkflowPlus currently uses Mailgun to deliver authentication-related emails such as account verification and password reset communications. In this context, limited data such as the user's email address and message metadata may be transmitted to the service provider solely for email delivery.

WorkflowPlus may update its list of subprocessors from time to time as operational needs evolve.

WorkflowPlus retains personal data only for as long as reasonably necessary to operate the service, fulfill contractual obligations, comply with legal requirements, maintain security, resolve disputes, prevent fraud, and enforce applicable agreements.

When accounts are closed or access to the service ends, WorkflowPlus may delete or anonymize certain personal data and user content within a reasonable timeframe, subject to backup retention practices, legal obligations, or legitimate operational requirements.

Where WorkflowPlus acts as a processor for customer-managed content, retention and deletion may depend on instructions from the relevant organization or account administrator controlling the data.

Users may request deletion of certain personal data where permitted by applicable law, subject to verification and any lawful grounds for retention.

Individuals whose personal data is processed by WorkflowPlus may have certain rights under applicable data protection laws, including the General Data Protection Regulation (GDPR).

These rights may include the right to request access to personal data, correction of inaccurate information, deletion of personal data, restriction of processing, objection to certain processing activities, and data portability where applicable.

Where WorkflowPlus processes personal data on behalf of an organization acting as the data controller, requests relating to that data may need to be directed to the relevant organization.

WorkflowPlus may require reasonable verification of identity before fulfilling requests in order to protect personal data and prevent unauthorized access.

If you have questions about data protection, privacy practices, or your rights under applicable data protection laws, you may contact WorkflowPlus at privacy@alma.com.cy.

If WorkflowPlus provides a web-based account deletion request page, requests may also be submitted through that page in accordance with the instructions provided there.

Requests relating to access, correction, deletion, or other privacy rights should include sufficient information to identify the relevant account or data involved so that WorkflowPlus can review the request appropriately.

Where applicable, individuals may also have the right to lodge a complaint with a supervisory data protection authority in their jurisdiction if they believe their personal data has been handled in a manner that violates applicable law.