Data processing agreement
1. Parties
This document governs the processing of personal data between:
- The SignaPlan customer company (controller of its workers’ and collaborators’ data), and
- Francisco Navarro Hernández (processor), under Article 28 of Regulation (EU) 2016/679 (GDPR).
By creating an account and using the service, the customer accepts this processing framework. If a specific DPA is signed later, that document prevails where it is incompatible.
2. Subject matter and duration
The processor will process, on behalf of the customer and for the life of the account, the data needed to provide SignaPlan: identification and operational employment data of employees and collaborators, site assignments, leave, clock-ins and working-time events (including geolocation if the customer enables it), vehicle data and audit logs associated with the service.
3. Nature and instructions
Processing is automated and limited to the purposes of the service (planning, time clock, fleet, working-time reports and workspace administration). The processor will only process the data under the customer’s documented instructions (including product settings) and applicable law, without using them for its own purposes unrelated to the service.
4. Processor obligations
- Ensure authorised people commit to confidentiality.
- Adopt adequate technical and organisational measures (multi-tenant isolation, role-based access, encryption of integration secrets, integrity measures on working-time events when the module is active).
- Not disclose the data to third parties except authorised sub-processors, a legal duty or the customer’s instruction.
- Assist the customer, to the reasonable extent of the product, with data-subject rights and security-breach notices.
- Make available to the customer the information needed to demonstrate compliance with this addendum.
5. Customer (controller) obligations
- Have a legal basis to process workforce data and inform data subjects under the GDPR and labour law.
- Configure the product properly (roles, geolocation, modules) and not enter unnecessary data.
- Handle their workers’ rights requests; SignaPlan will assist as processor.
6. Sub-processors
Infrastructure, hosting, email or other necessary technical providers may intervene, under contract and with equivalent duties. SignaPlan will inform of relevant sub-processor changes when required. Contact: paconavarro.fsn@gmail.com.
7. Security and breaches
If a security breach affects the customer’s data, the processor will notify the customer without undue delay so the customer can meet its notification duties.
8. End of processing
When the service ends, the customer may export their data in the formats available in the product. SignaPlan will then delete or return the customer workspace information, except a legal duty to keep it or a block needed to exercise or defend claims.
9. Processor contact
paconavarro.fsn@gmail.com · Calle La ermita 23, Teruel · 18461268L