Data processing agreement

Who is who

You (the venue or chain) decide why and how your staff data and records are processed, so you are the controller. We store and process them on your behalf and only on your documented instructions, so we are the processor.

See: Contact and company details

What the agreement is based on

The core is the European Commission's standard contractual clauses for controllers and processors (Implementing Decision (EU) 2021/915), in the GDPR version, word for word. Under that decision they meet GDPR Art. 28(3) and (4). Our additional terms may not contradict them.

Whose data

• the owner, managers and staff of your venues, including people without an e-mail address who sign in with a PIN on a venue device,
• inspectors or auditors you give read-only access to,
• people who appear on photos and documents your team adds, for example a driver's name on a delivery note,
• contact people at your suppliers, if you enter them.

What data

• account data: first name, last name, optional e-mail address, language, role and assigned venues,
• sign-in data: hashes of passwords, PINs and tokens, never the plain values,
• technical data: IP address and e-mail address in failed sign-in counters, venue device identifiers,
• records: who made each entry, when it was measured and saved, corrections with their reason, and the event log,
• photos and files your team adds to records,
• data of the modules you turn on: HACCP and cleaning plans, pest control, allergens and labels, batches, audits, notifications,
• the staff register: trainings and medical certificate dates.

Your team and health data

Everyone who works with food must have a medical certificate for sanitary and epidemiological purposes (Polish Food Safety Act, Art. 59(2)), and an employer may not let anyone work without a valid one (Labour Code, Art. 229 § 4). Haccly reminds you about expiry dates, but keeps the data to a minimum:

• the register stores only the person, the type, the training name, the date and the valid until date,
• we do not store scans or photos of certificates; the original stays with the employer in the personnel file (Food Safety Act, Art. 59(4) and (5)),
• certificate dates are visible only to the Owner and the Venue manager,
• the app shows a validity status, and logs and error reports never contain this data.

Even a certificate's validity date may count as health data (GDPR Art. 9), so we protect it as such. Because of that, we must keep a record of processing activities as a processor despite our size (GDPR Art. 30(2) and (5)).

Nature and purpose

We store the data, show it to your users, generate PDF reports and exports, send notifications, make backups and delete it. The only purpose is to provide Haccly to you. Reading text from photos is not live yet; before we turn it on, we update the list of subprocessors.

Safeguards

Annex III of the agreement describes the technical and organisational measures in detail. They include:

• data kept in Poland: the app and database on an OVH server in Warsaw, files and backups on our own server,
• each customer's data separated in the database (tenant ID and row-level security),
• personal accounts and roles, every entry tied to a person; passwords hashed with argon2id; PIN locked after 5 failed attempts; limits on sign-in attempts,
• HTTPS only, session cookies marked httpOnly and Secure,
• entries cannot be changed or deleted, a correction is a new version with a reason,
• backups, and logs without personal data,
• changes deployed only after automated tests pass,
• confidentiality obligations for everyone with access to the data.

Subprocessors

Providers during the pilot:

• OVH Sp. z o.o.: application server and database (Poland, Warsaw),
• Sentry: error reports with identifiers only (EU),
• Purelymail (Add Rabbit LLC): sending e-mails from the app (USA); we will add the basis for the transfer to the USA once we have clarified it with the provider.

We keep files and backups on our own server in Poland, with no intermediary. You get the full list with the providers' details before signing. You give general consent to this list (clause 7.7, option 2). We tell you at least 30 days before adding or replacing a provider, by e-mail and on this page. You can object at hello@haccly.eu; if we cannot remove the reason, you can terminate the agreement at no cost before the change takes effect. We are fully liable to you for our subprocessors (GDPR Art. 28(4)).

Retention

• entries, corrections and photos: 3 years by default; you can set a longer period,
• sessions: expire after 30 days without use, or at once when you sign out,
• e-mail confirmation and password reset links: 24 hours and 1 hour, single use; the link to set a new account's password: 7 days,
• failed sign-in counters (IP address, e-mail): 24 hours,
• database backups and old file versions: 30 days.

Data breaches

We report a personal data breach to you without undue delay (GDPR Art. 33(2)), so you have time for your own 72 hour deadline to report it to the supervisory authority (Art. 33(1)). We report it within 48 hours of finding it at the latest, to the person named in the agreement and to the Organisation's Owners. Write to hello@haccly.eu about personal data.

Help, requests and audits

We help you answer requests from the people whose data it is, for example an employee asking for access or deletion, through exports, corrections with history and account management. Requests that reach us we pass on to you. You can check how we meet the agreement, including through audits and inspections (clause 7.6 of the standard clauses).

When the agreement ends

We return the data through export and then delete it, and confirm the deletion if you ask. The timeline (90 days read-only with export, then deletion, or earlier if you ask) is in the Terms of service.

See: Terms of service