Fier-App

1. Parties and status

This Data Processing Agreement (DPA) is between the Fier-App customer (“Controller”) and Fier-App, Alaimo Aleandro, Grabenstrasse 6, 45888 Gelsenkirchen, Germany (“Processor”). It forms part of the B2B contract. By accepting it electronically, the Controller records the date, time and version; the parties agree that this electronic form satisfies Art. 28(9) GDPR.

The Controller determines purposes and means. The Processor processes personal data only on documented instructions from the Controller, including this DPA, unless Union or Member-State law requires otherwise. The Processor will inform the Controller of such legal requirement unless law prohibits that information.

2. Subject, duration, nature and purpose

Processing concerns the provision, operation, security, support and maintenance of Fier-App’s SaaS application for time tracking, attendance, schedules, absences, tasks, client management, notifications, activity reports, secure work-document exchange (import, sending, reading and PDF download) and related account functions, including account backup and restoration where enabled for the customer’s active plan. The current work-document flow does not provide in-app editing, completion or signing. Processing lasts for the customer contract plus the deletion/return period under section 10.

Processing operations include collection on the Controller’s instruction, recording, organisation, storage, retrieval, transmission to authorised users and approved sub-processors, restriction, correction and deletion. The purpose is to provide the Service, prevent abuse, resolve faults and meet Processor security obligations; Processor’s separate billing/contract processing is outside this DPA.

3. Data subjects and data categories

Data subjects may include the Controller’s employees, workers, applicants where entered by the Controller, clients/contacts, site visitors, report signers and authorised users. Data may include identity/contact data; organisation/role data; schedules, work-time, attendance and absence data; task/message/report data; optional photos; work-document text and attachments; document versions and read/download event data; device/session and security data; optional location at a user-initiated clock event; and electronic-report signature data. Historical completion or signature records from an earlier work-document workflow may exist only where they remain subject to an applicable retention rule. Absence information may constitute special-category data. The Controller must not use special-category data without a valid legal condition and documented instruction.

4. Controller obligations and instructions

The Controller is responsible for lawfulness, transparency, data minimisation, accuracy, retention decisions, data-subject communications, workplace co-determination and instructions. In Germany it must assess § 26 BDSG, Art. 88 GDPR and any works agreement. Instructions must be given through the Service, support channel or another documented form. The Processor will promptly notify the Controller if an instruction appears to infringe GDPR or other applicable data-protection law, unless prohibited by law.

5. Confidentiality and security

The Processor ensures that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory duty. The Processor implements appropriate measures under Art. 32 GDPR, including access control and least privilege, authenticated roles, TLS in transit, validation and malware scanning of uploaded work-document files before conversion and persistence, isolated conversion with resource limits, encryption of sensitive application fields and work-document content and attachments at rest, secure credential/device handling, backups, logging and procedures for availability and incident management. The Controller remains responsible for its own users, devices, passwords/keys, signature authority and local exports.

6. Assistance and incidents

Taking account of the nature of processing, the Processor will assist the Controller through appropriate technical and organisational measures with requests under Arts. 15–22 GDPR. The Processor will assist, taking account of available information, with Arts. 32–36 GDPR obligations, including security, personal-data-breach assessment, notification, communication, data-protection impact assessments and prior consultation. The Processor will notify the Controller without undue delay after becoming aware of a personal-data breach affecting Controller data and provide available information needed for the Controller’s assessment.

7. Audit and information

The Processor will make information reasonably necessary to demonstrate compliance with Art. 28 GDPR available to the Controller. Audits are primarily documentation- and remote-review based. Where reasonably necessary, the Controller may arrange an on-site audit during normal business hours with at least 30 days’ notice, no more than once yearly unless a material incident or authority requires otherwise, without disrupting operations and subject to confidentiality/security measures. The Controller bears its own costs; additional Processor effort may be charged at reasonable rates disclosed in advance.

8. Sub-processors and third-country transfers

The Controller gives general written authorisation for the sub-processors listed below. The Processor will give at least 30 days’ prior notice of an intended addition or replacement by email or account notice, allowing the Controller to object for documented data-protection reasons. If no reasonable solution is possible, the Controller may terminate the affected Service before the change takes effect. The Processor imposes materially equivalent data-protection duties on every sub-processor and remains responsible for its obligations.

PayPal processes Fier-App’s payment relationship as an independent controller, not as a sub-processor of Controller employee data. Google Maps is opened only on a user-initiated external link. Before a transfer outside the EEA, the Processor will ensure an applicable transfer mechanism under Chapter V GDPR and supplementary measures where required.

9. No unauthorised disclosure

The Processor will not disclose Controller data to third parties except on the Controller’s instruction, under this DPA, to authorised sub-processors, or where legally required. The Processor will not use Controller data for its own advertising, profiling or unrelated purposes.

10. Return and deletion at end of processing

At the Controller’s choice communicated at or before account closure, the Processor will return Controller data through the available export/support process or delete it. After the return period, deletion is the default. Deletion does not apply to copies which Union or Member-State law requires to be retained; those copies are blocked from ordinary processing and deleted when the legal obligation ends. Work documents, attachments, versions and operational read/download event data are subject to an 8-day default application retention period, as described in the Privacy Notice. On deletion of an employee or customer account, the minimum time-recording archive and linked correction-audit record are retained only until the event-based two-year baseline expires; signed activity-report proof records follow their separate three-year retention and are not removed by the operational-account cascade; backup copies expire on their documented rolling cycle. The Controller must promptly communicate a documented legal hold or longer applicable legal obligation. The Processor will confirm deletion on reasonable request.

11. Contact and precedence

Data-protection instructions and questions: support@fier-app.de. This DPA prevails over conflicting contract terms concerning processing of Controller data. It is governed by GDPR and, to the extent permitted, German law.