Data Processing Terms

1. Roles

The customer company is the controller of the personal data of its employees, customers and suppliers: it decides what is entered and who sees it. Rawad is the processor: it stores and processes that data on the company's instructions and only to provide the service. Rawad is a controller only of account data (who signed up, when, and the means of sign-in).

2. Instructions and purpose

Rawad processes data as the company's settings and use of the service direct; those are its instructions. We do not sell data, use it for advertising or to train models, and do not look at its content except for support the company asked for, or to deal with a fault or a security incident.

3. Confidentiality and access

Access to the systems is limited to those who operate the service, with two-step sign-in, and every administrative access is logged. Anyone with access is bound to keep the data confidential.

4. Security

Each company's data isolated at the database level, encrypted connections, encryption of secrets and sensitive files, hashed passwords checked against leaked ones, two-step sign-in, roles and permissions, an activity log, rate limits, and daily encrypted backups with a tested restore.

5. Where the data is, and cross-border transfer

Data is hosted in Germany with Hetzner (EU). Regional hosting is planned, with no date set. By accepting these terms the company, as controller, agrees that its data is processed outside its country by the sub-processors listed below, and is responsible for checking that its own law allows this and for informing the people concerned where required.

6. Sub-processors

Hetzner (Germany): hosting, all data. Cloudflare: network edge, requests and internet addresses pass through with no content stored. Resend (Ireland): email — recipients' names, addresses and the notification text. Browser push services (Google, Apple, Mozilla): the notification's title and link only. Have I Been Pwned: password check, no personal data. We tell companies thirty days before adding a new sub-processor, and a company may object by ending its use.

7. Rights of the people concerned

The service gives the company what it needs to answer requests from the people concerned: access and export (per employee, from their own account or by HR), correction, reducing a former employee's data and removing their identity after the retention period. A request that reaches us directly is passed to the person's company.

8. Breach notice

If we learn of a breach affecting a company's personal data we notify that company without delay: what happened, which data, what we did and what we advise. Notifying the authority and the people concerned, where the company's law requires it, is the company's duty as controller, and we help with the information needed.

9. Retention

Payroll and accounting records are kept for 10 years by default, a period the company sets in its settings. Other data is kept according to its kind, as set out in the Privacy Policy and the record of processing.

10. Export and deletion on exit

On a request to close, the workspace stays available for export for thirty days and we provide a full copy on request. After that its data is deleted from the service, and leaves the backups as their cycle runs out (thirty days).

11. Verification

We answer a company's reasonable questions about how its data is processed and protected, and provide the record of processing on request: [email protected].

Sub-processors