Data Processing Agreement
Version 2026-10 · Published 17 October 2026
1. Parties, subject matter and acceptance
This agreement is made between the iTrackFlow customer organisation ("Customer"), as controller, and InovaSkills – Sistemas de Informação e Segurança, Lda, tax number 513 557 059 ("InovaSkills"), as processor, under Article 28 of Regulation (EU) 2016/679 ("GDPR"). It governs the processing of personal data that InovaSkills carries out on behalf of the Customer when providing the iTrackFlow service, described in Annex 1.
The agreement is part of the Terms of Use and is accepted electronically when the account is created, with date, version and IP address recorded. On request, InovaSkills provides a signed version with the same content.
This agreement does not cover the data for which InovaSkills is the controller (account, billing, security data and technical statistics), described in the Privacy Policy.
2. Customer instructions
InovaSkills processes personal data only on documented instructions from the Customer, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in that case it informs the Customer before processing, unless the law prohibits it. The Customer's instructions are these terms, the settings and actions taken in the app by the Customer and its Users, and written requests sent to info@itrackflow.com. InovaSkills informs the Customer if it considers that an instruction infringes the GDPR.
3. Confidentiality
InovaSkills ensures that the people authorised to process personal data have committed to confidentiality or are under a statutory obligation of confidentiality, and that they only access workspace content when needed to provide the service, solve a problem raised by the Customer or comply with a legal obligation.
4. Security
InovaSkills applies the Article 32 GDPR technical and organisational measures described in Annex 2. It may update them over time, provided the level of security does not decrease.
5. Sub-processors
- The Customer gives InovaSkills a general authorisation to engage sub-processors. The current list is in Annex 3.
- InovaSkills informs the Customer of any addition or replacement at least 30 days in advance, by email to the subscription holder and on the sub-processors page.
- The Customer may object, on reasonable grounds, within that period. If the parties do not reach agreement, the Customer may terminate the contract at no cost before the change takes effect, with a refund of the unused part of the paid period.
- InovaSkills imposes on each sub-processor, by contract, data protection obligations equivalent to those in this agreement and remains liable to the Customer for their performance.
6. International transfers
Data is hosted in the European Union, on InovaSkills' own infrastructure in Portugal. InovaSkills only transfers personal data outside the European Economic Area, or allows a sub-processor to do so, with one of the safeguards of Chapter V GDPR (an adequacy decision or standard contractual clauses adopted by the European Commission), shown in Annex 3.
7. Data subject rights
The app lets the Customer view, correct, export and delete the data of its Users and Portal users. If InovaSkills receives a request from a data subject about that data directly, it forwards it to the Customer without delay and does not answer it, unless instructed by the Customer. InovaSkills gives the Customer the reasonable assistance it needs to answer requests the app cannot fulfil.
8. Personal data breaches
InovaSkills notifies the Customer, by email to the subscription holder, without undue delay and at the latest within 48 hours of becoming aware of a personal data breach affecting the Customer's data. The notice includes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Information not yet available is provided in phases as it becomes known. InovaSkills documents every breach.
9. Assistance to the Customer
Taking into account the nature of the processing and the information available to it, InovaSkills assists the Customer in meeting the obligations of Articles 32 to 36 GDPR (security, breach notification, impact assessments and prior consultation). Assistance beyond what is reasonable, or arising from Customer requests unrelated to a failure by InovaSkills, may be charged at prices agreed in advance.
10. End of processing
Until access ends, the Customer can export its data through the app's exports, including during the read-only period provided for in the Terms. After the contract ends, InovaSkills deletes the Customer's personal data within the periods in the Terms — at least 45 days after access ends — and does not keep it unless required by law. Deleted data disappears from backups when they expire, within the period shown in Annex 2. At the Customer's request made before deletion, InovaSkills may bring it forward and confirm in writing that it has been done.
11. Information and audits
InovaSkills makes available to the Customer the information needed to demonstrate compliance with Article 28 GDPR and answers reasonable security questionnaires in writing. Where that information is not sufficient, or a supervisory authority requires it, the Customer may carry out or commission an audit, directly or through an independent auditor bound by confidentiality, with 30 days' notice, no more than once a year, on business days and without disrupting the service or exposing other customers' data. The Customer bears the cost of the audit, unless it reveals a material breach by InovaSkills.
12. Liability, term and precedence
The parties' liability is governed by Article 82 GDPR and, to the extent the law allows, by the limits in the Terms. This agreement remains in force for as long as InovaSkills processes personal data on behalf of the Customer. On data protection matters it prevails over the Terms. It may be changed as provided in the Terms for contract changes, except for sub-processors, which follow clause 5.
Annex 1 — Description of the processing
| Subject matter and nature | Hosting, storage, organisation, consultation, export and deletion of data in the iTrackFlow service (web app and client portal), and sending the service's emails. |
|---|---|
| Purpose | Providing the Customer with the time tracking, approvals, absences, expenses, to-dos, reporting and client portal service. |
| Duration | The term of the contract plus the deletion periods in clause 10. |
| Data subjects | Staff and other people the Customer invites to the app; people the records refer to (for example contacts of the Customer's clients); client portal users (contacts of the Customer's clients). |
| Categories of data | Identification and contact (name, email, role, language); time entries, descriptions, projects, tasks, clients and tags; time-off and absence requests and their type; expenses and receipts; to-dos; portal service requests and messages; profile photo; technical data on account use in the workspace (audit log with IP address). |
| Special categories | The service is not intended for special categories of data. The "sick leave" absence type may reveal health-related information; the Customer decides which absence types it uses, is responsible for the legal basis of that processing and must not record clinical information. The absence type is visible only to the person, to whoever approves the request and to the workspace owners and administrators. |
Annex 2 — Technical and organisational measures
- Encryption: communications always over HTTPS (TLS 1.2 or higher, HSTS); secrets (two-step keys, service passwords) encrypted at rest with keys protected by the operating system.
- Authentication: passwords stored with Argon2id, at least 10 characters, no reuse of the previous 5; two-step verification (TOTP) available; progressive lockout after failed attempts; request limits per IP address; single-use codes and links stored only as hashes and short-lived.
- Sessions: limited to 12 hours; revoked on sign-out and when the password or email changes.
- Access control: logical separation of data by workspace, checked on every request; least-privilege roles (owner, administrator, project manager, member); portal users limited to their own client's requests; InovaSkills support access limited to account management data.
- Infrastructure: service hosted in the European Union, on InovaSkills' own infrastructure in Portugal; least-privilege database accounts; internal support interface reachable only from authorised networks; security headers and a restrictive content policy in the web apps.
- Logging and monitoring: audit log of relevant changes and security events (90 days); service monitoring and operational alerts.
- Availability and recovery: verified database backups kept at another InovaSkills site in Portugal — transaction logs 5 days, daily full backups 6 days, weekly 4 weeks, monthly 12 months, yearly 3 years; documented update procedures with a prior backup and restore.
- Development: automated tests, security reviews and regular component updates.
- Organisation: access restricted to those who need it, under confidentiality commitments; personal data breach procedure (clause 8).
Annex 3 — Sub-processors
The current list, with each sub-processor's role, entity, location and transfer safeguard, is on the Sub-processors page, which is part of this agreement.