Privacy and GDPR
How PHOENIX GROUP processes data, and what our data processing agreement contains.
1. Two different roles
Controller : PHOENIX GROUP, for the data of its prospects and customers (site visitors, contacts, account administrators, invoicing).
Processor : PHOENIX GROUP, for the data of the employees the Customer manages in Workplan. The Customer (the employer) is then the controller.
2. Customer and prospect data
- Data
- Name, email, phone, company, RCS and VAT numbers, invoicing and payment data (full card numbers are processed by Stripe, not by Workplan).
- Purposes
- Answering requests, managing the trial and subscription, invoicing, providing support.
- Legal basis
- Performance of the contract and pre-contractual measures; legal accounting obligations; legitimate interest in the security of the service.
- Retention
- Duration of the business relationship, then 10 years for accounting records.
3. Summary of the data processing agreement (DPA)
The full agreement is annexed to the terms and conditions and accepted when the account is opened. In summary, PHOENIX GROUP undertakes to:
- Purpose : process the Customer's employee data solely to provide Workplan (scheduling, time tracking, absences, hours, documents, payroll exports), and only on the Customer's documented instructions.
- Data concerned : identity and contact details, contract and schedules, clock-ins (with location at clock-in and photo if the Customer enables it), absences and supporting documents, documents uploaded by the Customer. Some may be health data (medical certificates): access restricted to the administrator and the people they authorise.
- Privacy : only authorised PHOENIX GROUP staff access the data, under a duty of confidentiality, and only for support or maintenance.
- Security : encrypted communications (HTTPS), hashed PINs and passwords, biometrics stored only on the employee's device, data segregated per customer, daily backups, logging of corrections.
- Sub-processors : list below; the Customer is informed 30 days before any change and may object.
- Location : service data hosted in the European Union. Sole exception: the built-in help assistant, reserved for the Customer's administrators, uses xAI (United States); this transfer is governed by the European Commission's Standard Contractual Clauses and limited to the data needed for the answer (employee names pseudonymised, no contact details).
- Assistance : helping the Customer respond to access, rectification or erasure requests from its employees, and with its impact assessments.
- Data breach : notification to the Customer without undue delay and at the latest within 48 hours of becoming aware of it.
- End of contract : export possible for 30 days, then deletion of the data, unless there is a legal obligation.
- Audit : making available the information needed to demonstrate compliance with Article 28 GDPR.
4. Sub-processors
| Provider | Role | Location |
|---|---|---|
| Hostinger International Ltd | Hosting of the application and emails | EU |
| Stripe Payments Europe Ltd | Card payment (Customer invoicing data only) | EU (Ireland) |
| Odoo SA | Invoicing and accounting (Customer invoicing data only) | EU (Belgium) |
| X.AI LLC (xAI) | Help assistant built into the application, used only by the Customer's administrators (the question asked and the scheduling, hours and absence data needed for the answer; names pseudonymised, no contact details) | United States (Standard Contractual Clauses) |
5. Your rights
Access, rectification, erasure, restriction, objection and portability. Employees of a customer: first contact your employer. For any request: support@workplan.lu. You can also lodge a complaint with the National Commission for Data Protection (cnpd.public.lu).
6. Cookies
No advertising cookies or audience measurement tools. The application uses a strictly necessary session cookie.