Data processing agreement

What data of your company —and of the people who work in it— we process when you use the area, what for, for how long and under which obligations.

Who is who

The chain matters, because it sets each party's obligations. Your company is the controller of the data of the people who appear in the descriptions —usually its employees—. Handmetric is the processor: it processes that data on your behalf, on your instructions and for nothing else. And the providers listed further down are our sub-processors.

If you describe a client's processes —an accounting firm explaining how it runs payroll for a company it advises, say—, then that client is the controller, you are its processor and we are sub-processors. In that case you need an agreement with the client that allows you to engage sub-processors. We cannot verify that for you: by accepting this text you declare that you have one.

Subject matter, nature and purpose

Handmetric receives the descriptions of work processes you write or upload, turns them into ordered steps, estimates their cost, automation potential, risk and priority, and keeps all of it in your area so you can consult it, re-analyse it and compare it. The only purpose is providing you that service. It is not used to train anything, nor to build profiles, nor shared with anyone.

What data, and whose

Whatever appears in a process description: the name of whoever performs each step, the software they use, how long it takes and how often, and whatever you yourself say when describing it. The data subjects are the people in your company who appear in those descriptions and, if you name them, those of your clients.

Instructions

Data is processed solely on your documented instructions. Describing a process is one instruction; analysing it is another; storing it in your area, another. Nothing else is done with it. If any instruction of yours appeared to infringe data protection law, you would be told before it was carried out.

Confidentiality

Anyone with access to this data is bound by a duty of confidentiality. Today technical access is held by one person: the one named as controller in the legal notice.

Security measures

Encryption in transit on every connection. Encryption at rest of process descriptions, of each step's description and of the names of whoever performs them, with a different key per organisation. Isolation between organisations enforced by the database itself rather than by application code, so that a programming error cannot expose another client's data. Error logging without personal data. Backups carry the descriptions just as encrypted as the database does.

Sub-processors

The following providers take part in delivering the service. Hosting and identity providers process data in the European Union; the language model provider processes the text of your descriptions in the United States under the EU–US Data Privacy Framework and, by contract, does not use it to train models:

• IONOS SE — alojamiento del servidor — Alemania
• Google LLC — verificación de la cuenta y modelo de IA — EE. UU.

Any addition or removal of sub-processors will be announced at least thirty days in advance, so that you can object and, if you do, terminate without penalty.

For how long

What you describe and what is estimated is kept for as long as you have the account. There is no automatic deletion by age today; if one is set, you will be told before it applies. When the account is closed everything is deleted within thirty days at most, backups included, unless the law requires something to be kept — which does not happen in this service.

Data subject rights

If a person who appears in your descriptions exercises their rights, the party bound to answer is you, as controller, not us. We undertake to assist you in locating and erasing their data, and to forward to you any request that reaches us directly rather than answering it ourselves.

Personal data breaches

If a security breach affecting your data occurs, you will be notified without undue delay and in any case within 48 hours of it becoming known, with whatever is known at that point. Notifying the supervisory authority, where required, falls to the controller.

Audit

You may request the information needed to demonstrate compliance with these obligations. Handmetric is a small product and holds no third-party certifications: what exists is this document, the code, and a willingness to answer any specific question.

On termination

When you close your account everything described and everything estimated is erased. If you want to keep something, download each project's report as a PDF first: it is the only export there is. The deletion is real and there is no copy to recover afterwards.

Document version: 2026-09-13

This is a courtesy translation. The Spanish version is the original and is the one that binds; in case of discrepancy, the Spanish text prevails.