Privacy & Cookie Policy

1.Data We Process as Controller

When you register, contact us, or use Workflow as an account holder, we process the following personal data as a controller:

• Account data — name, email, phone, organisation, role and authentication details (including two-factor authentication, if you turn it on), to create and secure your account (legal basis: performance of contract, Art. 6(1)(b) GDPR).
• Billing data — the details needed to charge you for the service and to keep the related records (Art. 6(1)(b) and, for tax records, Art. 6(1)(c)).
• Usage and device data — server logs and IP addresses used to operate and secure the service (legitimate interest, Art. 6(1)(f)). If you turn on browser push notifications for events in your workshop, your browser’s push subscription is stored with your account until you turn them off. We do not use analytics or advertising trackers.
• Marketing data — where you opt in, to send product updates (consent, Art. 6(1)(a)).

2.Data We Process as Processor

Car workshops (“Workshops”) use Workflow to run their work. The personal data they enter is Customer Data: we process it only on the Workshop’s documented instructions and solely to provide the service, as their processor under our Data Processing Agreement. The Workshop is the controller. Customer Data may include:

• The Workshop’s customers and their contact persons — names, addresses, phone numbers, email addresses, and tax numbers where an invoice requires them.
• Their vehicles — plate, VIN, mileage, photos of the car’s condition, findings and inspection results, and the service history.
• The Workshop’s staff and technicians — names, contact details, roles, and the time they clock on jobs.
• The Workshop’s suppliers — contact persons and their details.
• Messages and photos of the in-app conversations between the office and its business customers — the text, the photos, who wrote them and when.
• Photos and short videos of the car taken by the Workshop at check-in, for findings and inspections, and for the reports it sends.
• The customer’s answers through the public pages — estimate approvals, quote and booking requests, and email opt-outs.

The estimate, inspection, status-report and reminder pages open from a link in an email, without an account; the Workshop can stop such a link at any time. If you are a customer of a Workshop, or one of its employees, and have a question about your data, please contact the Workshop (the controller); we will assist it as required.

3.Cookies and Similar Technologies

We only use cookies that the service needs or that remember a choice you made. We do not use analytics, advertising or third-party cookies, so we do not ask for cookie consent.

• Sign-in (wf_access) — keeps you signed in. Strictly necessary.
• Language (NEXT_LOCALE) — remembers the language you chose, for one year.
• Layout (sidebar_state) — remembers whether the side menu is open.

The service also keeps in your browser’s local storage what it needs to keep you signed in (sign-in tokens, your workspaces and profile) and some display preferences, such as the theme and the width of the details panel.

4.Third Parties and International Transfers

We share personal data with the service providers (sub-processors) needed to operate Workflow — currently: Oracle Cloud Infrastructure, Brevo (Sendinblue SAS), VIES (European Commission). The full registry, including each provider’s role and location, is maintained in Schedule 1 of our Data Processing Agreement. All of them are established in the European Union, so personal data stays within the EU. Should we add a sub-processor outside the European Economic Area, we would give notice first and the transfer would be protected by an adequacy decision or by appropriate safeguards such as the EU Standard Contractual Clauses together with supplementary measures.

On the Workshop’s instructions, data is also disclosed to its customers — through the emails with estimates, invoices, status messages, reports and reminders, and the public links in them — and to VIES (European Commission) to validate a business customer’s EU VAT number.

5.How Long We Keep Data

• Operational and security logs — up to 12 months after account termination.
• Marketing data — up to 24 months after the relationship ends.
• Messages and photos of the conversations — deleted 3 months after they are sent.
• Other Customer Data — kept while the Workshop’s account is active and deleted within 30 days of account termination.
• Records required by law — up to 7 years where required by applicable law.

6.Your Rights

Where we are the controller, you have the right to access, rectify, erase, restrict or port your personal data, and to object to processing or withdraw consent at any time. Where Workflow is the processor, please direct such requests to the controller (the Workshop or the organisation that holds the account); we will assist them as required. You also have the right to lodge a complaint with a supervisory authority: ours is the Office of the Commissioner for Personal Data Protection in Cyprus, and you may also turn to the authority of the country where you live or work — in Greece, for example, the Hellenic Data Protection Authority.

Contacting us

For any privacy question or to exercise your rights, contact us at privacy@workflow.woocargo.com. Controller: Woocargo Ltd, Reg. No. HE 403674, VAT CY10403674R, 4A Andrea Assioti, Akropoli, 2007 Nicosia, Cyprus. Tel. +357 22397742.

7.Updates to This Policy

We may update this policy from time to time. Material changes will be notified through the service or by email, and the “last updated” date above will reflect the latest version.