GDPR Compliance

ProBeya is committed to protecting personal data in compliance with the General Data Protection Regulation (GDPR). This page explains how we handle data and what tools are available to administrators for compliance.

Data Processing

ProBeya acts as a data processor on behalf of your organization (the data controller). We process personal data only as necessary to provide the service:

• User account data -- Name, email address, avatar, authentication credentials, and MFA secrets.
• Usage data -- Activity logs (stored in the activity_log table), session data, and feature usage analytics.
• Content data -- Items, comments, file attachments, KPI values, and other content created by users.
• Membership data -- Organization memberships, role assignments, and workspace access records.

All personal data is scoped by organizationId for tenant isolation, ensuring that data processing is limited to the organization context.

Data Residency

ProBeya stores data in the following regions:

• EU (Frankfurt) -- Default for organizations in Europe.
• US (Virginia) -- Default for organizations in North America.
• AP (Singapore) -- Default for organizations in Asia-Pacific.

Enterprise customers can choose their data residency region during organization setup. Data does not leave the selected region. File attachments are stored in S3-compatible object storage within the same region.

Right to Access (Article 15)

Users and administrators can export all personal data associated with an account:

1. Navigate to Settings > Data > GDPR.
2. Click Request Data Access Report for a specific user.
3. The report is generated within 24 hours and sent to the administrator's email.

The report includes all personal data: profile information, items created, comments, activity history, KPI entries, and metadata. Activity log entries include the actor's name, email, and action timestamps.

Right to Erasure (Article 17)

To delete a user's personal data:

1. Navigate to Settings > Data > GDPR.
2. Click Request Data Erasure for a specific user.
3. Review the data that will be affected.
4. Confirm the erasure.

Erasure removes:

• The user's profile and account data (name, email, avatar).
• The user's name from comments and activity logs (replaced with "Deleted User").
• The user's personal notification preferences, sessions, and MFA backup codes.
• The user's API keys and their bcrypt hashes.

Erasure does not remove:

• Items created by the user (they remain but show "Deleted User" as creator).
• Comments by the user (content remains, author shows "Deleted User").
• KPI values entered by the user (values remain, source attribution is anonymized).

This approach preserves the integrity of project and compliance data while removing personal identifiers, which is consistent with the GDPR principle of data minimization.

aviso

Data erasure is irreversible. The anonymization of activity logs and comments cannot be undone. Ensure the request is legitimate before confirming.

Right to Portability (Article 20)

ProBeya supports data portability through the Data Export feature. Organizations can export all data in machine-readable formats (CSV and JSON) at any time. The JSON export provides a complete hierarchical representation of all organization data suitable for migration to another platform.

Data Processing Agreement (DPA)

ProBeya provides a Data Processing Agreement for organizations that require one:

1. Navigate to Settings > Data > GDPR.
2. Click Download DPA.
3. The DPA can be countersigned electronically or printed for physical signatures.

Enterprise customers receive a custom DPA as part of their contract.

Sub-Processors

We maintain a list of sub-processors (third-party services that process data on our behalf):

Sub-Processor	Purpose	Location
Cloud infrastructure provider	Hosting and storage	EU/US/AP
Resend	Transactional emails	EU
Stripe	Billing and payments	US (PCI compliant)
Error tracking	Application monitoring	EU
S3-compatible storage	File attachments	Same as data region

The current sub-processor list is available at Settings > Data > GDPR > Sub-Processors. We notify organization administrators at least 30 days before adding a new sub-processor.

Data Retention

Data Type	Retention Policy
Active account data	Retained while the account is active
Audit log (Free)	7 days
Audit log (Pro)	90 days
Audit log (Enterprise)	Unlimited (configurable)
Post-cancellation	90 days after subscription cancellation
Erasure requests	Processed within 30 days of confirmation

Breach Notification

In the event of a data breach affecting personal data, ProBeya will:

1. Notify affected organization administrators within 72 hours (Article 33).
2. Provide details of the breach, data affected, and remediation steps.
3. Assist with regulatory notifications as required (Article 34).

Contact

For GDPR-related inquiries, contact our Data Protection Officer at [email protected].

Related Features

• Data Export -- Export all data for portability.
• Audit Log -- Complete audit trail for compliance.
• Security Settings -- 2FA, session management, and access controls.
• Guest Access -- Control external stakeholder data exposure.