Spifex
Start free

Guides

GDPR Compliance Guide for Spifex Customers

A practical GDPR guide for Spifex customers: controller and processor roles, legal bases, DPA, data subject requests, transfers and security.

Last updated:

This guide is for customers who use Spifex to process personal data and want a practical way to organize their GDPR compliance. Your obligations depend on your role, your data and your jurisdiction.

1. Understand your role

In most business workspaces, the customer is the controller and Spifex is the processor. The customer decides:

  • why the data is processed;
  • which data is entered;
  • who can access it;
  • how long it is retained; and
  • which integrations are connected.

Spifex processes the data to provide, secure and support the service. For account administration, security and billing, Spifex may act as an independent controller as described in the Privacy Policy.

2. Confirm your legal basis

Identify the lawful basis for each processing purpose, such as:

  • performance of a contract;
  • compliance with a legal obligation;
  • legitimate interests; or
  • consent, where required.

Document the basis before you collect the data. Do not use “consent” as a fallback when another basis applies.

3. Sign or incorporate the DPA

Use the Data Processing Agreement to document:

  • instructions for processing;
  • security measures;
  • subprocessors;
  • international transfers;
  • breach notification;
  • data subject assistance; and
  • deletion or return.

If you need a signed DPA or a completed annex, contact legal@spifex.com.

4. Keep a record of processing

Maintain a record that covers:

  • categories of data subjects and personal data;
  • purposes of processing;
  • recipients and subprocessors;
  • transfers outside the EU/EEA;
  • retention periods; and
  • security measures.

Spifex can provide information about the service, subprocessors and security controls. You remain responsible for your own record.

5. Minimize and classify data

  • Collect only what you need.
  • Avoid special categories of data unless you have a lawful basis and appropriate safeguards.
  • Use projects, departments and categories to keep ownership clear.
  • Do not upload data you are not authorized to process.

6. Configure access and roles

  • Give users the minimum permissions they need.
  • Review roles when people change teams or leave.
  • Restrict sensitive actions to owners and administrators.
  • Enable MFA where available.
  • Revoke integrations and AI connections that are no longer needed.

7. Handle data subject requests

You are responsible for responding to requests from data subjects. Spifex provides product features and support to help you:

  • access and export data;
  • correct records;
  • delete data where available; and
  • restrict or object to processing where applicable.

If Spifex receives a request relating to your workspace, we will redirect it to you where appropriate.

8. Manage retention

Use the Data Retention Policy to align your workspace settings with your obligations. Export data you need before ending a subscription.

9. Review international transfers

If you or your users access the service from outside the EU/EEA, or if a subprocessor processes data outside the EU/EEA, confirm that an appropriate transfer mechanism applies. The DPA describes the mechanisms Spifex uses.

10. Protect the workspace

Follow the Security and Technical Organisational Measures:

  • protect credentials;
  • review access regularly;
  • use secure devices;
  • monitor unusual activity; and
  • report suspected incidents promptly.

11. Prepare for incidents

Know how you will:

  • detect and contain an incident;
  • assess whether personal data is affected;
  • notify your supervisory authority within 72 hours where required; and
  • communicate with affected individuals where required.

Spifex will notify you without undue delay when a personal data breach affects your data, as described in the DPA.

12. Document AI use

If you enable AI connections:

  • keep the scope read-only unless you have a controlled use case;
  • authorize each user separately;
  • verify outputs before acting on them;
  • avoid automated decisions about individuals; and
  • revoke access when no longer needed.

See the AI Transparency Notice.

13. Review vendors and subprocessors

Review the Subprocessors page and subscribe to change notifications. If you object to a new subprocessor on reasonable data protection grounds, contact us.

14. Maintain your own policies

Your internal policies should cover:

  • acceptable use;
  • access control;
  • retention;
  • incident response;
  • vendor management; and
  • employee training.

Compliance checklist

  • Roles and legal bases documented
  • DPA incorporated or signed
  • Record of processing maintained
  • Access roles reviewed
  • Retention configured
  • Transfer mechanism confirmed
  • Data subject request process defined
  • Incident response plan tested
  • AI connections reviewed and revoked when unused
  • Subprocessors reviewed

Contact