Data protection and DPA: GDPR-compliant provision

At first glance, digital instructions for use process hardly any personal data. But as soon as users request a paper copy or your team works in the app, names, addresses, email addresses and login data are involved. This page explains how ManualPass handles them. Technical safeguards such as encryption and tenant separation are described on the Security page.

Which personal data is involved?

Who is the controller, who is the processor?

The controller within the meaning of the GDPR is whoever determines the purposes and means of processing. The processor is whoever processes personal data on behalf of and on the instructions of the controller.

Conclude the DPA online in the app

A data processing agreement (DPA) governs, under Article 28 GDPR, how a service provider processes personal data on behalf of a customer. With ManualPass, you conclude it directly in the application:

1. In the app, open the “Data protection & DPA” section.
2. Review the text of the agreement with the technical and organisational measures (TOMs) in Annex 2.
3. Conclude the agreement electronically.
4. Save the concluded agreement as a PDF for your records.

The electronic form is sufficient: in addition to written form, Article 28(9) GDPR expressly permits an electronic format. The audit log records the conclusion of the DPA with time and person.

Where is the data processed?

All data is stored on servers in Germany: documents, log, team and account data as well as the details from paper copy requests. The only sub-processor is the hosting provider lima-city (TrafficPlex GmbH, Bremen).

Scan page without cookies and without tracking

The scan page is the public web page that users see after scanning the QR code. It sets no cookies and uses no tracking. Your customers are therefore not tracked while reading the instructions.

Paper copy requests: data minimisation through anonymisation

If a user requests a paper copy, the manufacturer needs their name and address for dispatch. After that, these details are no longer required. ManualPass therefore anonymises paper copy requests automatically after dispatch:

• Selectable period: 6, 12, 24 or 36 months after dispatch.
• Retained: the date, machine and status of the request.
• Removed: the requester's personal details.

This way, you can still prove that requests were handled on time without keeping address data longer than necessary. The Paper copy request page describes the request process.

Security data deleted after 24 hours

ManualPass stores failed login attempts and expired password reset links only briefly to prevent misuse. This data is deleted after 24 hours. Only the entries in the audit log, such as successful logins, are kept longer, because they serve as proof of who performed which action and when.

Text module for your privacy policy

As the controller, you must inform users about the processing, so ManualPass provides a text module in the app. You include it in your own privacy policy and adapt it to your company. The module describes that you use a service provider to provide the documents and handle paper copy requests. Check the adapted text with your data protection officer.

Data protection checklist

• Conclude the DPA in the app under “Data protection & DPA” and file it as a PDF
• Set the anonymisation period for paper copy requests
• Include the text module in your own privacy policy
• Enter ManualPass and its sub-processor in your record of processing activities