Who is controller and who is processor?
For commission and salary data, your company is the data controller and Prowi ApS (CVR 43243977, Klamsagervej 35, 8230 Åbyhøj) is the data processor, acting on your instructions under the DPA. For our own website, marketing and account data, Prowi is the controller.
What personal data does Prowi process for us?
Names, work email addresses and roles of the people on a commission plan; the deals, amounts and dates your CRM sends; the statements Prowi calculates from them; and the approvals and comments made in the platform. Prowi does not process CPR numbers, bank details or health data.
Where is data stored?
Exclusively within the EU/EEA. The application runs on Heroku in AWS EU-Central-1 (Frankfurt); the database and file storage are in AWS EU-North-1 (Stockholm). No customer data is processed or stored outside the EU/EEA. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
Which sub-processors do you use?
Heroku (Salesforce) and Amazon Web Services for hosting, plus the tools listed in Appendix B of the DPA. We give at least 4 weeks' written notice before adding or replacing a sub-processor, and you have the right to object. The current list is maintained at prowi.io/sub-processors.
Who can see a rep's commission?
The rep, the approvers named on the plan and administrators at your company. Prowi staff access production data only for support at your request, and access is logged.
How long is data kept, and what happens when we leave?
Personal data is retained for up to 5 years from the date of entry and then deleted automatically, unless you request earlier deletion or an extension within legal limits (Danish bookkeeping rules require 5 years for payroll records). On termination you can export all statements, and Prowi erases or returns the data as set out in Section 9 of the DPA.
What happens in a breach?
Prowi notifies you, where possible, within 24 hours of becoming aware of a personal data breach, with what happened, what data was affected and what has been done, so that you can meet your 72-hour duty to Datatilsynet. Where Prowi is itself the controller, Prowi notifies Datatilsynet within 72 hours.
How do we handle a data-subject request?
Write to legal@prowi.io. Prowi assists with access, rectification, erasure, restriction and portability requests within the statutory deadlines, as described in Section 7 of the DPA.
Can we audit you?
Yes. The DPA gives you an annual inspection right, including on-site, with 30 days' written notice (5 business days where a breach is suspected). Prowi also makes available the information needed to demonstrate compliance with Article 28 GDPR.
Is there a DPA, and do we have to sign it?
Yes, it is part of every customer agreement and is published on this site under Data processing agreement. It follows the Danish Data Protection Agency's standard clauses.
Who do we contact?
Data protection matters: legal@prowi.io or +45 70604554. If you believe we have not addressed your concern, you can complain to Datatilsynet (dt@datatilsynet.dk).