In this policy the following words and expressions shall, where the context so admits, be deemed to have the following meanings:

1. ‘Purpose’ shall mean the assessment of team cognitive load and related product development.
2. ‘Personal Data’ means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
3. ‘Data Subject’ means the identified or identifiable natural person to whom Personal Data relates;
4. ‘Data Protection Laws’ means all laws and regulations, including laws and regulations of the EU and the EEA and their respective member states, applicable to the Processing of Personal Data under this Agreement;
5. ‘EEA’ means the European Economic Area;
6. ‘EU’ means the European Union;
7. ‘GDPR’ means EU General Data Protection Regulation 2016/679;
8. “LOPDD” means spanish Data protection regulation https://www.boe.es/buscar/doc.php?id=BOE-A-2018-16673
9. ‘Processing’ means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
10. ‘Controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data;
11. ‘Processor’ means a natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of the Controller;
12. ‘Sub-processor’ means any third party appointed by FlowOnRails to Process User’s Personal Data in connection with the Agreement;
13. ‘Supervisory Authority’: (a) in respect of Processing that is subject to EU GDPR, has the meaning given in EU GDPR; and (b) in respect of Processing that is subject to any other Data Protection Laws, means any public authority responsible for the supervision of Data Protection Laws in the applicable jurisdiction;
14. ‘User’ shall mean a professional individual or a Legal Entity that has contracted the services of FLOWONRAILS SL
15. ‘Teamperature’ means the service provided by FlowOnRails

The nature and purpose of the Processing of Personal Data is for Teamperature  to perform team and organizational level assessments on Team Cognitive Load.

The objective of this processing is to identify Team Cognitive Load drivers, capture the root causes of unnecessary Cognitive Load in a work team context, understand the drivers of Cognitive Load, and help  manage the results to increase the productivity, well-being and performance of teams.

a. Browsing analytics

When browsing our website, we carry out analytical activities:

Processing performed: Analysis of users' navigation through the website managed by the controller to improve communication activities.

I. Group

Users who access websites or social media profiles managed by the controller.

II. Categories of Data

The type of data processed for this activity is as follows:

Browser user-agent strings and IP address logs, along with graphs and total values regarding the navigation of all users on each page of the website. These data are presented in a disaggregated manner, so that the controller cannot identify the users.

The use of Teamperature will require the processing of the following categories of data:

• Identification data
• Contact data
• Business data
• Seniority in the company
• Workplace type (remote, on site, hybrid)
• Gender
• Familiarity with the team
• Commercial data
• Any other data incorporated in the documents that the User makes use of in the context of the service provision.

In addition to the types of data specified in this point that are necessary for the purpose of the contracted service, Teamperature may request other optional data that may only be processed with the consent of the User for research and product improvement purposes, such as gender, seniority, how the team members work (on-site, remote, hybrid), team familiarity.

For processing these data, the User, as the data controller, ensures that obtains the informed consent of the employees. In any case, Temperature will anonymize the data and will never give them to the user, as foreseen in section VIII.c.

III. Purpose of the processing

Processing is performed for analytical purposes: Analysis of users' navigation through the websites in order to implement improvements according to the product’s Purpose.

IV. Legal basis

This data processing is legally justified by the Article 6. of the General Data Protection Regulation:

• For the performance of a contract with the client: users and team members data are necessary for that purposes. Teamperature will process those data as Data Processor.
• In the legitimate interest of the Data Controller: conduct team research, statistical analysis, etc.

a. Who is the controller and processor of your personal data of the contracted service?

The Data Controller will always be the User.

Teamperature is the Data Processor, and as such informs the User that data shall be processed in accordance with the provisions of Regulation (EU) 2016/679 of 27 April (GDPR) and the Organic Law 3/2018 of 5 December (LOPDD) and always pursuant to the instructions of the Data Controller (the User of Teamperature Services).

Teamperature does not need personal data for providing services but for the operation of the platform it is necessary that all team members complete some questions that will be processed anonymously by Teamperature.

b. Why do we process Team member’s personal data?

To provide the services contracted by the User: the user will be the person responsible for initiating the assessment of their teams for which they will have to enter the names and email addresses of the members of their teams.

The purpose of such processing will be solely and exclusively to send the surveys that will serve as the basis for the service provided.

Individual (team member) survey answers will be anonymous and will not be accessible to your company.

We do not do profiling and will not use your information and survey answers for anything other than obtaining anonymous statistics and analytics that we will provide to the User.

c. Why can we process your personal data?

Because the processing is based on legal basis established by article 6 of the GDPR as follows:

For the performance of a contract with the User: users and team members data are necessary for that purpose. Teamperature will process that data as DATA PROCESSOR.

In the legitimate interest of the CONTROLLER: conduct team research, statistical analysis, etc.

d. For how long will we keep your personal data?

Data will be stored until you delete your account.

e. To whom do we disclose your personal data?

Team members’ answers to surveys won’t be accessible, as all surveys will be anonymous and treated in aggregate.

No communication of personal data to third parties is foreseen except, if necessary for the development and execution of the purposes of the processing, to our suppliers of services related to communications.

We use a set of tools that allows us to select the destination and location of the information. We have configured the European Union as the data location for all of them.

The company maintains the information on servers located in European Union territories, thus, there will be no data transfer and the standards set by the GDPR will be maintained.

a. Confidentiality. Teamperature shall ensure that its personnel engaged in the data Processing are informed of its confidential nature, have received appropriate training on their responsibilities and have executed written confidentiality agreements.

b. Limitation of Access. Teamperature shall ensure that access to Personal Data is limited to those personnel performing work in accordance with the Purpose of this Privacy Policy.

c. Third parties. User authorizes Teamperature to appoint Third parties or Sub-processors (and permit each Sub-processor appointed in accordance with this section 5 to appoint their own sub-processors).

Teamperature may use Sub-processors provided that they ensure and maintain a data protection compliance status and capability equal to those maintained by Teamperture, to the extent applicable to the nature of the Services provided by such Third Party or Sub-processor. And always in accordance with the provisions established in the DPA.

The ownership of the data and information collected on Teamperature belongs solely to the Users. Access to this data will only be made for the purpose of providing the service in the best possible manner, without using the data and information for any purpose other than the provision of the service without the express consent of the owners.

In the event of data communication to third parties, it will be done for purposes directly related to the provision of the service or as required by legislation.

In accordance with the provisions of the current regulations on the protection of personal data, Teamperature is complying with all the provisions of the GDPR and LOPDGDD regulations for processing the personal data, and is manifestly complying with the principles described in Article 5 of the GDPR, by which they are processed in a lawful, fair and transparent manner in relation to its users, the data subject and appropriate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

Teamperature guarantees that all appropriate technical and organizational policies have been implemented to apply the security measures established by the GDPR and LOPDGDD in order to protect the rights and freedoms of Users.

We change this Privacy Policy from time to time. We will not reduce your rights under this Privacy Policy without your explicit consent. We always indicate the date the last changes were published. If changes are significant, we’ll provide a more prominent notice (including email notification of Privacy Policy changes).