1. Controller and contact

SafeProtokol is operated by Sharif El Fatatry. For the operator’s own processing purposes described in this policy, the controller is:

Sharif El Fatatry — Operator of SafeProtokol
Correspondence address:
Apartado de Correos 26
Carrer de la Indústria, 30
08202 Sabadell, Barcelona
Spain

Email: support@safeprotokol.org
Telephone: +34 651 070 393
Website: safeprotokol.org

2. Scope and roles

This policy explains personal data processing on our website and in the SafeProtokol native iPad application. The application helps businesses create digital protocols and documentation across technical and professional fields, including RIS and SHK.

We act as controller for administering our service and user accounts, our own security purposes and handling inquiries addressed to us.

When a business enters information about its customers, employees, contacts or signatories into projects and protocols, that business generally determines the purposes of processing. We process that content on the business's behalf and under its instructions. The details are governed by the data processing agreement. The business's own privacy information supplements this policy, particularly regarding its lawful bases, information duties and retention decisions.

An account uses an email address and password. Profile information includes first and last name, telephone number and, where applicable, a display name. A user identifier, verification status and technical timestamps are also processed. Sign-in, email verification and password recovery use a Google authentication service. Your password is transmitted to that service and is not stored as an ordinary profile field in the application database.

Authentication tokens and session information support signed-in use. A session may persist on the device until you sign out or it ends for another reason. Signing out does not delete your account or the business's documentation.

Information required for registration and sign-in is necessary to provide a personal account and associate access permissions with it. The corresponding account functions cannot be used without that information.

4. Businesses, invitations and employees

Creating and administering a business workspace involves the business name, identifiers, memberships, roles and statuses. The business profile may include its address, contact details, proprietor or management details, and registration and tax information where entered. A selected business logo may be stored for display and PDF output.

Administrators can invite people using their email addresses and manage access rights. We process the invitation, intended role, inviting person, validity and acceptance, and administrative timestamps and history. Invitation information comes from the inviting business; membership details may be taken from the user's profile. The inviting person may distribute invitation instructions using the device's sharing functions.

Active members can access projects and protocols within their business. Project assignments organise work and do not establish a confidentiality boundary against other active members of the same business. Revoking membership does not automatically delete the person's account or business documents already created.

5. Projects, protocols and content

Depending on use, processing includes project names and numbers, customer and contact information, email addresses, telephone numbers, project addresses, employee assignments, protocol content and timestamps. Protocols contain completed form values and information about creation, editing and versions.

The actual content depends on the protocol type and the business's entries. Not every protocol contains every listed category. The business decides which personal information is necessary and lawful for its documentation and informs the people concerned.

6. Signatures, sketches, images and PDF export

Supported form fields allow drawn signatures and sketches, including drawings and text. These are processed together with association, creation and synchronisation information. The described functionality does not perform automatic biometric identification using a signature.

You can select specific images for business logos using the iPad photo or file picker. Selecting an image does not provide general access to your entire photo library. General camera capture and arbitrary document uploads are not part of the functionality described here.

PDF documents are generated on the device. When you export or send them using the iPad's sharing functions, the recipients and services you select receive the relevant content. Copies saved or sent outside SafeProtokol are then also subject to those recipients' processing and retention.

7. On-device storage and offline use

SafeProtokol stores downloaded protocol data, drafts, drawn content and synchronisation information locally, among other working data. This allows work on available protocols without a connection. Changes synchronise after connectivity returns and access has been checked.

Local working data are associated with the user and business. Without a connection, access to previously available data may continue for a limited period based on an earlier access check. Permission changes therefore do not necessarily take immediate effect on a completely offline device. Signing out is not a guarantee that every local draft or exported file is immediately deleted.

8. Maps and Apple Maps

When you load a map for a project address, the address is sent to Apple's mapping services for search and display. Opening the project in Apple Maps may also pass destination information and the project name to the Maps application. Apple processes its own technical and usage data under its privacy information.

This feature is separate from continuous location tracking by SafeProtokol. You can use the documentation functions without loading a project map. Further information: Apple Maps and privacy.

9. Purposes and lawful bases

When we are responsible for the processing, we rely on the following lawful bases:

Article 6(1)(b) GDPR: where necessary for a contract with you or pre-contractual steps you request, such as providing your service access or answering a contractual inquiry.
Article 6(1)(f) GDPR: where justified by legitimate interests, particularly operating a business service, administering authorised employee access, securing accounts and infrastructure, and handling other inquiries. Your rights and interests must be taken into account.
Article 6(1)(c) GDPR: where a specific legal obligation requires the processing or retention concerned.

For business content, the responsible business determines the necessary lawful basis. A data processing agreement is not, on its own, a lawful basis for processing that content. If processing relies on your consent, you may withdraw it for the future without affecting the lawfulness of earlier processing.

10. Google cloud infrastructure and technical data

SafeProtokol uses Google's cloud infrastructure. The application database is configured in a European multi-region location. File storage and backend functions are located in Frankfurt am Main, Germany. The Google service used for authentication processes data in the United States. Other technical services, logging and website delivery may operate globally.

To provide and secure the services, the infrastructure processes IP addresses, request times, technical request and device information, and error and security information, among other technical data. Application integrity checks use Google and Apple services to verify the app or device and associated attestation tokens. This is not advertising tracking.

The described app functionality does not use our own advertising tracking, usage analytics or automatic crash-reporting feature. This does not exclude technically necessary processing by Google and Apple or on-device operating-system diagnostics. Google information: Privacy and security.

11. Subscriptions and Apple

Public in-app purchases are not currently enabled in SafeProtokol. The website has no direct payment checkout.

The subscription infrastructure is designed for business subscriptions through Apple's App Store. When a corresponding Apple transaction is processed, this involves product and transaction identifiers, the original transaction identifier, a business-association identifier, subscription status, periods, expiry and any revocation or grace-period dates, and technical verification and history information. These data associate and verify access entitlements. Technical verification uses Apple servers and signed transaction information; the infrastructure includes a receiver for Apple subscription notifications.

SafeProtokol does not receive payment-card details through this process. Apple independently controls its processing of App Store account, purchase and payment data. Deleting a SafeProtokol account or business does not cancel an Apple subscription. Information: App Store and privacy.

12. Recipients and transfers outside the EEA

Recipients may include Google as cloud provider and the companies it uses, Apple for the App Store, maps and integrity checks, authorised people in the relevant business, and recipients and services you choose when sharing. If you contact us by email or telephone, the communications providers involved also process the corresponding data. Disclosure to authorities or other bodies may occur where a legal obligation or another valid lawful basis applies.

European configuration of the application database and file storage does not mean that all data are processed exclusively within the European Economic Area. Authentication and global technical services, in particular, may involve processing in the United States or other third countries. Apple also has its own international processing arrangements.

Google publishes information about transfer arrangements, including standard contractual clauses and applicable adequacy arrangements, in its data processing terms. Apple's privacy information applies to Apple. The safeguard relevant to a transfer depends on the service, recipient and legal framework. You may request information about the recipients and transfer safeguards applicable to our processing and, where relevant, a copy of the safeguards using the contact details above.

13. Retention

Retention depends on the processing purpose, the service relationship, the responsible business's instructions and any legal obligations or necessary handling of legal claims. There is no single automatic deletion period for all content.

Accounts, profiles and business documentation are not automatically deleted solely because they are unused. Expired invitations and revoked memberships may remain as administrative and historical records. Deleting an individual protocol does not automatically delete its associated files; limited deletion and history information also remains. Retention of those data must be considered separately when handling erasure requests. Subscription association and verification information may also remain separately from visible content.

The checked Google technical log stores are configured for 30 days, or 400 days for mandatory audit logs. These periods do not apply universally to all services. Files that have actually been deleted may be retained for another seven days under the configured recovery feature. Further provider-specific deletion and backup processes may apply. Deletion from every system at an identical time is therefore not guaranteed.

Deleting a project removes the project association, not its protocols.

14. Deleting accounts and data

Where the relevant in-app deletion function is available, you can delete your personal account in SafeProtokol and, if authorised, your business workspace. Alternatively, you can contact support@safeprotokol.org at any time. To protect your data, we verify your identity and, for business data, your authority. Questions about administrator authority or subscription ownership may need to be resolved first.

Deleting your personal account does not automatically delete your business's protocols. Deleting a business workspace is a separate process affecting its data.

Data covered by deletion are removed according to the retention rules described in section 13. Depending on the service, technical recovery copies may remain temporarily. This does not mean that deleted accounts or protocols can be restored.

Legal retention obligations still apply. Copies already exported to other recipients must be considered separately. Your statutory data protection rights remain unchanged.

15. Security

Protection includes authentication, business-specific access checks, roles, server-side validation and device protection mechanisms. Google describes encrypted transmission and service-specific encryption of stored data for the cloud services used. End-to-end encryption between users is not guaranteed. Security measures can reduce risks but cannot guarantee absolute security.

16. Contact and support

If you contact us, we process your contact details, message content and any technical information you voluntarily provide to handle your inquiry. Please provide only necessary information, without passwords or unnecessary details about other people. Where an inquiry concerns business content, the business's responsibility and instructions also apply.

17. Your rights

Where the legal conditions are met, you have rights of access, rectification, erasure, restriction of processing and data portability. Portability applies particularly to automated processing based on consent or a contract and does not apply without limits to all business documentation.

Objection: where processing relies on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will then assess the legal conditions for continuing that processing.

You can exercise your rights using the contact details above. Requests are generally answered within one month; you will receive the required information if a legally permitted extension applies. If your request concerns data controlled by your business, SafeProtokol assists the relevant controller in handling it.

The described service does not make solely automated decisions, including profiling, that produce legal effects concerning you or similarly significantly affect you.

18. Complaints to a supervisory authority

You may complain to a competent data protection authority, particularly in the place of your habitual residence, workplace or the alleged infringement. For this private provider established in Spain, the generally relevant Spanish authority is the Agencia Española de Protección de Datos (AEPD): www.aepd.es.

19. Professional use and minors

SafeProtokol is intended for businesses and their authorised professional users, not children. Businesses must ensure that use and entry of information about other people are lawful. This policy does not authorise unlimited collection of minors' data or specially protected information.

20. Website, cookies and external links

The website is static and delivered through Google Hosting. The hosting infrastructure processes technical access data for delivery and security. Fonts and images are served locally. There are no contact or newsletter forms or embedded videos. Email and telephone links open your chosen applications.

Where optional website analytics is enabled, we use Google Analytics 4 to understand visits to the existing website pages and improve their information. It loads only after you explicitly consent to the Analytics category. Rejecting optional analytics does not restrict website use. Google Ireland Limited is the European analytics service provider; processing can also involve Google LLC and Google subprocessors outside the European Economic Area. We accepted the Google Analytics data processing terms on 30 October 2026. These terms govern Google’s processing on our behalf and include provisions for international transfers. Depending on the transfer, the applicable provisions provide for an adequacy decision or other applicable transfer mechanism, including standard contractual clauses where required. This is not a guarantee of EU-only processing. You may contact us using the details in section 1 for further information about the applicable safeguards.

The consent record safeprotokol.consent.v1 is stored in your browser's localStorage for six months and records your analytics choice, schema and policy versions, and decision/expiry timestamps. Both acceptance and rejection are remembered. It is not an account identifier. If storage is unavailable, the choice applies only to the current page and you may be asked again. Material changes to processing purposes require a new decision.

After consent and activation, GA4 may store first-party cookies _ga and _ga_LD0ZMZ78N8 on this website host with path /, Secure and SameSite=Lax settings. The configured cookie lifetime is 180 days. In local browser testing, _ga retained its observed expiration, while _ga_LD0ZMZ78N8 renewed its expiration during activity. Cookie expiration can therefore change with activity, and browser privacy settings may shorten storage. Both cookies were removed after consent withdrawal in that test. Your consent preference expires independently after six calendar months; cookie renewal does not extend that preference. Analytics uses pseudonymous cookie identifiers and technical usage information. Explicit page views contain the canonical page address without query parameters or fragments, the static page title, page category and website language; raw referrers are suppressed. This is not anonymous processing. Advertising features, Google Signals and user-provided data collection are disabled. We do not send account IDs, contact details or form contents. Event and user data retention are configured to two months, with retention reset on new activity disabled. Sharing Analytics data with Google products and services is disabled. Standard aggregated reports can follow different retention behavior.

You can accept, reject or customize analytics using the banner and change or withdraw your choice at any time through Cookie Settings in the footer. Withdrawal blocks future analytics calls, removes accessible cookies for this stream and, when the new choice is saved, reloads the page to remove the loaded analytics runtime. If saving fails, tracking remains blocked in the current document without reloading an older grant. Withdrawal cannot recall data already sent or requests already in flight; it does not automatically delete historical analytics data. Contact us to exercise the rights described in section 17. The consent basis for optional analytics is Article 6(1)(a) GDPR and the applicable rules for storage/access on your device. Necessary preference storage is used to respect your choice.

If you follow an external link, the destination website's privacy information applies. Further provider information: Google Analytics privacy and security and Google privacy policy.

21. Changes

We update this policy when processing activities or legal requirements change. The date above identifies this version. Where material changes require further information or consent, this will be provided or obtained separately.