Record of Processing Activities
GDPR article 30 · Last updated: September 2026
Controller and processor: Twikii, a business registered in Denmark. Contact for data protection questions: support@twikii.com. Twikii acts as controller for platform accounts, subscriptions, security and support, and as processor on behalf of each customer company for the service data they enter — see our Data Processing Agreement.
| Activity | Data subjects | Data categories | Purpose | Legal basis | Recipients | Retention |
|---|---|---|---|---|---|---|
| Account and workspace management | Administrators, staff, customers with a login | Name, email, phone, role, company affiliation | Create and operate accounts, assign roles and access | Contract performance | Hosting and database provider (EU) | While the account is active, then 90 days |
| Customer and property register | Private and business customers of our customers | Name, company, email, phone, address, location, notes | Deliver service planning and documentation for the company | Contract performance (processor for the company) | Hosting and database provider (EU) | While the workspace is active, then 90 days |
| Scheduling and dispatch | Staff, customers | Jobs, dates, time slots, assigned staff, service address | Plan and assign work, route navigation | Contract performance | Map provider when navigation is opened (address only) | While the workspace is active, then 90 days |
| Job documentation (check-in/out, checklist, photos) | Staff, customers | Check-in/out times, checklist results, before/after photos, position at check-in | Prove work performed and resolve disputes | Contract performance; legitimate interest in documentation | Private photo storage (EU) | 2 years after job completion, unless the company sets shorter |
| Quotes, invoicing and payments | Customers, administrators | Billing details, amounts, tax, payment status, invoice history | Quote, bill and collect payment; bookkeeping | Contract performance; legal obligation (bookkeeping) | Merchant of Record (Paddle), accounting advisers | 5 years from the end of the financial year (Danish bookkeeping law) |
| Subscription billing for Twikii itself | Company administrators | Billing contact, plan, subscription status, transaction references | Sell and manage platform subscriptions | Contract performance; legal obligation (tax) | Paddle as Merchant of Record | 5 years from the end of the financial year |
| Security, logging and fraud prevention | All users | IP address, device data, access and error logs | Protect accounts and data, investigate incidents | Legitimate interest; legal obligation (article 32 security) | Hosting provider, security tooling | 12 months |
| Support and communication | All users | Messages, contact details, case history | Answer questions and resolve issues | Legitimate interest; contract performance | Support tooling provider | 24 months after the case is closed |
| Optional analytics cookies | Website and app visitors | Usage events, device and browser data | Understand and improve product use | Consent (cookie banner) | Analytics provider | 14 months |
International transfers
Database, authentication and photo storage are hosted in the EU. Where a provider processes data outside the EEA, transfers rely on EU standard contractual clauses or an adequacy decision.
Security measures
Measures are described in section 6 of the Data Processing Agreement, including tenant isolation in the database, role-based access, private photo storage, encryption in transit and at rest, and position recorded only during an active shift.