For procurement, legal, security and data-protection teams
Security & Data-Protection Fact Sheet
Everything a DPO checks about the "Menopause at Work — Romania" programmes, in one document. Signed DPA available on request; a one-page DPA outline is included as Annex A.
Read this first — the design principle. These programmes are built so that the most sensitive data category involved — how individual employees experience menopause — is never collected in identifiable form by anyone, including us. Anonymity is enforced in the database layer, not promised in a policy. Everything below follows from that choice.
1. Parties and GDPR roles
| Supplier | {{LEGAL ENTITY NAME, registration number, registered office — Ireland}} |
| Data-protection contact | {{dedicated email address}} |
| GDPR role — anonymous pulse survey | Survey responses are anonymous by design (see §4) and are engineered to fall outside the scope of personal data (GDPR Recital 26). No controller/processor relationship arises over the responses themselves. |
| GDPR role — project administration | For client contact data (HR contacts, contracts, invoicing), the supplier acts as an independent controller. |
| GDPR role — sessions & training | No participant personal data is collected by the supplier; attendance is managed by the employer. |
2. Architecture at a glance
- Static website, no CMS. metodamidlife.ro is a static site with no server-side application code, no content-management system and no exposed administration surface — which removes the most common attack classes (CMS exploits, plugin vulnerabilities, admin credential theft) by construction.
- No cookies, no trackers. The public site sets no tracking cookies and loads no analytics, advertising or social-media scripts. A single theme preference is stored in the visitor's own browser (localStorage) and never transmitted.
- Self-hosted assets only. All fonts, styles, scripts and images are served from our own origin. No third-party CDNs, no external font services, no embedded third-party widgets — so no page view leaks visitor data to advertising networks.
- Minimal backend. The only dynamic component is the survey database (EU-hosted, see §5), reached through a narrowly scoped API described in §4 and §7.
- The "Midlife Assistant" self-help app (if used by employees privately) keeps all data on the user's own device in browser storage — no account, no server, user-controlled deletion.
3. What data each service touches
| Service | Data | Where stored |
|---|---|---|
| Anonymous pulse survey | Closed-scale answers (1–5) + a company code + the calendar day. No names, emails, employee IDs, free text, or IP addresses stored with responses. | EU database — Supabase, Frankfurt region |
| HR results report | Aggregates only; a hard n≥5 suppression threshold is enforced server-side in the database function (below the threshold, no report is produced at all) | Generated on demand; the PDF remains with the client |
| Website contact / proposal forms | Name, work email, company, message | Netlify Inc. (US) — transfer under the EU–U.S. Data Privacy Framework / SCCs, with a DPA in place |
| Project administration | HR contact details, contracts, invoices | Supplier's business systems (EU) |
| Midlife Assistant app | Entirely on the employee's own device (localStorage); no account, no server | The user's device |
4. Survey anonymity — technical guarantees, not promises
- Minimal collection. The survey form contains no identifying fields and requires no login. Answers are exclusively closed 1–5 scales — the free-text re-identification vector is eliminated by design, not moderated after the fact.
- Date truncated to the day. Responses carry only the calendar day, preventing correlation with access logs, badge systems or calendar data.
- Insert-only client access. The public API key embedded in the survey page permits INSERT only, enforced through database Row Level Security. Reading raw rows from the client is impossible — not merely forbidden.
- Aggregation enforced server-side. Results are obtainable exclusively through a database function that computes aggregates and refuses any response covering fewer than 5 records. The threshold lives in the database, where neither the employer nor a report reader can bypass it.
- The employer never sees individual rows — not even on request. This is a contractual condition as well as a technical one.
- Honest limitation — deduplication. Prevention of duplicate responses is best-effort and per-device (browser-side). Strict deduplication would require identifying respondents, which we refuse by design. At typical sample sizes the statistical impact is negligible, and we say so rather than overstating the control.
- Bilingual instrument. The survey is delivered in Romanian and English — identical questions, identical scales — for sites with international staff.
- Infrastructure logs. Default provider logs (which may include network-level IP addresses) are short-retention and are not associated with survey responses; the configuration is documented at onboarding.
5. Hosting map and subprocessors
| Provider | Service | Location / transfer mechanism |
|---|---|---|
| Supabase | Survey database and aggregate reporting function | EU — Frankfurt, Germany. No transfer outside the EU. |
| Netlify Inc. | Website hosting + contact-form handling | US — EU–U.S. Data Privacy Framework / Standard Contractual Clauses; DPA in place |
| Anthropic | Only if optional AI-assisted features are enabled for an engagement — disabled by default. Any AI interface carries a visible "you are talking to an AI assistant" disclosure and is used only with the individual user's consent; no survey data is ever sent to it. | US — EU–U.S. Data Privacy Framework / SCCs |
| {{Email provider}} | Business correspondence / newsletter | {{location and transfer basis — completed at onboarding}} |
We notify clients of subprocessor changes affecting their engagement and maintain DPAs with each provider that processes personal data on our behalf.
6. Data retention schedule
| Data category | Retention | Rationale |
|---|---|---|
| Survey responses — raw rows | Max. 12 months after survey close, then deleted | Needed only for year-on-year comparison |
| Survey aggregates (anonymous) | Indefinite | Retained as anonymous benchmark data; not personal data (Recital 26) |
| HR results reports | Not retained by supplier | Generated on demand; the delivered PDF remains with the client |
| Website form submissions | Max. 24 months from last correspondence | Sales and service follow-up, then deleted |
| Client contacts, contracts, correspondence | Duration of engagement + 24 months | Contract administration and follow-up |
| Invoicing and accounting records | Statutory retention period under applicable tax law | Legal obligation |
| Midlife Assistant app data | User-controlled | Device-only storage; deletable in-app by the user |
7. Access control — the two-code model for survey results
Access to the survey pipeline is split into two credentials with strictly different powers:
| Participation code | HR read token | |
|---|---|---|
| Held by | Employees invited to the survey | The client's designated HR contact |
| Identifies | The company only — never the person | The company's engagement |
| Permits | Submitting responses (INSERT only) | Requesting aggregate results only, via the server function with the n≥5 threshold |
| Cannot do | Read any data | Read individual rows — this capability does not exist for this credential at the database level |
Either code can be rotated on request (for example when the HR contact changes); rotation invalidates the previous code immediately.
8. Special-category data (GDPR Article 9) — by design
Survey questions concern the experience of menopause at work, which — if linked to an identified person — would constitute health data under Article 9. Our position, and the reason for the architecture above: because responses carry no identifiers, cannot be linked to individuals by us or the employer, and are only ever released as thresholded aggregates, they are anonymous information within the meaning of Recital 26 and Article 9 is not engaged. We nevertheless apply Article-9-grade discipline to the design itself — minimal collection, EU residency, server-side aggregation, suppression thresholds — because the sensitivity of the subject deserves it regardless of legal classification. Where we do process personal data (client contacts, forms), none of it is special-category data.
9. Incident response and breach notification
- Client notification within 48 hours of our becoming aware of a security incident affecting the engagement, with an initial assessment and a remediation plan — faster than the regulatory baseline.
- Where we act as controller of affected personal data, we notify the competent supervisory authority within 72 hours where required by GDPR Article 33, and affected individuals where Article 34 applies.
- Worth stating plainly: a breach of the survey database would expose anonymous scale values — by design, there are no names, emails, IPs or free text in it to leak.
10. Organisational measures and scope
- Programme content is strictly non-medical: lifestyle education and workplace capability. Employees' medical questions are referred to their own physicians — the service creates no health records. We support; we do not treat, diagnose or provide medical services.
- Professional indemnity insurance: {{insurer, cover amount — completed at contract}}.
- Access to business systems is limited to named personnel; devices are encrypted and protected with strong authentication.
- Testimonials and case studies are published only with written consent; survey results are never published in client-identifiable form without written agreement.
11. Documents available on request
Signed Data Processing Agreement (see outline in Annex A) · framework contract clauses (confidentiality, rescheduling, liability cap — summarised in the vendor fact sheet) · extended technical description of the survey architecture · public privacy policy (metodamidlife.ro/confidentialitate.html) · the certification standard (public document).
Annex A — Data Processing Agreement: one-page outline
Our standard DPA (available in English and Romanian, mirroring the Romanian model agreement) follows GDPR Article 28 and contains:
- Parties and roles — identification of controller and processor for each processing activity; explicit note that anonymous survey responses fall outside the DPA's scope because they are not personal data.
- Subject matter, duration, nature and purpose — processing tied to the specific engagement (programme delivery and administration), for its duration plus the retention periods in §6 above.
- Categories of data and data subjects — client staff contact data (HR and project contacts); no special-category data.
- Processor obligations — processing on documented instructions only; confidentiality undertakings by all persons authorised to process; security measures per Article 32 (as described in §§2–7 of this fact sheet).
- Subprocessors — the list in §5, with prior notice of changes and the right to object.
- Assistance — with data-subject rights requests, security, breach notification (48-hour client commitment per §9) and DPIAs where relevant.
- International transfers — EU residency for survey data; EU–U.S. Data Privacy Framework / SCCs for the US providers listed in §5.
- Audit and information rights — documentation-based audit by default, with reasonable on-request verification.
- Deletion or return — at the end of the engagement, at the client's choice, subject to statutory retention obligations.
- Liability and governing law — aligned with the framework contract; liability capped at fees paid under the engagement.
To receive the full DPA for review, write to {{data-protection email}} — standard turnaround is one business day.
12. Contact
Data-protection and security questions: {{dedicated email address}} · Commercial questions: antonela@wellnessacademy.ie · Programme overview: metodamidlife.ro/en/corporate-services.html
Related documents: Vendor fact sheet · Certification standard (EN) · Case-study format