This guide is general guidance, not legal advice. For your specific case, talk to a data protection officer or a lawyer.
Why this matters with approval tools
An approval tool holds the names and email addresses of approvers, their comments, the times of their decisions and often images or videos showing people. That is personal data within the meaning of the GDPR.
Who is the controller, who is the processor?
As a rule, as an agency or freelancer you are responsible toward your clients for the data you upload to the tool. The tool's provider processes it on your behalf. For this setup, Article 28 GDPR requires a data processing agreement (DPA), which can be concluded in writing or in an electronic format.
Checklist for choosing a tool
- Data processing agreement: does the provider offer a DPA, and do you receive it before you start using the tool?
- Storage location: where are the database and files stored? Is this stated publicly and verifiably on the provider's website?
- The provider's service providers: is there a list of the subprocessors used, including their location?
- Third countries: is data transferred to countries outside the EU, and on what legal basis?
- Technical and organizational measures: encryption, access control, backups, monitoring. The provider should be able to describe them.
- Deletion: what happens to the data after the contract ends, and how long does it remain in backups?
- Access for approvers: do clients need an account? Fewer accounts mean fewer stored credentials.
- The provider's privacy policy: does it match what the security page says?
What you need to do yourself
- Conclude the DPA and file it.
- Add the tool to your record of processing activities, if you are required to keep one.
- State in your privacy policy and toward your clients that you use such a tool.
- Define internally who has access, and protect accounts with two-factor authentication where the tool offers it.
- Define a deletion policy for completed projects.
How CLAPPO handles this
Hosted in Germany: servers, database and files at Hetzner, managed by ELMACO. Approvers do not need an account. After the contract ends, clients can export their data for 30 days; after that it is deleted, and from backups within a further 30 days. CLAPPO provides a data processing agreement on request. All service providers, storage locations and safeguards are listed on the Security page, the legal details in the privacy policy.