GDPR questions to ask before you choose a business app
Before you put customer data in a business app, ask the vendor who is controller and who is processor, for its data processing agreement and sub-processor list, how data leaves the EEA, how it is secured, how long it is kept, and how you get it back out.
This is a buyer's checklist, not legal advice. In the EU, the GDPR generally puts the duty on you as the business that decides why customer data is used, so the answers a vendor gives become part of how you meet it. Below are the questions, what a good answer looks like, and how our own privacy page answers them.
The questions, and what a good answer sounds like
| Ask the vendor | Why it matters | A good answer |
|---|---|---|
| Are you our processor, and for which data? | The roles decide who owes what. | A plain statement that your company is the controller for the records you enter. |
| Can we see your data processing agreement? | In the EU, processing on your behalf is generally governed by a written agreement. | A document that covers instructions, security, sub-processors, deletion and audits. |
| Which sub-processors do you use? | Your data reaches every one of them. | A named list, and a promise to tell you before it changes. |
| Does data leave the EEA, and on what basis? | Transfers need a legal basis. | The basis per provider, such as an adequacy decision or Standard Contractual Clauses. |
| How do you secure it? | Security should fit the risk. | Specifics: encryption in transit, how passwords and secrets are stored, who on their side can access data. |
| How long do you keep it, and how do we get it out? | Data should not outlive its purpose, and you should be able to leave. | Retention periods per data type, and an export in an open format. |
Controller, processor and the agreement between you
Under the GDPR, the controller decides why and how personal data is used; a processor handles it on the controller's behalf. When you store your customers in a business app, you are usually the controller and the vendor is your processor.
That relationship is generally set down in a data processing agreement. It should say that the vendor acts on your instructions, keeps the data confidential and secure, uses sub-processors with your authorization, helps you answer requests from the people in your data, tells you about a breach without undue delay, and deletes or returns the data when you stop. If a vendor cannot show you one, treat that as an answer in itself.
Sub-processors and transfers
A business app rarely runs alone. Hosting, email delivery, push notifications, payments and AI each tend to be separate providers. Ask for the list, the country of each, and the transfer basis where data leaves the EEA. The European Commission's adequacy decisions, including the EU-U.S. Data Privacy Framework, and Standard Contractual Clauses are the common ones.
For a closer look at where data physically sits, our guide on where your business data is stored lists the follow-up questions about databases, backups and logs.
Security, breaches and proof
The GDPR asks for security appropriate to the risk and names encryption as one example. Ask how passwords are stored, whether traffic is encrypted, who on the vendor's team can read your data, and how they would tell you about a breach. In the EU a controller generally has 72 hours to report a breach to the authority, so a processor's notice needs to reach you fast.
Some vendors point to an audit report or a certificate as proof. Our explainer on what security certifications mean for a small vendor covers what those documents do and do not show.
Features that send data somewhere else
Some features hand data to a third party by design. Ask about each one you plan to use:
- AI assistants. What text is sent, to which provider, and whether it is used for anything else. What business data an AI assistant sends walks through it.
- Address lookup. Autocomplete sends what you type to a maps service. In Swiftly Workspace, address search goes to Apple's maps service, not through our server.
- Email and notifications. Who delivers them, and what the message contains.
How our privacy page answers these questions
We publish the answers on our privacy page. In short:
- Roles. When your organization enters personal data about its own customers, suppliers or staff, your organization is the controller and Swiftly Workspace processes that data on its behalf.
- Providers. The page names the providers that process data for the app: app distribution and push notifications, subscription status, hosting, the AI provider your workspace sets up, and delivery of emails such as invitations.
- Transfers. Where a provider sits outside the EEA, the page relies on the EU-U.S. Data Privacy Framework, Standard Contractual Clauses or adequacy decisions, and offers a copy of the safeguards on request.
- Security. Passwords are never stored in readable form; a salted hash is kept. Data in transit is encrypted. The app has no advertising and no third-party analytics or tracking SDKs.
- AI. Cloud AI runs on a provider key your company adds. When you use it, the text you provide and the workspace context needed to answer go to that provider, and the content is not used for advertising or sold. With Apple Intelligence on the device, the text isn't sent to a cloud AI provider.
- Retention. Account and workspace data are kept while your account and workspace are active. Invoicing records are kept for a minimum of seven years, as Belgian law requires.
- Rights. Requests are answered within 30 days. Requests about your workspace data are referred to your organization, as the controller, and we help it respond. You can deactivate your account in the app.
Inside the app, two things help you meet your own duties. Records such as customers, invoices and timesheets keep a change history, which audit trails for small businesses explains. And an admin can export records as CSV files with Data Export, one file per record type, as described in how to export your data. Before you commit to any vendor, run through the questions to ask about data portability.
Questions the page does not answer, such as a signed data processing agreement or where your data is hosted, are best asked directly: contact us and we will reply.
Frequently asked questions
Is a business app vendor a data processor under the GDPR?
Usually, for the customer and staff data you enter. You decide why that data is used, which generally makes you the controller and the vendor your processor. For its own account and billing data about you, the vendor is generally a controller in its own right.
What should a data processing agreement include?
In the EU it generally covers the subject and duration of the processing, the vendor acting on your instructions, confidentiality, security measures, rules for sub-processors, help with requests and breaches, deletion or return of the data at the end, and audits.
Do I need consent to store my customers in a CRM?
Often not. Many businesses rely on another legal basis, such as performing a sale or a legitimate interest, for ordinary customer records. Consent matters more for things like marketing emails. Check the basis for each purpose with your adviser.
How quickly must a request for personal data be answered?
Generally within one month, which can be extended in some cases. If your vendor holds the data, ask how it helps you find and export a person's records in time.
Run your business on Apple.
Create your account on the web, then set up your workspace in the app on your iPhone, iPad or Mac.
Create your account
