GDPR and your data
Who is the controller and who is the processor, where data is stored, how to export or delete an organization or an account, and the audit log.
This page explains who is responsible for the personal data in assign2me and which tools you have to handle it. The legal details are in the DPA, the Privacy Policy and on the Security page.
Who is responsible
- Your company is the controller of the data it puts into assign2me: its team, its tasks and its clients’ people.
- assign2me is the processor. We process the data only to provide the service, on your instructions, under the data processing agreement (DPA). The DPA is part of the Terms. An Administrator accepts it in the app before inviting the first guest.
- Guests’ data is controlled by the company that invited them. A guest accepts the Terms and the privacy notice on first sign-in. More for guests in the Privacy Policy.
We don’t use your data for our own purposes, including training AI models, and we don’t sell it.
Where the data is
All data is stored in the European Economic Area. Attachments are kept in storage under EU jurisdiction. The companies that help us run the service (subprocessors) are listed in Annex 1 to the DPA. We tell Administrators by email at least 14 days before adding or replacing one.
Exporting and deleting the organization
An Administrator can export the whole organization at any time: tasks and projects as CSV and JSON files, plus all attachments. You don’t need to contact us.
An Administrator can also delete the organization permanently from its settings. From that moment nobody has access to it, and its data is permanently deleted within 30 days, and from backups in their normal rotation.
When a subscription ends, the organization stays read-only for 60 days so you can export the data. After that it is deleted, and Administrators get an email 7 days before (Billing).
Your own account
Every user can download their own data (profile, memberships, tasks they created or were assigned, and their history) as a JSON file, and delete their account.
When an account is deleted, the person’s name in comments and task history is replaced with “Deleted user” within 30 days. The rest of the team’s work stays intact.
An organization always has at least one Administrator. Before the last Administrator leaves, they hand the role, and with it the ownership of the organization, to someone else. That way the company never depends on one person’s account.
Audit log
Administrators see the organization’s Audit log: invitations sent, resent and revoked, accounts deactivated and restored, role changes, and projects archived, restored and deleted, each with who and when. It is kept for at least 12 months.
Every task also has its own History: who changed what and when, and whether the change came from the app, Slack, an AI assistant (MCP) or an integration. History entries can’t be edited or deleted. Only the author’s name is anonymized when an account is deleted.
Data subject requests
When someone asks your company to see, correct or delete their data, you handle it with the features above: export, editing and deleting content, removing a guest from a project, deleting an account or the organization. If a request reaches us directly, we forward it to your company without undue delay, as the DPA requires. Questions: contact@assign2me.com.
Guests and access
Administrators see a list of all guests with their projects, invitation date and last visit. Removing a guest from a project takes their access away on their next request, and archiving a project ends the access of its guests. See Guests.