Data processing agreement

Purpose

This agreement forms part of the contract between Fikra Systems and the customer under the Diwink Cloud terms of service. It sets the conditions under which Fikra Systems processes, on the customer’s behalf, the personal data the customer entrusts to Diwink Cloud. On this subject, it prevails over the terms of service.

It applies law no. 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data, as amended and supplemented by law no. 25-11 of 24 July 2025, in particular its provisions on processors.

For the data of people in the European Economic Area, it is the contract required by article 28 of Regulation (EU) 2016/679 (GDPR).

Roles of the parties

The customer is the controller: it decides to control and monitor its organisation’s printing, and decides on the rules applied (access, quotas, blocks) and on the service’s settings. Fikra Systems is its processor.

For Diwink Cloud account data and billing data, Fikra Systems is itself the controller: they are covered by the privacy policy.

Description of the processing

Subject matter and duration

The provision of Diwink Cloud to the customer, for the term of the contract and then until the data are deleted (see “Retention and deletion”).

Nature and purposes

Hosting and storing the organisation’s data; deciding on each print job according to its rules; the history, the reports, the users’ requests, the notifications and their e-mails; monitoring and maintaining the printers; support at the customer’s request.

Data subjects

The organisation’s users: the people whose printing Diwink controls and the administrators of its panel, as well as the people its records name (approvers, maintainers).

Data processed

the users’ identity: name, user name, e-mail address, groups, roles and seats;
their Windows accounts (DOMAIN\user and security identifier) and, on shared PCs, the sessions they open in the Diwink app;
the metadata of each print job: the user and their Windows account, the PC, the printer and the print queue, the number of pages and copies, colour, double-sided printing, paper size, the times, the decision and its reason;
the documents’ names, only if the organisation turns their recording on (off by default on Diwink Cloud);
quotas and their use, the users’ requests (with their reasons and the answers), notifications, alerts and maintenance tasks;
the PCs: computer name, domain or workgroup, Windows version, IP address, agent version;
the audit log: who did what in the panel, when, and from which IP address.

The contents of documents are never processed by Diwink Cloud. When a driver does not report a print job’s number of pages, the agent reads the print data on the PC to count them, then deletes its copy at once: nothing of these contents leaves the PC.

The service requires no sensitive data; the customer refrains from entering any in free-text fields (reasons for requests, comments, notes).

The customer’s instructions

Fikra Systems processes the data only on the customer’s documented instructions: the terms of service, this agreement, the settings its administrators choose in the panel and its written requests. It informs the customer if an instruction appears to it to infringe the law. If the law requires it to process the data otherwise, it informs the customer beforehand, unless the law prohibits it.

Fikra Systems does not use these data for its own purposes. The usage figures it needs to apply the plans and to bill (numbers of users, PCs, printers, print jobs and pages) contain no names.

Confidentiality

Fikra Systems ensures that the people it authorises to access the data are bound by confidentiality. Its team accesses them only when this is necessary to run the service, at the customer’s request or when the law requires it.

Security

Fikra Systems implements the technical and organisational measures described in the annex to this agreement. It may change them without lowering the level of protection.

Sub-processors

The customer authorises Fikra Systems to use the following sub-processors, whose identity it gives the customer on request:

the host of Diwink Cloud (servers and databases);
the service that sends the e-mails (invitations, notifications, account e-mails).

Fikra Systems informs the customer by e-mail at least 30 days before adding or replacing a sub-processor; the customer may object on reasonable grounds and, failing a solution, end the contract. Fikra Systems imposes on each, by contract, data protection obligations equivalent to those of this agreement, and remains liable to the customer for their compliance.

Paddle, the reseller that collects the subscriptions, receives no data about the organisation’s users: only what the purchase needs, described in the privacy policy.

Transfers

Fikra Systems transfers the customer’s data outside Algeria only with the ANPDP’s authorisations that law no. 18-07 requires.

Fikra Systems processes the data outside the European Economic Area. A customer subject to the GDPR makes sure, before using the service, that this transfer is permitted for it.

Data subjects’ rights

The panel lets the customer answer data subjects’ requests itself: its administrators can view, correct and delete users, and export the print history and the reports (Excel files). Fikra Systems passes on to the customer, without delay and without answering them itself, the requests it receives directly, and helps it answer them when the panel is not enough.

A deleted user immediately loses their access, their Windows accounts and their roles; their record (name, user name, e-mail address), marked as deleted, is kept as long as the organisation exists, since the history and the audit log refer to it.

Assistance to the customer

Taking into account the nature of the processing and the information available to it, Fikra Systems helps the customer to ensure the security of the processing, to notify a personal data breach, to carry out a data protection impact assessment and, where needed, to consult the data protection authority.

Personal data breaches

Fikra Systems notifies the customer of any personal data breach affecting it as soon as possible, and at the latest 72 hours after becoming aware of it, by e-mail to the organisation’s owner. The notification describes, as far as this information is known: the nature of the breach, the categories and approximate number of people and records concerned, its likely consequences, the measures taken or proposed to address it, and the contact person. Fikra Systems completes this information as it obtains it.

It is for the customer, as controller, to notify it to the supervisory authority and to inform the people concerned where the GDPR requires (articles 33 and 34).

Retention and deletion

During the contract, the data are kept as follows:

print history: 90 days on the Free plan, the period its plan provides on a paid plan (see Pricing); older print jobs are deleted every day, including when a paid plan ends and the Free plan applies;
read notifications: 180 days after they were read; unread notifications, resolved alerts, ended app sessions and expired or revoked PC enrolment tokens: one year;
printers’ status readings: 90 days (a setting of the panel);
quotas and their use, requests and the audit log: as long as the organisation exists;
the other data (the users, including deleted ones, which keep their name, user name and e-mail address; the Windows accounts; the PCs and their IP address; the printers; the seats; the maintenance; unresolved alerts, including event alerts, which are never resolved): at most as long as the organisation exists;
the service’s technical logs: 30 days.

When the contract ends, Fikra Systems provides the customer, on request, with a full copy of its database, in its original format (SQLite or PostgreSQL), within 30 days and free of charge, then deletes it within 30 days of the end of the contract, unless the law requires it to be kept. A deleted database leaves the backups 30 days later at the latest.

A Free-plan organisation with no activity for 90 days is deleted, after two warnings by e-mail to its owner (at 60 and 80 days): its database is exported, then deleted. Fikra Systems keeps this export, which allows the organisation to be restored, for 90 days, then deletes it.

Information and audits

Fikra Systems makes available to the customer the information needed to demonstrate compliance with its obligations, and allows audits, including inspections, by the customer or an auditor it appoints, under the following conditions: a written request at least 30 days in advance, one audit a year at most, at the customer’s cost, by an auditor bound by confidentiality, without access to other customers’ data or disruption of the service. Where this suffices, Fikra Systems first answers in writing (documents, questionnaire).

The customer’s obligations

The customer ensures that the processing has a legal basis; informs the people whose printing is controlled before Diwink is put in place; chooses settings proportionate to its needs (rules, recording of documents’ names); and sees to the accuracy of the data it enters and to the security of its administrators’ accounts.

It keeps its record of processing activities and, where the GDPR requires, carries out a data protection impact assessment.

Duration

This agreement applies as long as Fikra Systems processes data on the customer’s behalf. Each party’s liability follows the terms of service.

Annex: security measures

One database per organisation, reached only by that organisation’s requests.
Encrypted exchanges (HTTPS) with the panel and with the PCs’ agent, through which the Diwink app goes.
Passwords kept only as hashes; an account locked for 15 minutes after 5 failed sign-ins; two-step verification, which the organisation may require; links sent by e-mail that work once and expire, of which only a hash is kept.
Encrypted secrets: each database’s connection string, the authenticator app’s key, the printers’ SNMP communities (sent only to the PCs that read those printers).
Roles and permissions with scopes in the panel, checked by the server at every request; a protected session (HttpOnly, Secure and SameSite=Strict cookie, anti-forgery token).
PCs each authenticated by their own secret, of which the service keeps only a hash; signed rules, which each PC checks before applying them.
An audit log of changes and sign-ins, with the IP address, kept as long as the organisation exists.
On each PC, the agent’s data in a folder reserved for the system and administrators; the agent can be uninstalled only by an administrator of the PC.
Regular backups of each database, kept for 30 days at most, and a procedure to restore them after an incident.