The terms under which we handle personal data in your workspaces, as required by Article 28 of the GDPR.
This agreement is between the customer that holds a Mechanesmos account ("you", the controller) and E.Y.F. Engineering Your Firm LTD, registered in Cyprus under number ΗΕ 458838, based in Limassol, Cyprus ("we", the processor). It forms part of the terms of service and applies automatically when you accept them. A signed copy is available on request.
| Subject matter | Hosting the content of your workspaces so you and the people you invite can use it |
|---|---|
| Nature and purpose | Storing, synchronising, displaying, backing up and exporting that content |
| Types of personal data | Whatever you choose to put in: typically names, email addresses, job titles, work notes and comments |
| People concerned | Your users, staff, clients, suppliers and other contacts you record |
| Duration | While your account is active, then until deletion as set out in section 9 |
You must not put special categories of personal data (such as health information) into Mechanesmos unless you have a lawful basis and have judged our security measures adequate for it.
We process your workspace data only on your documented instructions: these terms, and the actions you and your users take in the product. We will tell you if we believe an instruction breaks data-protection law. If the law requires us to process data in another way, we will tell you first unless the law forbids it.
Only people at our company who need access to run the service can reach your data, and they are bound to keep it confidential. We look at workspace content only to keep the service running, to help when you ask us to, or when the law requires it.
We take the technical and organisational measures required by Article 32 of the GDPR, including: encrypted connections; passwords stored only in scrambled form; optional two-step sign-in; roles and workspace access checked by the server on every request; limits on repeated attempts; a record of sign-ins and security events; nightly backups; key-only access to the server. They are described in more detail on the Security and your data page. We may improve these measures over time, but will not reduce the overall level of protection.
You authorise us to use the following sub-processor:
We will tell you by email at least 30 days before adding or replacing a sub-processor. If you object on reasonable data-protection grounds, you may end the agreement and we will refund any amount paid for the time after it ends. We place the same data-protection obligations on every sub-processor, and remain responsible to you for their work.
You can find, export, correct and delete content yourself in the product. Where you need more help to answer a request from a person whose data you hold, or for a data-protection impact assessment or a consultation with an authority, we will assist within reason. If someone contacts us directly about data in your workspace, we will pass the request to you.
We will tell you without undue delay, and aim to do so within 48 hours, after becoming aware of a breach affecting your workspace data. We will give you the information we have about what happened, what data is affected and what we are doing about it, and update you as we learn more.
You can export all your content at any time. When your account or a workspace is deleted, we delete its content from the live service at once, and it disappears from backup copies within 30 days, unless the law requires us to keep it.
We will give you the information you reasonably need to show that this agreement is being followed, including answers to security questionnaires. If that is not enough, or an authority requires it, you may audit our compliance once a year, with 30 days' notice, at your own cost, under a confidentiality agreement.
We do not transfer your workspace data outside the European Economic Area. If that ever changes, we will tell you in advance and use a safeguard recognised by the GDPR, such as the European Commission's standard contractual clauses.
The liability terms of the terms of service apply to this agreement. If this agreement and the terms of service conflict on how personal data is handled, this agreement wins.
Last updated: 13 November 2026.