Privacy Policy
Last updated: 7 September 2026
FloorDash is operated by Lambda Twelve PC ("we", "us"). This policy explains what personal data the Service handles, in which role, and your rights under the GDPR.
Two roles
- We are a controller for the data we process for our own purposes: account and authentication administration data of workspace users, billing and invoicing data, support correspondence, security and technical logs, and service administration records.
- We are a processor for Customer Content — the people directory (whether synced from the customer's identity directory or imported manually), floorplans, sites, desk and location assignments and their history, and asset records where they contain personal data. The customer organization is the controller of that data and decides what is stored and who may see it. This processing is governed by the FloorDash Data Processing Agreement.
Data we process
| Category | Data | Purpose |
|---|---|---|
| Account data | Name, work email, identity-provider identifiers (directory and subject IDs) received at single sign-on | Authentication and workspace access |
| Customer Content | Floorplans, assets, desk assignments, and people records (typically name, email, job title) the customer stores, syncs, or imports | Providing the Service, on the customer's instructions (processor — see the DPA) |
| Billing data | Company name, VAT ID, billing address and contact; payment cards are handled solely by Stripe and never reach our servers; legal invoices are issued through our invoicing provider | Billing, invoicing, and tax-law obligations |
| Support data | Support conversations; time-limited read-only access you explicitly grant via a one-time PIN | Providing support at your request |
| Technical logs | IP addresses and request logs | Security, abuse prevention, and service operation |
The precise lawful basis per purpose (contract, legal obligation, legitimate interest) is being confirmed with counsel ahead of commercial launch; none of the above is processed for advertising or sold.
What we do not do
- No advertising, no sale of data, no cross-site or behavioural tracking.
- FloorDash uses cookies and similar browser storage (such as local storage) only where necessary to provide and secure the Service — authentication, session management, security, and user-requested functionality like display preferences. These technologies are not used for behavioural advertising, so there is no consent banner to click through.
- Our staff have no standing access to Customer Content. Routine support access exists only through the customer-generated one-time PIN mechanism: temporary, read-only, scope-bound, revocable, and logged in the workspace's audit trail. Exceptional infrastructure access for operating, securing, or restoring the Service is described in the Terms, section 6.
Where data lives
FloorDash runs on servers operated by us on infrastructure leased from Hetzner, currently located in Finland (EU). Floorplan images and nightly backups are stored with Backblaze in its EU region (Netherlands). Support chat runs on software we operate ourselves on the same Lambda Twelve-controlled infrastructure — support conversations stay on it and no chat SaaS is involved.
Service providers and subprocessors
We use a small number of external providers; the maintained list — including each provider's role, the data involved, and locations — is published at floordash.eu/subprocessors. As of this policy's date: Hetzner (infrastructure), Backblaze (storage and backups, EU region), Stripe (payments), Microsoft (sign-in and, at the customer's instruction, directory sync), and Elorus (statutory invoicing). Transactional email is being moved to an EU-based provider ahead of commercial launch; the subprocessors page will name it when selected.
Retention
- Customer Content: for the life of the workspace. You can export everything at any time; deleting a workspace removes its content from live systems.
- Backups: nightly, kept 14 days on our infrastructure; copies in EU object storage expire on the backup retention schedule (being finalized, with concrete periods, for commercial launch).
- Abandoned, never-completed signups are deleted automatically after 30 days.
- Billing and invoicing records are kept as long as tax law requires.
- Technical logs are retained for limited periods for security and operations; concrete periods will be documented in this policy at commercial launch.
Your rights
Under the GDPR you can request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. For Customer Content, direct your request to your organization (the controller) — we support them in fulfilling it. You can lodge a complaint with your supervisory authority; for Greece, the Hellenic Data Protection Authority (dpa.gr).
Contact
Lambda Twelve PC (trading as Lambda Twelve)
VAT: EL800949070 · G.E.MI. No.: 145563001000
support@floordash.eu