FluxeHRa · generated from markdown source

DPIA / AIPD Support Pack — FluxeHRa Full HR (+ E-Sign)

Document type: technical annex from the processor (Foil Envie SAS — FluxeHRa) for the controller (customer) — GDPR Art. 35 / French AIPD. Edition: Full HR Version: 2.0 — October 2026 Not a complete DPIA, legal advice, or certification.

Related: Trust Center /trust · Security white paper · ISO pack · DPA Full HR · E-sign standards (internal)

No medical / health data. FluxeHRa does not process medical or occupational-health dossiers. Customers must not upload clinical records, medical certificates content intended as health data, or other data requiring French HDS (Hébergeur de Données de Santé) hosting. Standard EU hosting (Supabase Ireland / Vercel Dublin) applies; HDS certification is not required for this product scope and is not claimed.

1. Processing identification

Item	Value
Processing name	Operation of FluxeHRa Full HR HRIS + e-signature for the organisation
Controller	`[TO BE COMPLETED BY THE ORGANISATION]`
Processor	Foil Envie SAS — 8 rue Sylvestre, 69100 Lyon, France — RCS Lyon 949 663 124 — SIRET 94966312400012 — VAT FR56949663124 — contact@fluxehra.ai
Service	https://fluxehra.ai — `product_edition = full`
Applicable DPA	DPA Full HR — `[signature date]`

2. Purposes (typical)

ID	Purpose	Modules
F1	Employee master data / employment admin	Core HR
F2	Compensation / payroll-oriented exports	Compensation, API/SFTP
F3	Performance	Performance Management
F4	Learning / SCORM	Learning
F5	HR documents + e-signature	DMS; Fluxehra e-signature (eIDAS SES + optional PAdES-B) and/or DocuSign
F6	Self-service & notifications	Self-service
F7	Analytics	Analytics
F8	Talent / recruitment (if enabled)	Talent Pool / Recruitment
F9	DSAR & retention tooling	DSAR, Retention

Modules enabled: [TO BE COMPLETED]

Legal bases: employment contract / legal HR obligations / legitimate interest as applicable — no Art. 9 medical processing in product scope.

3. Data subjects & categories

Employees, managers, admins, candidates (EDR), signers. Categories: identity, employment, compensation, performance/learning, documents/PDFs, e-sign metadata, audit logs. Excluded: medical / health data; HDS-scoped dossiers.

4. Data-flow schematic

[ HR / Manager / Employee / Admin ]
        → FluxeHRa (Vercel dub1) → Supabase eu-west-1 (RLS + private Storage)
        → optional SMTP / IdP / SFTP
        → Fluxehra e-signature (/sign) or DocuSign

5. Security matrix

RBAC, TLS, field encryption, private Storage, audit, MFA for privileged roles, e-sign hashed tokens + evidence pack + optional PAdES-B. Verify via white paper & Org Setup.

6–8. Backups, retention, recipients

Supabase backups; Customer configures retention; recipients = authorised users + Foil Envie support + platform sub-processors + customer integrations.

9. Residual risks

Risk	Reduced by platform	Customer
Cross-tenant	RLS	Account hygiene
Over-retention	Purge tools	Lawful periods
Medical data in PDF	Product policy forbids health dossiers	Do not upload medical content

10. Checklist

[ ] DPO involved; DPIA necessity confirmed
[ ] Modules listed; placeholders completed
[ ] Confirm no medical data will be stored
[ ] Sign DPA Full HR; archive sub-processors
[ ] Configure visibility & retention
[ ] Attach white paper + this annex

11. Revisions

Ver	Date	Note
2.0	2026-10	Dual edition; remove medical/HDS product scope
1.x	2026-07/09	Prior generic annex