The app your facilitator is using, and everything it does with your data.

1About RoomPulse

A facilitator builds a running order before the event. During it, they push one activity at a time to everyone's phone. Participants join by scanning a QR code or typing a short code. There is no account, no app store download and no password.

Key facts

Default retention

ImmediateAll participant data is deleted when the session ends. An organiser may extend to 24 hours, 7 or 30 days. Never longer.

Data held in

FrankfurtGermany. Database, file storage and application servers are all in the EU.

Transfers outside the EEA

EU onlyParticipant data is stored only in Germany. Section 4.3 sets out each provider's contractual position in full.

Trackers and analytics

NoneNo analytics, advertising or third-party scripts. This page makes no external request either.

1.1What the app does

Most live-participation tools cover the first group below. RoomPulse covers all six, because an away day is not a webinar: people move, form teams, go outdoors, make things, and meet colleagues they have never worked with. The app has to follow them.

Every one of those is configured per session by the facilitator rather than hard-coded, so the same app runs a twenty-person workshop in one meeting room and an event of several hundred spread across a whole venue, indoors or out.

1.2Who is accountable

2Privacy statement

DOCRP-PS-01

Written for participants. If you are joining an event on your phone, this is what happens to what you type, tap and photograph.

2.1Who is responsible

2.2What is collected

How you are identified is chosen by the organiser before the event, and stated on the notice you see before you join. Anonymous is the default for new sessions.

In addition, depending on which activities the facilitator runs:

2.3Photographs, where an event uses them

• You are asked separately. Photo consent is a distinct choice when you join, not bundled into joining. If you decline you can still take part in every challenge. A teammate uploads instead, and you need not be in the picture.
• Location and device data are removed. Phone cameras embed GPS coordinates, timestamps and device identifiers in image files. RoomPulse removes this metadata on your own phone, before the image ever leaves it — the photo is re-encoded in your browser, which discards everything except the picture itself. Our server then independently checks each incoming image and refuses any that still carries metadata. We never hold the place a photo was taken or the phone that took it.
• Images are stored privately. They go to a private, access-controlled store in the EU. They are never publicly addressable, and each view is authorised individually and expires.
• Shown only where the challenge says. A photo may appear on the event's big screen or in a shared wall. That is the point of the activity, and it is described before you submit.
• No face recognition. We do not run facial recognition, biometric matching, automatic tagging or any form of image analysis. Ever.
• Deleted with everything else, on the retention schedule in section 2.4.

2.4How long it is kept

DOCRP-RET-01

Retention is set per event by the organiser and shown on the notice before you join. The options are deliberately short, and the shortest is the default.

Deletion is carried out by an automated task running every five minutes inside the database itself, so it does not depend on anyone remembering. A separate daily watchdog, running on independent infrastructure, checks that no deletion is overdue and raises an alarm if the task ever falls behind. Afterwards the system re-counts every table to confirm nothing is left, and issues a deletion certificate recording what was deleted and when. An administrator can also trigger the full deletion immediately at any point after an event ends, and can export or erase a single participant's data on request during one.

What is kept afterwards is anonymous summary only. For example, "62 of 88 people chose option B", or a team's total score. Where a future activity type summarises words people typed, rare answers will be suppressed before the summary is kept, so an unusual response cannot be traced back to one person. Free text is never kept. The event's written report is generated at the end and handed to the organiser. From that moment they hold it, and it is governed by their retention rules, not ours.

2.5Why it is collected, and on what basis

To run the session you are taking part in: to show the facilitator how the room is responding, to give you your timer and your team's challenges, and to produce a summary for the organiser. The legal basis is set by the controller and named in the notice you see before joining. For EU bodies it is normally the performance of a task carried out in the public interest. Where the controller relies on consent for photographs, this is how we implement it: you are asked separately from joining, and refusing costs you nothing, so the choice is a real one. Participation in any activity is voluntary. You can skip a question or close the page at any time.

2.6Your rights

You may ask for access to your data, correction, erasure, restriction of processing, or object to it. Because retention is usually immediate, the fastest route during an event is to tell the facilitator. They can delete your responses on the spot, and the change takes effect at once. Otherwise contact the organiser as controller, or us at dpo@aim-associes.com and we will pass it on.

You also have the right to complain to a supervisory authority. That is the European Data Protection Supervisor where the controller is an EU body, and your national authority otherwise. In Belgium that is the Autorité de protection des données / Gegevensbeschermingsautoriteit.

If a personal data breach occurs, we notify the controller without undue delay so they can meet their own notification deadlines, and we support their assessment.

3Technical and organisational measures

DOCRP-TOM-01

The controls protecting personal data processed through RoomPulse, appropriate to the risk of a short-lived event application handling responses and photographs. Required by Article 32 GDPR.

3.1Access control

• Facilitator accounts are created by invitation only. Self-registration is disabled at the identity provider.
• Minimum 12-character passwords. Credentials are salted and hashed by the identity provider and never visible to us.
• Three separate roles (administrator, session owner, facilitator), each scoped to the specific events a person is assigned to.
• Every privileged action is checked independently at three layers: the page, the server action, and the database.
• Deactivating an account revokes access immediately and terminates existing sessions.

3.2Database protection

• Row-level security is enabled on every table and denies by default. Access is granted only by explicit policy.
• The public application key carries no database privileges whatsoever, so it is useless for reading data even though it is present in every browser.
• Participants never connect to the database. All access is mediated by the server, which validates every request.
• Participant identity is carried in a signed, HTTP-only cookie. No identifier ever appears in a web address, which removes a common class of data-exposure flaw.
• Administrative keys are held server-side only and are never sent to a browser.

3.3Encryption and storage

• All traffic is encrypted in transit with TLS 1.2 or above. HTTPS is enforced.
• Data at rest is encrypted by the hosting provider using AES-256.
• Uploaded images are held in a private store with no public addresses. Access is by short-lived authorised links generated per view.
• Image metadata, including GPS coordinates and device identifiers, is stripped on the server before storage.
• Backups are encrypted at rest and taken daily by our database provider. A restored backup could briefly contain data already deleted from the live system, so we confirm the backup window per project with the controller instead of claiming deletion is instantaneous everywhere. This is the one place where "deleted" means "deleted from the live service, and from backups as they age out".

3.4Data minimisation

• Anonymous participation is the default for every new event. A name is collected only where an organiser deliberately turns it on.
• Each activity type declares what categories of data it collects, and the participant notice is generated from the event's actual running order, so it cannot drift from reality.
• No analytics, advertising, tag managers, session recording or heat-mapping of any kind.
• No externally hosted fonts, scripts or images. The app makes no third-party requests from a participant's browser.

3.5Deletion and accountability

• Automated deletion runs inside the database every five minutes, independent of any external scheduler.
• A monitoring task checks daily for any event whose deletion is overdue and alerts administrators.
• Deletion is verified in the same database transaction by re-counting every table that can hold personal data; if anything remains, the deletion is rolled back and retried rather than reported as done. A certificate records the result, carries a cryptographic fingerprint (SHA-256) of its own contents, and is published at an unguessable web address the organiser can open — and re-check — without an account.
• In an anonymous session there is nothing to look up. Nobody at AIM can connect a response to a person, because the link does not exist. A participant who wants their contribution removed during an event points it out to the facilitator and it goes immediately. Where an organiser has chosen to collect names, we can also act on a request for access or erasure.

3.6Organisational measures

• Access is limited to the AIM staff delivering the event, on a need-to-know basis.
• Staff are bound by confidentiality obligations.
• We enter into a written processing agreement with the controller for every engagement.
• We use only sub-processors that publish data processing terms incorporating the European Commission's Standard Contractual Clauses.
• Changes to the schema or to security policy are made through reviewed, version-controlled migrations, and tested against an automated access-control suite before release.
• Load and resilience testing is carried out before large events.

4Data residency and sub-processors

DOCRP-RES-01

All personal data processed through RoomPulse is stored and processed in the European Union. There is no transfer to a third country in normal operation.

4.1Where data is processed

Every component is pinned to an EU region. Participants receive no email. The application makes no requests to third-party services from a participant's browser, so no data leaves the EEA by that route either.

4.2Sub-processors

We engage three sub-processors directly. Their published terms are linked below so you can read them without asking us for a copy; the database and email providers' terms incorporate the European Commission's Standard Contractual Clauses and apply to us, while the hosting provider's addendum does not cover its free tier — see the note in section 4.1. Links open on the provider's own site and pass no referrer.

4.3Position on US-parent providers

5Cookies

DOCRP-CK-01

RoomPulse sets one cookie. It is strictly necessary to deliver the service you asked for, so no consent banner is required. There is nothing to consent to in any case, because there is nothing else.

Facilitators, who do have accounts, also have an authentication cookie for as long as they stay signed in.

6Questions we are often asked

DOCRP-IC-01

These are the questions public and private organisations put to us most often before approving RoomPulse for an event. If yours is not here, write to us at dpo@aim-associes.com and we will answer it properly. Send us your own data processing agreement and we will sign it. If you would rather we supplied one, we can do that too, and it can sit as an annexe to an existing framework contract.

7Record of processing activities

DOCRP-ROPA-01

The record we are required to keep as a processor under Article 30(2) GDPR. Most providers hand this over only when asked. It is a statement of fact, not a negotiation, so we publish it.

This record is maintained alongside the application. It is reviewed whenever a new activity type, sub-processor or retention option is introduced, and it carries the same version number as this page.

8Contact and complaints

If you took part in an event and want to know what was held about you, or want it deleted, the fastest route is to ask the facilitator during the event. It is done immediately. Otherwise write to us and we will act on the controller's instruction.

Our record of processing activities is section 7 of this document, so there is nothing to request. For a data processing agreement, send us your template and we will sign it, or ask and we will supply one. We can also complete a security questionnaire in your own format or contribute to a data protection impact assessment.