Data Processing Addendum
DRAFT — NOT YET IN EFFECT. This document is a working draft prepared for review by an attorney. It has not been approved, is not legal advice, and does not bind anyone in its current form. Text in square brackets, such as
[LEGAL ENTITY NAME], is a placeholder that still has to be filled in.
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between
[LEGAL ENTITY NAME] (“Processor”, “we”) and the Customer (“Customer”, “you”). It applies
automatically when the Customer accepts the Terms. Capitalised terms not defined here have the
meaning in the Terms.
1. Definitions
- Personal Data: information within Customer Data that identifies or relates to an identifiable individual.
- Data Protection Laws: all privacy and data protection laws that apply to the processing of Personal Data under the Terms, including the California Consumer Privacy Act as amended (“CCPA”) and other US state privacy laws.
- Security Incident: a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data in our systems.
- Subprocessor: a third party we engage that processes Personal Data for us.
- “Controller”, “processor”, “business”, “service provider”, “sell” and “share” have the meanings given in the Data Protection Laws.
2. Roles
2.1 The Customer is the controller (and “business”) of Personal Data. We are its processor (and “service provider”).
2.2 The Customer is responsible for having a lawful basis for the processing, for the accuracy of Personal Data, and for giving workers any notice and obtaining any consent that the law requires, in particular before enabling location capture, real-time location tracking, geofences, or punch photos.
3. Instructions
3.1 We process Personal Data only on the Customer’s documented instructions. The Terms, this DPA, and the Customer’s configuration and use of the Service (including settings chosen by its administrators and calls made with its API keys) are the Customer’s complete instructions.
3.2 We will tell the Customer if we believe an instruction breaks the Data Protection Laws, and we may decline to follow it.
3.3 Service-provider commitments. We will not:
- sell or share Personal Data;
- keep, use, or disclose it for any purpose other than providing the Service and the other business purposes the Terms and this DPA allow, or outside our direct business relationship with the Customer;
- combine it with personal information we receive from other sources, except as the Data Protection Laws permit.
We will tell the Customer if we can no longer meet our obligations under the CCPA. The Customer may take reasonable steps to stop and remedy unauthorised use of Personal Data.
4. Details of the processing
| Item | Description |
|---|---|
| Subject matter | Providing the Tick Tack Timetrack time-tracking and workforce management service |
| Duration | The term of the Terms plus the retention period in section 10 |
| Nature and purpose | Hosting, storing, calculating hours, overtime and gross pay, showing maps and geofences, sending notifications, securing the Service, supporting the Customer |
| Data subjects | The Customer’s employees, contractors and other workers; its administrators, managers and advisers who use the Service |
| Categories of Personal Data | Identity and contact details; employment details such as role, department, position, hire date, date of birth, address; sign-in and security data; time punches, breaks, time cards, schedules and time off; location at punch time and, if enabled, real-time location while punched in and geofence events; punch photos, if enabled; IP addresses and browser details; kiosk PINs (hashed, with a one-time encrypted copy); pay rates and gross pay results; audit log entries; notification content |
| Sensitive data | Precise geolocation (where enabled). Punch photos are images only: we do not perform face recognition or create biometric identifiers or templates. The Customer must not put other sensitive data, such as health or government identification numbers, in the Service |
5. Confidentiality
We ensure that everyone we authorise to process Personal Data is bound by a duty of confidentiality and accesses it only as needed to provide the Service.
6. Security
6.1 We maintain the technical and organisational measures described in our Security overview, including encryption in transit, encryption of stored files, hashed credentials, role-based access, separation between customers, and an immutable audit log. We may update these measures if the overall level of protection does not decrease.
6.2 The Customer is responsible for securing its own accounts and devices, choosing appropriate settings (such as requiring two-factor authentication), and for data it exports or sends to a webhook or other destination.
7. Subprocessors
7.1 The Customer gives general authorisation for us to use Subprocessors. The current list is our Subprocessor list.
7.2 We impose data protection obligations on each Subprocessor that are no less protective than this DPA, and we remain responsible for their performance.
7.3 We will give at least [SUBPROCESSOR NOTICE PERIOD, e.g. 30] days’ notice before adding or
replacing a Subprocessor. The Customer may object on reasonable data protection grounds within
that period. We will then discuss the objection in good faith; if we cannot resolve it, the
Customer may cancel the affected part of the Service, and, after the beta, receive a refund of
prepaid fees for the unused period.
7.4 Endpoints that the Customer configures for webhooks or API integrations are not Subprocessors.
8. Assistance with requests and compliance
8.1 If we receive a request from an individual about Personal Data, we will forward it to the Customer without undue delay and will not respond ourselves other than to direct the individual to the Customer, unless the law requires otherwise.
8.2 The Service lets administrators view, correct, export (as CSV files) and delete records. Where the Customer cannot handle a request with these tools, we will provide reasonable help.
8.3 We will provide reasonable information the Customer needs for data protection impact or risk assessments relating to the Service.
9. Security Incidents
9.1 We will notify the Customer’s administrators without undue delay, and in any case within
[INCIDENT NOTICE HOURS, e.g. 72] hours, after becoming aware of a Security Incident affecting
its Personal Data.
9.2 The notice will describe, as far as known, what happened, the data and people affected, the likely consequences, and what we are doing about it. We will update the Customer as we learn more.
9.3 We will take reasonable steps to contain and remedy the incident. Our notice is not an admission of fault. The Customer is responsible for notifying its workers and regulators where the law requires, and we will help as reasonably needed.
10. Return and deletion
10.1 During the term, and for [CANCELLED RETENTION DAYS, currently planned: 90] days after the
Customer’s account ends, administrators may export Customer Data using the Service’s export tools.
10.2 After that period we will delete Personal Data from the live Service, and from backups within
[BACKUP RETENTION PERIOD], unless the law requires us to keep it.
[OWNER: the cancelled-account deletion process is not yet built and decision D4.19 is still open. Do not publish this section until it is.]
10.3 While the account is active, the Customer’s retention settings control deletion:
- time records follow the Customer’s retention period;
- real-time location points are deleted after 30 to 2,190 days, as the Customer chooses;
- punch photos are deleted after the period the Customer chooses, or with their punch;
- deleted workers are removed 30 days after deletion unless needed for payroll records.
The audit log and payroll records are kept for the life of the account.
11. Audits
We will make available information reasonably necessary to demonstrate compliance with this DPA,
such as written answers to security questionnaires [and third-party audit reports, once available]. If that is not enough, the Customer may, at its own cost and with at least 30 days’
notice, have an independent auditor bound by confidentiality review our compliance, no more than
once a year, during business hours, and without access to other customers’ data.
12. Location of processing
We process and store Personal Data in the United States. We will not move the main storage of Customer Data outside the United States without notice under section 7.3.
13. Liability and order of precedence
Each party’s liability under this DPA is subject to the limits in the Terms. If this DPA conflicts with the Terms on the processing of Personal Data, this DPA governs.
14. Contact
Privacy contact for this DPA: [DPO/PRIVACY CONTACT].