Data Processing Agreement
Draft v0.2 — last updated 18 October 2026. This is a working draft and is being reviewed; items highlighted in yellow are still to be completed or confirmed.
This agreement applies automatically to every customer as part of the Terms of Service. Solicitor to review. A signed copy can be offered to customers who ask.
This Data Processing Agreement (“DPA”) is between the Customer and PROVIDER LEGAL NAME (“Processor”) and forms part of the Terms of Service. It applies to personal data the Processor handles on the Customer's behalf in providing the service (“Customer Personal Data”). Terms such as “controller”, “processor”, “personal data”, “personal data breach” and “data subject” have the meaning given in the GDPR (Regulation (EU) 2016/679) and the Irish Data Protection Act 2018.
1. Roles and instructions
The Customer is the controller and the Processor is the processor of Customer Personal Data. The Processor will process it only on the Customer's documented instructions — which are these terms, the Customer's use and configuration of the service, and any further written instruction — unless the law requires otherwise, in which case it will tell the Customer first unless the law forbids that. The Processor will tell the Customer if it believes an instruction infringes data protection law.
2. Details of the processing
| Item | Detail |
|---|---|
| Subject matter and nature | Hosting and operating the service: storing, organising, retrieving, displaying, backing up and deleting data; sending notifications and emails at the Customer's request. |
| Purpose | To provide the service the Customer has subscribed to. |
| Duration | For as long as the Customer has an account, plus the deletion period in section 9. |
| Data subjects | The Customer's employees, subcontractors and job applicants; people named in projects, contacts and documents (for example client or supplier staff); and anyone who appears in photographs or records the Customer uploads. |
| Types of personal data | Identity and contact details; employment details (job title, start date, rates, pay and tax details, bank details, PPS numbers); time, attendance and clock-in location; leave and absence, including sickness; training and certificates; documents and photos; incident and injury records; messages; sign-in and audit records. |
| Special categories | Health information (health questionnaires, sickness absence, injury and incident records). The Customer decides whether to record it; it is encrypted at rest and access-controlled. No other special categories are intended. |
3. Confidentiality
The Processor ensures that people it authorises to process Customer Personal Data are bound by confidentiality.
4. Security
The Processor applies appropriate technical and organisational measures, which at the date of this DPA include:
- encryption in transit (HTTPS) and encryption in the database of especially sensitive fields (PPS numbers, bank details, health questionnaires);
- hashed passwords, sign-in lock-outs after repeated failures, session time-outs, and optional or required two-factor authentication;
- role-based access inside each customer's account, and a service designed to keep each customer's data separate from every other customer's complete the cross-company isolation audit before relying on this statement;
- an audit trail of important actions, and administrator controls to sign people out of all devices;
- nightly backups with integrity checks, tested restores, and availability monitoring;
- access to production systems limited to named administrators using key-based authentication.
5. Sub-processors
The Customer gives general authorisation for the sub-processors listed on the sub-processors page. The Processor will give at least 14 days' notice (by email or in the service) of any addition or replacement, and the Customer may object on reasonable data protection grounds in that time; if the objection cannot be resolved the Customer may cancel without penalty. The Processor imposes on each sub-processor data protection obligations no less protective than this DPA and remains responsible for their performance.
6. Assisting the Customer
- Data subject requests: the Processor will promptly pass on any request it receives about Customer Personal Data and will help the Customer respond, using the export and editing tools in the service where possible.
- Impact assessments and consultations: reasonable help with data protection impact assessments and prior consultation with the Data Protection Commission.
7. Personal data breaches
The Processor will notify the Customer without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting Customer Personal Data, with the information it has (nature, categories and approximate numbers affected, likely consequences, measures taken) and further detail as it becomes available. Customers, as controllers, are responsible for notifying the Data Protection Commission within 72 hours where required, and affected individuals where necessary. See the Data protection overview.
8. International transfers
The service is hosted in Amsterdam, the Netherlands. Customer Personal Data is transferred outside the European Economic Area (EEA) only to sub-processors on the sub-processors page, and only with an approved transfer mechanism (EU Standard Contractual Clauses or an adequacy decision). The Standard Contractual Clauses (processor module) are incorporated into this DPA where a transfer needs them. Confirm mechanisms provider by provider.
9. Return and deletion
While the account is active the Customer can export its data at any time (Settings → Export your data), and the Processor will help on request within 30 days. On termination the Customer has 30 days to take a final export. The Processor then deletes Customer Personal Data from the live service within 30 days and from backups as they expire within a further 30 days, and will confirm deletion in writing on request, unless the law requires the Processor to keep something (in which case it is kept confidential and used only for that purpose).
10. Audits and information
The Processor will provide the information reasonably needed to show compliance with this DPA and allow for audits by the Customer or an auditor it appoints, on reasonable notice, no more than once a year (unless a breach has occurred), during business hours and subject to confidentiality and to not disrupting other customers.
11. Liability and law
Liability under this DPA is subject to the limits in the Terms of Service. This DPA is governed by the laws of Ireland. If it conflicts with the Terms of Service on the handling of personal data, this DPA prevails.