Data Processing Agreement

§ 1. Subject matter, nature and purpose of processing

The Controller entrusts the Processor with the processing of personal data entered into the System on behalf of the Controller, solely for the purpose of providing the PSH Worker Service described in the Terms of Service: keeping working-time records (also without internet access, if the Controller enables this feature), handling punch correction requests and end-of-work reminders, organising work (working hours, leave, days off, groups, work sites), handling tasks and the client portal, making the Controller's information notice available to employees and recording acknowledgements that they have read it, securing access to the panel, sending notifications, reporting and exporting data, including to HR and payroll software.

Processing covers the following operations: collection (via the app and the panel), recording, organisation, storage (including temporary storage in the app's memory on the User's phone – data saved without signal until it is sent and copies for working without signal: assigned tasks with reference photo thumbnails, the profile and the current day's punches – until logging out of the app), viewing, disclosure to persons authorised by the Controller, export and erasure – in an IT system.

§ 2. Types of data and categories of data subjects

• Categories of data subjects: the Controller's employees and associates, panel users designated by the Controller, the Controller's clients and their contact persons, as well as the Controller's data protection officer, if the Controller provides their details in the information notice.
• Types of data: first name, last name, username, job title, phone, e-mail, interface language; the employee identifier in the HR and payroll software (assigned by the Controller, without the PESEL number – the System does not accept the PESEL number in this field); time and type of punches and the source of the entry (punch, correction requested by the employee, addition by a supervisor, offline punch); GPS location at the moment of punching (if enabled by the Controller), address, accuracy; device data (identifier, model, operating system, app version, battery level, network type, IP address, anti-spoofing signals); push token; work sites (zones), the declared work site (with the position at the moment of declaring it, if the phone determined it) and the flag for punches outside the zone; location check requests and responses to them; failed punch attempts and security events (including technical rejections of offline punches); leave requests, punch correction requests (reason, decision, supervisor's note), a register of reminders sent about work that has not been ended, days off, working hours, calibrations and corrections; tasks, photos and files (including those saved without signal) and position when marking a task as done; client data, client portal passwords (as a hash) and the history of report sends; audit log entries.
• Working without signal (Android app, where the Controller uses tasks or offline punches): the device's public key and its attestation certificate (phone model, operating system and security patch version, verified boot state), one-time key attestation challenges, readings of the phone's system clock (time since boot, boot count) and the time from the phone's clock (time anchors), operations saved without signal (punches, photos, task completions) together with the device's digital signature, and for offline punches – the time calculated by the server, the time of sending, the GPS position read without internet access (if the Controller has enabled location), the result of the device check and the supervisor's decision.
• Panel accounts: two-factor authentication data (the authenticator app added to the account – its key is stored by the authentication service; events of enabling, changing and resetting it).
• Information notice: the content of the versions of the Controller's information notice (including the Controller's details and – optionally – those of the data protection officer) and acknowledgements that it has been read (employee, version, server time, language, device type, app version, device identifier and whether it is the phone linked to the account, and in the browser – its technical description, the User-Agent).
• Export to HR and payroll software: the Controller's export settings and templates, the mapping of absence types to the software's codes and audit log entries on each export (person, time, period, template, list of employees, file hash). The export file itself is created in the browser of the Controller's user and is not stored in the System.
• The System is not intended for processing special categories of data (Art. 9 GDPR), except for information on the type of absence (e.g. sick leave, care of a child or another person), which the Controller enters in the Leave module and passes on in exports – without diagnoses or medical documents. The Controller does not enter any other such data into description fields, photos or files.

§ 3. Duration

This Data Processing Agreement remains in force for the term of the agreement for the use of the System and for the period necessary to return or delete the data in accordance with § 9.

§ 4. Obligations of the Processor

The Processor:

1. processes the data only on documented instructions from the Controller – such instructions include the Terms of Service, this agreement, the System configuration made by the Controller (e.g. enabling modules or location) and instructions sent by e-mail – also with regard to transfers of data to a third country; where Union or Polish law requires the Processor to process the data, the Processor informs the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; if, in the Processor's opinion, an instruction infringes data protection law, it informs the Controller without delay,
2. ensures that persons authorised to process the data have committed themselves to confidentiality,
3. applies the security measures referred to in Art. 32 GDPR, described in § 5,
4. taking into account the nature of the processing, assists the Controller in fulfilling its obligation to respond to requests from data subjects (including through the export, editing and account deactivation functions in the panel) and its information obligation (Art. 13 GDPR) – through the information notice generator and the register of acknowledgements that the notice has been read; the content of the notice and the decision to publish it rest with the Controller,
5. assists the Controller in complying with the obligations under Arts. 32–36 GDPR, including a data protection impact assessment where required,
6. makes available to the Controller the information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and allows for audits (§ 8),
7. maintains a record of the categories of processing activities carried out on behalf of the Controller (Art. 30(2) GDPR).

§ 5. Security measures

• encryption of transmissions (TLS) and storage of passwords only as hashes,
• two-factor authentication (password and TOTP one-time code) for all accounts with panel permissions and for platform administrator accounts – without the second factor the server does not make panel data available, notifications containing other persons' data are delivered only to supervisors' devices after two-factor authentication, and the authentication is reset by the company boss (in the case of the boss – by the platform administrator) with an entry in the audit log,
• isolation of company data at database level (Row Level Security) and a system of permissions granted by the Controller,
• punches recorded only by the server after validation, immutability of original punches (corrections requested by employees, additions by supervisors, calibrations and decisions on offline punches are separate, flagged entries), an audit log of administrative changes, exports and access by the platform administrator,
• when working without signal: encryption of the operation queue on the phone with a key stored in the phone's hardware key store (Android Keystore, on an iPhone – the iOS Keychain; photos waiting to be sent and reference photo thumbnails – in the app's private directory), a digital signature of each operation with a non-exportable device key, verification of the key attestation, event times determined on the server from the database clock (time anchors) and acceptance of each offline punch by a supervisor,
• binding of an employee account to a single device, detection of location manipulation, rate limits on login attempts and on access to the client portal,
• private storage of task photos and files with access via time-limited signed links,
• creation of export files (including the export to HR and payroll software and the export of the Company Account data) in the browser of the Controller's user, without storing them on the server, with neutralisation of spreadsheet formulas in CSV files,
• database hosted in the EU region (Frankfurt); the database provider's service plan used by the Processor does not include automatic backups available to the Processor – before System updates, the platform administrator manually makes a copy of the database, which is stored on the administrator's computer and deleted no later than 30 days after it was made (§ 9),
• access by the Processor's staff only to the extent necessary to maintain the Service and provide support, on the basis of an authorisation.

§ 6. Sub-processing (sub-processors)

The Controller gives general authorisation for the Processor to engage sub-processors. As at the date of the most recent update of this agreement, these are:

Data is transferred to a third country on the basis of a European Commission adequacy decision (Art. 45 GDPR) – in the case of the United Kingdom and US entities certified under the EU-US Data Privacy Framework – and in other cases on the basis of standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR).

The Processor informs the Controller by e-mail at least 14 days in advance of any intended addition or replacement of a sub-processor. The Controller may raise a reasoned objection within that period; if the parties do not reach an agreement, the Controller may terminate the agreement for the use of the System with immediate effect and receive a refund of the proportionate part of the fee for the unused period. This does not limit the right to cancel with a full refund within 14 days of the conclusion of the agreement (§ 4 of the Terms of Service).

Subject to the next sentence, the Processor imposes on sub-processors the same data protection obligations as those arising from this agreement and remains liable to the Controller for their performance. The System uses the public services of the OpenStreetMap Foundation (Nominatim, map tile servers delivered by Fastly, Inc.) and Apple Maps in the iPhone app on the Controller's instructions (enabling location at punch time or modules that use maps), under the terms set by those entities – the Processor does not conclude a separate data processing agreement with them and therefore limits the data transferred to them to the scope described in the table (coordinates without identifiers, the address entered, the device's IP address and the map area viewed), without Users' first names, last names or account identifiers. A Controller that does not accept these terms may disable location at punch time and the modules that use maps, or raise an objection in accordance with the previous paragraph.

§ 7. Personal data breaches

The Processor notifies the Controller by e-mail (to the company boss's address) without undue delay, and no later than 48 hours after becoming aware of it, of any personal data breach concerning the entrusted data, providing the information required by Art. 33(3) GDPR to the extent available, and takes measures to mitigate the effects of the breach.

§ 8. Audit

The Controller may verify compliance with this agreement – in the first instance through written questions, which the Processor answers within 14 days. An on-site audit at the Processor's premises – carried out by the Controller or by an auditor mandated by it who is bound by confidentiality and is not a competitor of the Processor – is possible once a date has been agreed at least 14 days in advance, during working hours, no more than once a year (unless a breach has occurred), while protecting trade secrets and the security of other customers' data. The costs of the audit are borne by the Controller.

§ 9. End of processing

The entrusted data is stored in the System until the provision of the Service ends, unless the Controller instructs that it be deleted earlier. Once the provision of the Service ends, the Processor closes the Company Account and, at the Controller's choice, returns the entrusted data (export of the Company Account data – a ZIP archive with CSV/XLSX files and task photos and files) or deletes it; the entrusted data is permanently deleted from the System no later than 30 days after the provision of the Service ends (earlier on the Controller's instruction), unless the Controller instructs that the deletion be put on hold (e.g. in connection with a pending dispute in which it needs the data) or Union or Polish law requires their further storage (e.g. at the request of a competent authority). The Processor informs the Controller by e-mail without delay of any hold on deletion and of its basis; once that basis ceases to apply, the data is deleted without undue delay. The database provider's service plan used by the Processor does not include automatic backups available to the Processor; the only copies at the Processor's disposal are database copies made manually by the platform administrator before System updates, stored on the administrator's computer and deleted no later than 30 days after they were made – data deleted from the System may therefore remain in such a copy for no longer than 30 days after its deletion. Apart from those copies, the Processor keeps – only for as long as necessary to hand it over – an export of the Company Account data prepared at the Controller's request after the Company Account has been closed; it deletes that export without undue delay after handing it over, no later than on the day the data is deleted from the System.

In the event of cancellation within 14 days (§ 4 of the Terms of Service), the Company Account is closed immediately and the Processor permanently deletes the entrusted data without undue delay once 30 days have elapsed since the account's closure (database copies – no later than 30 days after they were made), subject to a hold on deletion in accordance with the previous paragraph. Before submitting the cancellation, the Controller may download an export of the Company Account data in the panel and, until the data is deleted, may request that the export be provided by writing to support@pshu.pl.

Data that the Controller must retain for longer as an employer (e.g. working-time records and acknowledgements of the information notice) is exported by the Controller before the data is deleted and retained by the Controller itself. Deletion of data from the System does not cover data saved by the Controller outside the System (e.g. downloaded reports and exports).

§ 10. Final provisions

The parties' liability under this agreement is governed by the GDPR and the provisions of the Terms of Service. Matters not governed by this agreement are subject to the Terms of Service, the GDPR and Polish law. The Polish version of this agreement is binding.

A Controller who needs the data processing agreement as a separate document signed by the parties may request it at support@pshu.pl.