Data processing agreement

1. Roles

The customer is the controller of the personal data of its workers and users. TopTimesheets is the processor and acts only on the customer's documented instructions: the settings the customer chooses and the terms of service.

2. Subject matter and duration

Recording working time and attendance, schedules, leave, and preparing pay runs and payroll files, for as long as the customer's account is open, and afterwards only as long as section 9 allows.

3. Data and data subjects

Data subjects: the customer's workers, managers and other users.

Data: identity and contact details, employment details, time and attendance records, location at the moment of each punch, selfies when the customer requires them, leave and pay information, bank details and national IDs (encrypted), and messages sent through the service.

4. Our obligations

We process the data only to provide and secure the service, keep it confidential, and make sure our staff are bound by confidentiality.

We apply the security measures described on our Security page, including tenant isolation in the database, encryption of bank details and national IDs, and an append-only audit log.

5. Sub-processors

The customer authorises the sub-processors listed on our Sub-processors page. We give at least 30 days' notice of a new one there; the customer may object on reasonable grounds and, if we cannot resolve it, end the affected service.

6. Helping with people's rights

The service has tools for this: workers can download their data and ask for a correction or deletion from the “My data” page; admins review each request, can put it on legal hold with a reason, and can export a person's data. We help with anything the tools do not cover.

7. Retention controls

The customer chooses how long selfies are kept (90 days by default) and whether punch locations are cleared after a number of months once the pay period is locked. A nightly job applies these settings. The customer can also turn every AI feature off for its organisation.

8. Personal data breaches

We will tell the customer without undue delay, and in any case within 72 hours of becoming aware of a breach affecting its data, with the information the customer needs to meet its own obligations.

9. End of the service

The owner can export all of the organisation's data at any time as CSV files. After the account is closed we delete the customer's data, except where the law requires us to keep it; backups are overwritten on a rolling basis.

10. Transfers, audits and records

International transfers follow section 6 of the Privacy policy. The customer can review changes in its audit log and export it; we will provide the further information needed to show compliance with this agreement.