Data processing agreement

1. Parties and roles

This agreement applies between the customer that opens a Daytide workspace (the “controller”) and[Company legal name and registered address] (the “processor”). It forms part of the terms of service and applies wherever the processor handles personal data on the controller's behalf.

2. Subject matter and duration

The processor provides an automatic record of working time and related reports. Processing lasts for as long as the controller has a workspace, plus the deletion period in section 9.

3. Nature and purpose of processing

Collecting activity records from the Daytide desktop app, storing them, sorting them by client, project and kind of work (including by automated means and AI models), presenting them to the person concerned and, in aggregated form, to the controller's owners and managers, and producing reports.

4. Data subjects and categories of data

Data subjects: the controller's employees and contractors who use the app, and its account holders.

Categories of data:

• identification and account data: name, work e-mail, role, team;
• device data: device name, operating system, app version, state of permissions;
• activity data: time intervals; activity state (active, idle, locked, asleep); application name; window title, document path and web address as reduced by the capture policy; flags for private, meeting and full-screen windows;
• derived data: time entries, labels, the evidence for each label, answers given in chat, corrections;
• chat messages written to Daytide.

Not processed: screenshots, screen recordings, keystrokes, mouse movement, clipboard contents, contents of files, e-mails or messages, camera or microphone input. The app has no function to collect these.

Special categories: the service is not intended to process special categories of data. Titles and addresses can reveal such information incidentally. The on-device removal of personal details and the default exclusion list (banking, health, personal webmail, social media, shopping, password managers, adult content, job sites) exist to reduce that risk. The controller can extend the exclusion list.

5. Controller's instructions and duties

The processor acts only on the controller's documented instructions, which are these terms and the settings the controller chooses in the product. The controller is responsible for the lawful basis, for informing data subjects, and for any impact assessment or consultation with employee representatives that the law requires.

6. Confidentiality and security

Persons authorised to process the data are bound by confidentiality. The processor maintains at least these measures:

• separation of each customer's data from every other customer's at the data-access layer, with automated tests;
• removal of personal details on the device, again on receipt, and again before any AI model call;
• encryption in transit; [encryption at rest: confirm and describe];
• device tokens stored only in hashed form on the server and in the operating system's protected store on the device;
• signed app updates;
• an append-only log of settings changes, role changes, exports and support access;
• two-factor authentication for the processor's staff, and read-only, visibly marked, logged support access;
• [backups, incident response, penetration testing: describe once in place].

7. Sub-processors

The controller authorises the following sub-processors. The processor will give [30 days'] notice of any addition, and the controller may object.

8. International transfers

[To be completed: storage region, whether data leaves the EEA or UK, and the transfer mechanism relied on, for example standard contractual clauses.]

9. Assistance, return and deletion

The processor helps the controller answer requests from data subjects. The product lets each person see and export their own data and send a deletion request, and lets the controller export the workspace's data. On termination the processor deletes the controller's data within [period], unless the law requires it to be kept.

10. Breach notification

The processor notifies the controller of a personal data breach without undue delay, and at the latest within [48 hours] of becoming aware of it, with the information the controller needs to meet its own duties.

11. Audits

[To be drafted: the information and audit rights the controller has, and how they are exercised.]

12. Help with assessments

On request the processor provides the information the controller needs for a data protection impact assessment or a legitimate-interest assessment, including [template documents, to be prepared] and a description of what the app records under each capture setting.