Data Processing Agreement

The customer, the company identified in the account, is the controller: it decides what data is collected, why and for how long. ClockWitness is the processor: it processes customer data only on the customer's behalf and on its instructions.

ClockWitness is provided by Espírito Rebelde Publicidade e Marketing Lda.

Address: Rua da Fábrica 222, Armazém 2, 4470-768 Maia, Portugal

Registration number: 509360378

Privacy and data protection contact (DPO): Bruna Teixeira, privacy@clockwitness.com.

Subject matter and purpose: providing the service described in the Terms of Service, that is, recording and evidencing working time and managing schedules, absences, reports and timesheets, according to the features the customer enables.

Nature of the processing: collection, hosting, storage, organisation, display, export and deletion of the data.

Duration: for as long as the Terms of Service are in force and until customer data is deleted, as set out in section 11.

Data subjects: the people who work for the customer (members, managers and account owners) and other people the customer invites to the account, for example its own clients with read access.

Categories of data: account data (name, email, role, language, time zone); devices (computer name, operating system and agent versions); time records, breaks, projects and task descriptions; screenshots; level of keyboard and mouse activity (never what is typed or which keys are pressed); application names and window titles, if the customer keeps this on; location at clock-in and clock-out in the mobile app, if the customer requires it; schedules, absences and payroll; and the audit log.

Special categories: the service does not ask for them, but they may appear in screenshots, window titles or free-text notes. The customer should configure the service and instruct its team so as to reduce that risk.

We process customer data only on the customer's documented instructions, including with regard to transfers outside the European Economic Area (EEA). The instructions are the Terms of Service, this Agreement, the settings the customer chooses in the dashboard (for example screenshots, cadence, application tracking, location and retention period) and any other written instructions it gives us. If the law requires us to process the data differently, we will inform the customer beforehand, unless the law prohibits this.

If we consider that an instruction infringes the GDPR or another data protection law, we will inform the customer immediately.

The customer gives us general written authorisation to engage sub-processors, such as external hosting services, where the application, the database, screenshot storage and backups run.

The current list of sub-processors is available on request by email to privacy@clockwitness.com.

We email account owners before adding or replacing a sub-processor, so that the customer can object on reasonable grounds. If we cannot find a solution, the customer may close the account before the change takes effect.

We impose on each sub-processor, by contract, data protection obligations equivalent to those in this Agreement, and we remain liable to the customer for their performance.

We host customer data in data centres in the European Union, and our backups are kept in the European Union, encrypted.

If our authorised staff or a sub-processor access customer data from a country outside the EEA, we do so only under one of the safeguards in Chapter V of the GDPR: an adequacy decision of the European Commission (including, for the United States, the EU-U.S. Data Privacy Framework, where the recipient is certified under it) or the standard contractual clauses adopted by the European Commission, together with a transfer impact assessment and any supplementary measures found to be necessary. The details are in the "International transfers" section of the Privacy Policy.

If the customer, or users it authorises, access the data from outside the EEA, that access takes place on the customer's instructions and under its responsibility.

We help the customer respond to requests from data subjects exercising their rights. The service itself lets the customer: show each person their own records and screenshots; correct time records, with each correction logged; switch screenshots off for the whole company or for specific people, and switch application tracking off; and export records in CSV and PDF.

When the customer asks us in writing to erase a person who has already been deactivated, we delete their screenshots, application and window records, exact GPS coordinates, devices, credentials and free-text notes, and replace their email address with a pseudonym. We keep the working-time and pay records that the customer may be legally required to keep.

If a data subject contacts us directly about customer data, we forward the request to the customer without undue delay and do not respond on the substance unless the customer instructs us to.

The customer can, at any time, export its records (return) and request closure of the account. On closure, after a full export of the records has been generated, we delete the company, its users, its records and the stored screenshots, unless the law requires us to keep some of the data. Screenshot images are not included in exports.

The closure export is sent to the owner by email, as a personal link to download it. The link works without signing in, even after the account has been deleted, for 30 days; after that period it stops working and the file is deleted from our servers.

Deleted data disappears from backups as they expire: daily database backups are kept for 30 days, and the other backups rotate and are replaced periodically.