Data Processing Agreement

1. Parties and roles

This Data Processing Agreement ("this Agreement") is between the organisation that holds a CrewClock workspace ("the Customer") and Dynamics Bridge, the provider of CrewClock ("the Provider"), reachable at https://dynamicsbridge.com and contact@dynamicsbridge.com.

The Customer is the controller of the personal data in its workspace. The Provider is the processor of that data and acts only on the Customer's instructions.

This Agreement is part of the Terms of Service and applies for as long as the Customer has a workspace, including a trial. If this Agreement and the Terms say different things about personal data, this Agreement applies.

2. Subject matter, duration, nature and purpose

The processing consists of running CrewClock for the Customer: recording timesheets, approvals, leave, payroll, invoicing, attendance and reports, sending the related emails and notifications, storing uploaded documents, and keeping backups.

It lasts for the length of the subscription, including any trial, and for the return and deletion period in section 8.

3. Categories of data and data subjects

Personal data: names, work email addresses and usernames; designation, joining date and employment details; pay rates, salary, deductions and payroll results; bank details used for salary slips; national ID numbers and uploaded staff documents where the Customer records them; hours worked with task and project descriptions; leave requests and balances; attendance check-in and check-out times with the location reported by the phone where the Customer switches attendance on; the names and contact details of the Customer's clients; and the activity log of who changed what in the workspace.

Data subjects: the Customer's staff and contractors, and the contact persons at the Customer's clients.

4. Obligations of the Provider

The Provider processes personal data only on the Customer's documented instructions. The Customer's instructions are its use of the Service, its settings in the workspace and this Agreement. If the Provider believes an instruction breaks data protection law, it tells the Customer before acting on it.

Everyone working for the Provider who may access workspace data, staff and contractors alike, is bound by a confidentiality duty and has access only when needed to provide support or maintenance; such access is recorded.

The Provider applies the technical and organisational measures described on the CrewClock security page (/security): hosting in the European Union, encryption in transit, encryption of the most sensitive fields at rest, workspace isolation, role-based permissions, two-factor sign-in, daily backups and an activity log.

The Provider helps the Customer answer requests from data subjects (access, correction, deletion and export) within 10 working days of the Customer's request. Most of these can be done by the Customer's owner directly in the Service.

On request the Provider helps the Customer with security assessments, data protection impact assessments and consultations with a supervisory authority, to the extent the information is not already available on the security page or in this Agreement.

The Provider keeps a record of the processing it carries out for the Customer and makes it available on request.

5. Sub-processors

The Customer authorises the Provider to use the following sub-processors, each under a written agreement that imposes data protection duties no less protective than this Agreement. The Provider remains responsible to the Customer for their work.

Hetzner Online GmbH: hosting of the application, the database, uploaded files, the background job queue and the daily backups. Location: Helsinki, Finland (European Union).

Microsoft (Microsoft 365, Exchange Online): sending the emails the Service generates: invites, reminders, approvals, salary slips, invoices and reports; each email carries only what the recipient is meant to receive. Location: Europe (the Microsoft 365 tenant's Exchange Online data is held at rest in Microsoft's European data centres).

Google LLC: optional sign-in with a Google account, used only for Users who choose it; Google receives the sign-in request and returns the name and email address of the account. Location: United States and worldwide, under Google's EU-approved transfer safeguards; no workspace data is sent.

Web push services of Google, Apple and Mozilla: delivery of browser push notifications that a User switches on; a notification carries a short title and a link, never work data. Location: the User's browser vendor; no workspace data is sent.

The Provider tells the Customer at least 30 days before a new sub-processor starts handling workspace data, by notice inside the Service or by email to the workspace owner. The Customer may object within that period on reasonable data protection grounds; if the objection cannot be resolved, the Customer may end the subscription and export its data without penalty.

6. Security incidents

If the Provider becomes aware of a personal data breach affecting the Customer's data, it notifies the Customer without undue delay and in any case within 72 hours, by email to the workspace owner.

The notice says what is known so far: what happened, which data and roughly how many people are affected, the likely effect, and what the Provider is doing and recommends. Information that is not yet known is sent as soon as it is.

7. International transfers

Workspace data is hosted and processed in the European Union. The Provider's team works from outside the European Union and the United Kingdom, so two things happen under a safeguard: support and maintenance access to the Service by the Provider's staff (section 4), and a disaster-recovery copy of the newest daily backup that the Provider keeps at its own office for up to 30 days, on an access-controlled computer, used only to restore the Service after a loss on the hosting side.

The safeguard is the European Commission's standard contractual clauses (controller to processor), which the Provider signs with the Customer together with this Agreement on request, alongside the measures on the security page. The Provider does not transfer workspace data to any other country or recipient.

Email and push notifications leave the European Union only to the extent that the sub-processors in section 5 deliver them to the recipient.

8. Return and deletion of data

The Customer may export its data at any time: every report, invoice and salary slip exports to Excel, CSV or PDF from inside the Service, and a full workspace export is provided on request.

After the subscription ends, the data is kept for 90 days so that it can be exported or the subscription resumed, then deleted. The Customer may ask for earlier deletion at any time; the Provider then deletes the workspace, its files and its records within 30 days of the request, unless the law requires the Provider to keep something, in which case the Provider says what and for how long.

Backups expire on their normal cycle after the deletion: 14 days on the server and up to 30 days for the off-site copy.

9. Audits

The Provider gives the Customer, on request, the written information needed to show that this Agreement is being kept.

The Customer may carry out, or have an independent auditor bound by confidentiality carry out, one audit a year at 30 days' written notice, during normal working hours, limited to the processing done for the Customer and arranged so that it does not disrupt the Provider's other customers or expose their data. Each side bears its own costs.

10. Liability and governing terms

Liability under this Agreement, the governing law and the way disputes are handled are as set out in the Terms of Service.

11. How to get a signed copy

To receive this Agreement as a signed PDF, email contact@dynamicsbridge.com from the owner's email address of the workspace, with the workspace name and the Customer's legal name and address. Dynamics Bridge returns a countersigned PDF.

This Agreement applies from the day the workspace is created, whether or not a signed copy is requested.