Data Processing Agreement (for companies)

1. Definitions

• Customer Personal Data: personal information about Customer's workers, managers, clients, applicants and other people (including non-users such as injured persons and emergency contacts) that Customer or its users put into the Service, and that Provider processes on Customer's behalf.
• Applicable Privacy Law: PIPEDA, Quebec's private-sector privacy act (Law 25), other Canadian provincial laws that apply, and, where they apply, US state privacy laws and the GDPR / UK GDPR.
• Subprocessor: a third party Provider engages to process Customer Personal Data.
• Security Incident: a breach of security leading to unauthorized access to, or loss or disclosure of, Customer Personal Data.

2. Roles

Customer controls Customer Personal Data and decides why and how it is processed (through its settings, roles and permissions). Provider processes it on Customer's behalf. Provider controls the data it processes for its own purposes, as described in its Privacy Policy (accounts, billing, security, analytics, the Job market and worker portfolios).

3. Customer's responsibilities

Customer is responsible for:

• having a lawful basis, and giving all notices and obtaining all consents required, for collecting and entering Customer Personal Data, including live location (which also requires each worker's agreement in the app), photos, health information in incident reports, government ID and licence numbers, emergency contacts, and information about non-users;
• configuring roles, permissions, client sharing, live location, retention settings and AI features appropriately;
• meeting its own employment-standards, record-keeping and privacy obligations, including keeping records for the periods its law requires (for example, Ontario's Employment Standards Act, 2000);
• answering requests from its workers about Customer Personal Data, with Provider's reasonable help;
• the accuracy of data it enters, and the instructions it gives.

4. Provider's obligations

Provider will:

1. process Customer Personal Data only to provide, secure, support and improve the Service, on Customer's documented instructions (the Terms, this DPA and Customer's settings), and as required by law;
2. ensure staff with access are bound by confidentiality, access is limited to those who need it, and admin-panel actions (including reading AI conversations and viewing the Service as a user for support, which is read only unless a second reason and an emailed code are given, lasts at most 30 minutes, and is told to that user) are logged in an audit log;
3. maintain reasonable technical and organizational safeguards (Annex B);
4. notify Customer without undue delay, and in any case within 72 hours, after confirming a Security Incident affecting Customer Personal Data, with the information reasonably available, and cooperate with Customer's notification duties;
5. provide reasonable help with access, correction, portability and deletion requests, and with privacy impact assessments that Law 25 requires of Customer (including for transfers outside Quebec);
6. not sell Customer Personal Data or use it for third-party advertising;
7. not use Customer Personal Data to train AI models, and use Subprocessors whose terms are consistent with this;
8. on request, provide information reasonably needed to show it meets this DPA (no more than once a year, unless required by a regulator or after an incident).

5. Subprocessors

Customer authorizes the Subprocessors in Provider's Outside Services List (published at urtimesheet.com/legal/subprocessors). Provider will update the list at least 30 days before adding or replacing a Subprocessor that receives Customer Personal Data. Customer may object on reasonable privacy grounds; if the parties cannot resolve it, Customer may cancel the affected service as its sole remedy. Provider remains responsible for its Subprocessors' performance under this DPA.

6. International transfers

Customer Personal Data may be processed in the United States and Europe by Subprocessors (see the list), and the primary hosting region is Canada. Provider will use contractual protections with Subprocessors. Customer acknowledges information processed abroad may be accessible to foreign authorities. Where the GDPR or UK GDPR applies, transfers rely on an adequacy decision (including Canada's) or on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, which the parties incorporate by reference as needed.

7. Retention, return and deletion

• During the subscription, Customer Personal Data is kept as described in the Privacy Policy; several categories (messages, incidents, complaints, documents) currently have no automatic time limit, and Customer can delete many records itself.
• Records stay readable on every plan after downgrading or cancelling.
• A company closes when Customer's owner closes the company in the app (or its owner deletes their account, which closes a company they run alone). Provider deletes or anonymizes Customer Personal Data 6 months after the company closes, except where law requires retention or as held in backups until overwritten. Until then, Customer's owner can reopen the company and download its records, and on Customer's written request Provider will export Customer Personal Data in a common format.
• Customer is responsible for exporting records it must keep before they are deleted.

8. Liability

Each party's liability under this DPA is subject to the limitations in the Terms of Use.

9. Order of precedence

If this DPA conflicts with the Terms of Use on processing of Customer Personal Data, this DPA prevails.

Annex A: Processing details

• Subject matter and duration: providing the Service for the term of the subscription and the retention periods above.
• Data subjects: Customer's owners, admins, managers, workers (employees and contractors), applicants, clients and client contacts; non-users such as emergency contacts, injured persons, bystanders and people in photos.
• Categories: contact and profile details; employment and pay details; shifts, timesheets (including raw tap times and change history), breaks, requests and availability; location check results, live location (with consent) and blurred home distance; documents and licences; incident reports (may include health data); complaints; ratings; equipment; messages and announcements; Job market applications; client portal data; AI feature inputs and outputs.
• Sensitive data: health data in incident reports; government ID and licence numbers; date of birth and gender; pay; harassment complaints; photos of people.
• Operations: storage, hosting, display, calculation, messaging, notifications, translation and AI assistance, export, support and deletion.

Annex B: Security measures (summary)

HTTPS for all connections; encrypted and verified database connection; passwords hashed and salted (scrypt), minimum 8 characters; role- and permission-based access enforced on the server; private file storage with expiring links; rate limits on sign-up, sign-in and password reset; 30-day sessions revocable on all devices; emailed one-time code for staff admin access; audit logging of staff actions; Android cloud backup disabled; crash and error reports kept on Provider's own servers, with the account and not the email. Two-step sign-in: optional for users (email code or authenticator app), which Customer can require for its admins; required for Provider's staff (authenticator app); an email to the user on a sign-in from a new device.