Data processing agreement

This agreement is between the Company named on the account (“the Company”) and [HOURCLOSE LEGAL ENTITY], of [HOURCLOSE REGISTERED ADDRESS] (“Hourclose”). It forms part of the Hourclose terms of service and runs while they do.

For the personal data in the Company's account, the Company is the controller (the business, under the CCPA; the data fiduciary, under the DPDP Act) and Hourclose is its processor (service provider; data processor). Hourclose's own data about the people who sign in, pay and receive its email is covered by Hourclose's privacy notice, not by this agreement.

• Purpose: running Hourclose for the Company: recording time and leave, approving it, closing pay periods, invoicing clients, and reporting on it, as the Company uses it.

• People: the Company's staff and contractors; its clients' contacts; members of an accountant or payroll bureau the Company links.

• Data: name, email, mobile number, role, manager, location, timezone, work schedule, employment type, start and departure dates, payroll identifier, kiosk PIN, rates and cost rates; time entries, breaks, notes, tags and custom fields; leave requests, balances and holidays; overtime; pay period and pay file contents; invoices, estimates and expenses; client contact names and emails; comments and the history of each record.

• Sensitive data: Hourclose asks for none. A leave record can show that a person took sick leave, or family and domestic violence leave, and a note can hold whatever its author writes.

• Duration: while the account exists, and then under section 9.

Hourclose processes the data only on the Company's instructions. These terms, the product's settings and the acts of the Company's admins and owners are those instructions. Hourclose tells the Company if it believes an instruction breaks data protection law.

Hourclose does not sell or share the data, does not use, keep or disclose it for any purpose other than the purpose in section 2 or outside its direct relationship with the Company, and does not combine it with data from elsewhere except as the CCPA allows a service provider. Hourclose never uses it to monitor anyone. Hourclose tells the Company if it can no longer meet its CCPA duties, and the Company may then take reasonable steps to stop and remedy unauthorised use.

Everyone at Hourclose who can reach the data is bound to keep it confidential. Hourclose protects the data by the measures on its security page, [SECURITY PAGE ADDRESS].

An import a support person makes on the Company's ask in a support conversation shows in the Company's history as theirs.

The Company authorises the sub-processors on Hourclose's sub-processor list. Hourclose binds each to data protection terms no weaker than this agreement and stays responsible for it.

Before a new sub-processor processes the data, Hourclose emails every owner, and the members of a bureau that pays for the Company, 30 days ahead. The Company can object through the helpdesk within those 30 days. If its objection stands, an owner may close the account, and Hourclose refunds the unused part of the paid term in proportion.

The Company's admins and owners can, in the product, export one person's full record, correct it with its prior version kept, and erase it. A person's request that reaches Hourclose is passed to the Company within 2 working days. Hourclose helps the Company with impact assessments and consultations with a regulator where they concern Hourclose's processing.

Hourclose emails every owner and admin, and the members of a bureau that pays for the Company, within 48 hours of becoming aware of a breach touching the Company's data, and helps the Company with the notices the law asks of it.

Hourclose makes available to the Company the information needed to show it meets this agreement, and allows and contributes to audits, inspections included, by the Company or an auditor it names. [AUDIT FREQUENCY, NOTICE AND COST: counsel to set.]

Any admin can export the whole account at any time; the export is the Company's copy. When an owner closes the account, the closing owner is emailed an export. The account can be restored for 30 days and is then deleted from live systems; backups are beyond use from deletion and gone within 90 days. For a Company in India, Hourclose keeps its log of acts for one year after deletion, as the DPDP Rules require, and then deletes it.

The data is stored in [HOSTING REGION]. Where data from the UK leaves the UK for a country without UK adequacy regulations, the International Data Transfer Addendum issued by the UK Information Commissioner applies to it, with the Company as exporter and Hourclose as importer. [ADDENDUM TABLES: counsel to complete once the hosting region and sub-processors are settled.]

Where the Australian Privacy Principles apply to Hourclose's handling of the Company's employee records, Hourclose complies with them.

Where this agreement and the terms of service differ on personal data, this agreement governs. Where the UK Addendum and this agreement differ, the Addendum governs.