Data Processing Agreement (DPA)

Incorporated pursuant to Article 28 of the GDPR

1. Roles And Scope Of Processing

1.1. Client = Data Controller, SIA “Duck typing” = Data Processor. This DPA applies to personal data processed by the Processor on behalf of the Controller under the Contract (“Client Personal Data”). The details of the processing are set out in Annex I.

1.2. The Processor processes Client Personal Data only on the Controller’s documented instructions, including with regard to transfers to third countries, unless required to do so by EU or Member State law; in that case the Processor informs the Controller before processing, unless that law prohibits it. The Contract, the Controller’s configuration and use of the Platform, and this DPA are the Controller’s complete instructions. The Controller instructs the Processor to anonymise Client Personal Data for the purposes set out in Section 5.5 of the Terms of Service.

1.3. The Processor immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other EU or Member State data protection law.

1.4. The Controller is responsible for the lawfulness of the processing, including having a legal basis, informing data subjects, and ensuring its instructions comply with applicable law. The Controller shall not submit special categories of personal data unless it has a lawful basis for doing so.

2. Security Measures (GDPR Art. 32)

2.1. Taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to data subjects, the Processor implements the technical and organisational measures described in Annex II. The Processor may update these measures provided that the overall level of protection is not reduced.

2.2. The Processor ensures that all persons authorised to process Client Personal Data are bound by confidentiality obligations.

3. Sub-Processor Protocol

3.1. The Controller grants general written authorisation for the Processor to engage sub-processors. The current list is available at https://basetime.pro/data-processing-agreement-dpa/#sub-processors (Annex III).

3.2. Notification of Sub-processor Changes: The Processor shall inform the Controller at least fourteen (14) calendar days prior to adding or replacing sub-processors by: (a) sending an email notice to the designated Account Owner; and (b) updating the official sub-processor register hosted at https://basetime.pro/data-processing-agreement-dpa/#sub-processors. The Controller may object to a new sub-processor on reasonable data protection grounds within fourteen (14) days of notice. If the parties cannot resolve the objection, the Controller may terminate the Contract with immediate effect, and the Processor shall provide a pro-rata refund of any prepaid, unearned subscription fees covering the remainder of the active billing period.

3.3. Urgent Security Replacements: In emergency circumstances where a sub-processor must be replaced or added immediately to prevent security breaches, the Processor may engage the replacement without prior notice, provided the Processor notifies the Controller within five (5) business days following the replacement, preserving the Controller’s right of objection.

3.4. In accordance with Article 28(4) GDPR, the Processor imposes on each sub-processor, by written contract, the same data protection obligations as set out in this DPA, and remains liable to the Controller for the performance of each sub-processor’s obligations.

4. Breach Notification Assistance

4.1. The Processor notifies the Controller without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a personal data breach affecting Client Personal Data. The notification includes, to the extent available, the information required by Article 33(3) GDPR; information not yet available is provided in phases without further undue delay.

4.2. A breach notification is not an acknowledgement of fault or liability.

4.3. Taking into account the nature of the processing and the information available to it, the Processor assists the Controller in responding to data subject requests and in meeting its obligations under Articles 32 to 36 GDPR. The Processor forwards to the Controller any data subject request it receives concerning Client Personal Data and does not respond to it, other than to refer the data subject to the Controller, unless instructed otherwise.

4.4. Assistance beyond the standard functionality of the Platform may be charged at the Processor’s reasonable rates, unless required because of the Processor’s breach of this DPA.

5. Audit And Data Return

5.1. The Processor makes available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR, including this DPA, Annex II and relevant certifications or audit reports of its hosting providers.

5.2. If this information is insufficient, the Controller, or an independent auditor bound by confidentiality, may carry out an audit, including an inspection, once per calendar year on thirty (30) days’ written notice, and additionally where required by a supervisory authority or following a personal data breach. Audits are carried out remotely where possible, and on-site only where a remote audit is insufficient, during normal business hours and without unreasonably disrupting the Processor’s operations. Each party bears its own costs.

5.3. At the end of the Service, the Processor, at the Controller’s choice, returns (by making exports available as set out in Section 15 of the Terms of Service) or deletes all Client Personal Data, and deletes existing copies unless EU or Member State law requires their storage. Backup copies are deleted in the ordinary backup cycle within 30 days and remain protected under this DPA until then. If the Controller does not execute an export or provide explicit written return instructions prior to the expiration of the 30-day Retrieval Period defined in the Terms of Service, this failure to act shall constitute the Controller’s definitive, documented instruction to delete all Personal Data pursuant to Article 28(3)(g) of the GDPR.

6. International transfers

6.1. The Processor does not transfer Client Personal Data outside the EEA, including by remote access, unless the transfer complies with Chapter V GDPR, for example under an adequacy decision or the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module 3) concluded with the relevant sub-processor.

7. Authorities, liability and term

7.1. If a public authority requests access to Client Personal Data, the Processor informs the Controller unless prohibited by law, discloses only what it is legally required to disclose, and challenges requests it reasonably considers unlawful.

7.2. Each party’s liability under or in connection with this DPA is subject to the limitations of liability in Section 10 of the Terms of Service. This does not limit either party’s liability towards data subjects under Article 82 GDPR.

7.3. This DPA remains in force for as long as the Processor processes Client Personal Data and is governed by the law applicable to the Contract.

Annex I: Details of processing

Subject matter	Provision of the BASETIME Platform under the Contract.
Duration	The term of the Contract, plus the retrieval and erasure periods in Section 15 of the Terms of Service.
Nature of processing	Hosting, storage, organisation, retrieval, backup, display, transmission, anonymisation and erasure
Purpose	Providing the Platform and its features to the Controller.
Categories of data subjects	The Controller’s Users (employees, contractors and officers); the Controller’s customers, suppliers and their contact persons; other individuals named in Client Data.
Types of personal data	Identification and contact data; job title; time entries; task and project data; expense data and receipts; invoice and payment data; uploaded files; login and usage logs.
Special categories	None intended; see Section 1.4.
Sub-processors	As listed in Annex III.

Annex II: Technical and organisational measures

1. Encryption: data is encrypted in transit (TLS 1.3).
2. Access control: role-based access for staff, multi-factor authentication for administrative access, and access reviews quarterly.
3. Tenant isolation: multi-tenant logical database isolation using dedicated PostgreSQL database schemas per customer.
4. Backups and recovery: daily backups within DigitalOcean EU infrastructure, kept for 30 days; restores tested periodically.
5. Logging and monitoring: security-relevant events are logged and kept for 12 months.
6. Vulnerability management: regular vulnerability assessments; critical security patches applied within 5 days of release.
7. Incident response: a documented procedure, including breach notification under Section 4.
8. Personnel: confidentiality undertakings for all authorised personnel and security awareness training annually.
9. Sub-processor management: due diligence before engagement and written data processing terms.
10. Deletion: a documented deletion procedure for Client Personal Data and backups.

Annex III: Sub-processors

To deliver the BASETIME platform, SIA “Duck typing” engages the following third-party service providers (sub-processors) to process Client Personal Data:

Sub-processor	Service Provided	Processing Location	Transfer Mechanism
DigitalOcean, LLC	Cloud hosting, databases, and backup infrastructure	Netherlands (EU)	Not applicable (EEA)
Mailgun Technologies, Inc. / Sinch	Transactional email delivery	Germany (EU)	Not applicable (EEA)