Data Processing Agreement

The customer is the business that uses TimeRecap for its team, and is the controller of the personal data. We are the processor: eMindBrowser BV, Schoolstraat 24 8530 Harelbeke, Belgium, enterprise number 1006742907.

For the data we need to run our own business, such as the contact and billing details of the person who orders, we are the controller ourselves. The Privacy Policy covers that data.

Subject: we host the TimeRecap app and cloud service for the customer. Nature: we receive time entries from the customer's devices and app, store and display them, and send them to the integrations the customer turns on. Purpose: to let the customer and its team track their time per activity, client and project. Duration: as long as the customer uses TimeRecap.

Personal data: names, email addresses and login IDs of team members; device IDs and settings; time entries with start and end times, activity, client, project and notes; and access tokens for the integrations the customer connects.

Data subjects: the customer's employees and other team members who use TimeRecap. Client names and notes may also refer to the customer's own clients.

TimeRecap isn't designed for special categories of personal data, such as health data. The customer shouldn't enter them in notes or names.

We process the personal data only on the customer's documented instructions. This agreement, the Software Terms of Service and the settings the customer chooses in the app are those instructions. The customer can give further instructions in writing.

If we think an instruction breaks data protection law, we tell the customer right away. If EU or Belgian law requires us to process the data in another way, we tell the customer first, unless that law forbids it.

Everyone who can access the personal data, at our company or at our sub-processors, is bound to confidentiality by contract or by law. Only the people who need access to run and support the service get it.

We protect the personal data with technical and organisational measures that fit the risk, including: • encryption in transit (TLS) and at rest • a database in a private network that can't be reached from the internet • access only for authorised people, with two-factor authentication for admin access • devices that must be registered before the cloud accepts their data, with flash encryption and secure boot on the device • monitoring and logging of our servers

We review these measures regularly and update them when needed.

We use these sub-processors: • Amazon Web Services EMEA SARL (Luxembourg): hosting, database and backups, in the AWS Paris region (France) • Auth0, part of Okta Inc.: login and authentication, in Auth0's EU region

The customer gives general authorisation for these sub-processors. Each one is bound by the same data protection obligations as in this agreement, and we remain responsible for them.

We announce new or replaced sub-processors by email at least 30 days in advance. The customer can object on reasonable grounds within that period. If we can't resolve the objection, the customer can stop using the service, and we refund any prepaid fees for the remaining period.

Integrations the customer turns on, such as Clockify, Toggl or Zapier, are not our sub-processors. The customer chooses them, and we send data to them on the customer's instruction.

We store the personal data in the European Union. AWS and Auth0 belong to US companies, which may access data in limited cases, for example for support or security. Those transfers are covered by the EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses.

Integrations the customer turns on may store data outside the EU. Their own terms apply.

In TimeRecap, the customer can view, correct, export and delete its team members' data. If the customer needs more help to answer a data subject request, we assist.

We also help the customer with data protection impact assessments, prior consultations and questions from data protection authorities, as far as they concern our processing. If a team member or an authority contacts us directly, we pass the request on to the customer instead of answering it ourselves, unless the law requires otherwise.

If we become aware of a personal data breach that affects the customer's data, we notify the customer without undue delay, and at the latest within 48 hours.

We share what we know: what happened, which data and how many people are affected, the likely consequences, and the measures we have taken or propose. We add information as we learn more, and help the customer notify the authority and the people affected where needed.

When the customer deletes its account, all personal data we process for the customer is deleted immediately, so the customer should export its data first. Copies in our backups are deleted automatically within 7 days, unless the law requires us to keep them.

On request, we confirm the deletion in writing.