Data processing agreement

Part A. How this agreement works

1. Parties and acceptance

The customer (the business that owns a workspace) is the controller; we are the processor (Annex I). The workspace owner accepts this agreement for the customer by ticking the box at sign-up, which records the version and the time. The agreement is concluded in electronic form (Art. 28(9) GDPR) and runs as long as we process personal data for the customer.

2. The standard contractual clauses

Sections I to III (Clauses 1 to 10) of the standard contractual clauses in the Annex to Implementing Decision (EU) 2021/915 form part of this agreement, unchanged, with these choices:

• Clause 5 (docking clause) is not used: each customer concludes its own agreement.
• Clause 7.7(a): Option 2, general written authorisation. We inform the customer of any intended change to the list of sub-processors at least 14 days in advance, or longer where our sub-processors give us longer notice (section 4).
• The Annexes are filled in below (Annexes I to IV).

Official text: Implementing Decision (EU) 2021/915 on EUR-Lex, available in all EU languages.

If this Part A or our Terms conflict with the clauses, the clauses prevail.

3. Instructions

The customer's documented instructions are this agreement, the Terms, and what the customer and its team do in the app, for example sending an invoice by email, starting an import or downloading an export. When a workspace owner invites an adviser (for example the customer's tax adviser or bookkeeper), that invitation is the customer's instruction to show that adviser the workspace's issued invoices and credit notes, their files, the expenses with their receipts, the reports and the exports until an owner removes the access. The adviser is the customer's recipient, not our sub-processor. Giving out the workspace's invoice inbox address, or uploading files to the inbox, is the customer's instruction to receive, check, store and show those invoices and the emails they arrive with. We tell the customer if we believe an instruction infringes data protection law.

4. Sub-processors

The customer authorises the sub-processors in Annex IV. We tell workspace owners about an intended change by email at least 14 days before it takes effect and update Annex IV. We chose 14 days because that is the notice some of our own sub-processors give us (Resend, for example); where a sub-processor gives us longer notice, we pass the longer period on to the customer. The customer can object within that period. If we cannot resolve the objection, the customer may cancel the paid plan before the change takes effect and receives a pro rata refund of fees paid for the unused period. We bind every sub-processor to the same data protection obligations and remain responsible for its work.

Transfers outside the EEA. Where a sub-processor processes customer data outside the EEA (Cloudflare and Resend, both in the USA, Annex IV), we have concluded with it the Commission's standard contractual clauses for transfers to third countries (Implementing Decision (EU) 2021/914), Module 3 (processor to sub-processor); both providers' data processing agreements include it and apply automatically to their customers. Where the sub-processor is certified under the EU-US Data Privacy Framework, the transfer can also rely on the Commission's adequacy decision for it. These clauses apply alongside the clauses under Implementing Decision (EU) 2021/915, which form the body of this agreement under Art. 28 GDPR (section 2).

5. Information and audits

We answer the customer's questions about our processing and provide the information needed to show compliance, starting with written information and this agreement's Annex III. Where that is not enough, the customer or an auditor bound to confidentiality may carry out an audit with reasonable notice, during business hours and without disrupting the service. The customer bears the costs of an on-site audit, unless the audit shows that we materially breached this agreement.

6. Personal data breaches

We notify the customer without undue delay after becoming aware of a personal data breach affecting the customer's data, with the information required by Clause 9 of the clauses, and help the customer meet its duties under Arts. 33 and 34 GDPR.

7. End of processing: return and deletion

The customer can export all its data at any time, also from a closed workspace (see the Terms, section 8). When the customer closes its workspace or ends its account, the workspace owner chooses, for the customer, one of two options:

• Export, then delete everything: the customer downloads the full export, and we delete the workspace with all its personal data.
• Keep the read-only archive: we keep the workspace as a read-only archive on the customer's behalf until the end of the customer's legal retention period for invoices and booking records (until none of its invoices, quotes, expenses and received invoices is still within its retention period: 10 years after the end of the year of the latest one, but at least 30 days after the workspace was closed), so that the customer can meet its own retention duties, and then delete it. The customer can still view and export everything and can ask us at any time to delete the archive earlier.

We carry out deletion requests within 30 days, except where EU or member state law requires us to keep the data. Deleted data disappears from the backups within 30 days. At the end of the retention period, or earlier on request, we delete a kept archive in the same way.

8. Requests from authorities

We disclose the customer's data to an authority only where EU or member state law obliges us to, and we tell the customer about the request unless the law forbids it. The infrastructure and its jurisdiction are listed in Annex IV.

9. Liability

Liability under this agreement follows section 12 of the Terms, except where the GDPR provides otherwise.

Part B. Our obligations in brief

A plain summary of what the clauses require of us. The clauses themselves prevail.

• We process the data only on the customer's documented instructions, including for transfers outside the EEA.
• Everyone who has access to the data is bound to confidentiality.
• We protect the data with the measures in Annex III (Art. 32 GDPR).
• We use sub-processors only as described in section 4 and Annex IV.
• We help the customer answer requests from data subjects (Arts. 15 to 22 GDPR) and meet its duties under Arts. 32 to 36 GDPR.
• We notify personal data breaches without undue delay (section 6).
• At the end of the processing we return and delete the data as described in section 7.
• We make available the information needed to show compliance and allow audits (section 5).

Annex I. List of parties

Controller	The customer: the business named in the workspace's seller settings, represented by the workspace owner who accepted this agreement. Contact: the workspace owner's email address.
Processor	Aleksandr Ulanov, Gran Via de les Germanies 29, 46006 Valencia, Spain, NIF Z2402794N. Contact for data protection: hello@clockaroo.com.

Annex II. Description of the processing

Categories of data subjects

• The customer's team: workspace owners and team members, and people imported from another tool who have no login.
• The customer's clients and their contact persons.
• Recipients of invoice emails sent through the service.
• People named in the customer's own seller data (for example the managing directors).
• Advisers the customer gives access to (for example tax advisers or bookkeepers).
• Suppliers of the customer and their contact persons, as named in invoices and emails the customer receives through the invoice inbox.

Categories of personal data

• Team: names, email addresses, roles, time entries (date, duration, start and end times from the timer, project, task, notes, billable flag), hourly rates.
• Clients: names, addresses, contact names, email and electronic addresses, VAT IDs, buyer references and Leitweg-IDs, invoice language and format, notes.
• Invoices: invoice content, issued PDF and XML files, the frozen snapshot of each invoice, payment status, records of sent invoices (recipient address and time).
• Seller data: legal name, address, VAT ID and tax number, bank details (IBAN, BIC), register details, managing directors, email and phone.
• Expenses and receipts: date, amount, supplier, notes, the person who spent it, and the receipt images or files, which can contain names of suppliers, guests or employees and, in photos, the place they were taken.
• The workspace's audit log: who changed what and when, including what advisers downloaded and exported.
• Advisers: name, email address, when access was granted and ended and by whom, last access.
• Data imported from Harvest: people, clients and contacts, projects, rates, time entries, expenses, invoices and payments.
• Received invoices: supplier name, address, VAT and tax numbers, bank details, contact names and email addresses, and the other content of each invoice file as received; email headers and message text of the emails they arrived with.
• Calendar events: title, start and end of the events from a calendar link a team member adds (kept for 45 days), and the link itself, stored encrypted.

Sensitive data

The service is not meant for special categories of personal data (Art. 9 GDPR) or data on criminal convictions. The customer should not enter such data, for example in notes.

Nature of the processing

Storage, organisation and display; calculation of hours, amounts and VAT; creation, validation and storage of invoices and e-invoice files (validation runs on our own server, without third parties); sending invoice emails on the customer's instruction; receiving invoices and emails sent to the customer's invoice inbox and checking them on our own server; fetching calendar links that team members add; imports from other tools on the customer's instruction; exports; backups.

Purpose

To provide the service to the customer under the Terms.

Duration

For the life of the customer's use of the service and afterwards until deletion as described in section 7.

Processing by sub-processors

As listed in Annex IV, for the same purpose and duration.

Annex III. Technical and organisational measures

We list the measures in place. The backups described below are set up before we take new accounts.

Encryption and secrets

• All connections to the service use HTTPS; plain HTTP is redirected and browsers are told to use HTTPS only.
• Passwords are stored only as bcrypt hashes. Import access tokens and the admins' second-factor secrets are encrypted in the database. Admin session tokens and the tokens of saved creator forms are stored only as SHA-256 hashes.
• Backups are encrypted before they leave the main server.
• The server's disk is not encrypted at rest. Access to the server is limited as described under access control, and backups are encrypted.

Integrity of invoices and records

• Issued invoices and their lines are frozen by database triggers; only status, paid date and cancellation date can change.
• The PDF and XML files of an issued invoice are stored once, with a SHA-256 checksum, and never regenerated.
• The audit log of each workspace is insert-only.
• Separate database roles: the app runs as a role that may not update, delete or truncate the audit log; schema changes run as a separate owner role.

Access control

• Each workspace's data is accessible only to its members and to advisers an owner invites. Roles: owners manage settings, plans and exports; members see only their own hours in reports, without amounts or rates.
• Advisers see issued invoices and credit notes, their files, the expenses by month with their receipts (originals as downloads, without who spent them), the reports by client and project and the exports, read-only; the only thing they can change is the DATEV settings, and owners are told by email when they do. They cannot see drafts, time entries, the team, settings or billing. They must use two-factor authentication and enter their password again after 12 hours. Access is checked on every request; when an owner removes it, the adviser's sessions end at once.
• Closed workspaces are read-only.
• Limits on repeated sign-in and sign-up attempts.
• Our admin area uses separate admin accounts with a password and a second factor (TOTP). Five wrong attempts lock the account for 30 minutes. Every admin sign-in, failure, lockout and second-factor change goes to an insert-only log. The admin cookie is HTTP-only, secure and limited to our own site.
• Server access only by SSH with keys, limited to the operator; password logins are switched off.

Data minimisation and deletion

• Passwords, tokens, email addresses, bank details, tax IDs and invoice party data are filtered out of application logs.
• Export files are deleted 7 days after they are created.
• Creator forms saved for a free account are deleted on import or discard, and at the latest after 24 hours.
• Import access tokens are deleted when the import ends.
• Files uploaded to the free checker are not stored.

Availability and recovery

• Backups are encrypted and always stored off-site, away from the main server, in Cloudflare R2 storage restricted to the EU. They are kept for 30 days.
• The database is backed up daily and the stored files nightly. A restore is tested when backups are set up and after changes to the setup.
• Our hosting provider netcup GmbH is certified under ISO/IEC 27001:2022. Its data centre in Nuremberg has physical access control, video surveillance around the clock, and an uninterruptible power supply with a diesel generator.

Incidents

• Errors are written to the server log, and the operator receives email alerts about billing problems, such as a payment notice that matches no workspace or a refused change of the number of people.
• The operator assesses every suspected personal data breach, records its facts, effects and the remedy (Art. 33(5) GDPR), and notifies affected customers as described in section 6.

Annex IV. Sub-processors and where the data is stored

Sub-processor	What it does with customer data	Location	Transfer safeguard
netcup GmbH, Karlsruhe, Germany	Server, database and stored files: all workspace data	Nuremberg, Germany	None needed (EU)
Cloudflare, Inc., USA	DNS, content delivery, TLS and protection against attacks; sees requests in transit; receives inbound email for the invoice inbox and passes it to our server (Email Routing, Workers)	USA, global network	EU standard contractual clauses 2021/914, Module 3 (section 4); EU-US Data Privacy Framework
Resend, Inc., USA	Delivery of emails, including the customer's invoice emails with attachments	Sends from Ireland, stores data in the USA	EU standard contractual clauses 2021/914, Module 3 (section 4); EU-US Data Privacy Framework
Cloudflare, Inc. (R2 storage)	Encrypted backups of all workspace data, always stored off-site, away from the main server; a temporary buffer for invoice inbox emails while our server cannot be reached, for at most 7 days	EU (storage restricted to the EU)	Stored in the EU; EU standard contractual clauses 2021/914, Module 3, and the EU-US Data Privacy Framework for Cloudflare, Inc.

We use no error tracking service at present. If we add one, we will announce it as described in section 4.

Support emails. Our support addresses forward to a mailbox that is not a sub-processor under this agreement. Please do not send workspace data by email; use the export or the app instead.

Not sub-processors: the customer's advisers. Advisers an owner invites see the customer's data on the customer's instruction (section 3), as the customer's own recipients. They are not our sub-processors, and inviting one does not change this list.

Not a sub-processor: Paddle. Paddle (Paddle.com Market Ltd, United Kingdom; Paddle.com Inc., USA, for US buyers) sells the paid plans as merchant of record. It processes the buyer's billing data as an independent controller under its own terms and privacy notice, not on the customer's behalf, and has no access to workspace data.