1. Parties and scope
This Data Processing Agreement (“DPA”) is between the organization that uses flexiday (the “Controller”), acting through its owner, and Daniel Hrynusiw OSVČ, Bořetická 4133/6, 628 00 Brno-Židenice, Czech Republic, IČO 23347406 (the “Processor”, “we”). It forms part of the Terms of Service and applies to every organization on every plan, from the moment the organization is created. The owner accepts it on the organization’s behalf by accepting the Terms.
It covers organization data: the personal data the Controller keeps in the Service about the people who work in it. It does not cover account data, such as a person’s sign-in, settings, notifications, calendar connections, push registrations and birthday. We are the controller of account data, and our Privacy Policy governs it. Where the Controller turns on the people directory, the People directory agreement adds to this DPA for the directory’s profile data.
2. Subject matter, duration, nature and purpose
- Subject matter and purpose. Providing the Service to the Controller: recording and approving leave, keeping quotas, recording attendance, keeping the change log, showing all of it to the people the Controller’s settings and roles allow, sending the notifications that go with it, and producing exports.
- Nature. Collection, storage, organisation, retrieval, display, transmission, export and erasure, by automated means.
- Duration. For as long as the organization exists in the Service, and until its data is deleted as section 12 describes.
3. People and data concerned
People: the Controller’s employees, contractors and anyone else it adds to the organization, including its owner, admins, group managers and approvers, and, where the people directory is on, the emergency contacts its people give.
Data: the organization’s copy of each person’s name and email; employments, groups, roles and invitations; leave requests with their dates, type, status and notes; quotas; the change log; request attachments; attendance times and, where the Controller turns it on, the location recorded at clock-in and clock-out; and, where the people directory is on, its profile fields.
Sick leave bookings and request attachments such as a doctor’s note can reveal health data, a special category under Article 9 GDPR. The Controller decides whether to use these features and is responsible for having a legal basis for them.
4. Instructions
We process organization data only on the Controller’s documented instructions, including for transfers outside the EEA, unless EU or Czech law requires otherwise; in that case we tell the Controller first, unless that law forbids it. The Terms, this DPA, and the Controller’s use and settings of the Service are its instructions. Ending an employment, erasing a person’s records, changing a retention setting and deleting the organization are instructions given through the Service. If we think an instruction breaks the GDPR or other data-protection law, we tell the Controller at once.
We do not use organization data for any purpose of our own, do not sell it, and do not use it for advertising or to train AI or machine-learning models.
5. Confidentiality
Everyone we authorise to process organization data is bound to confidentiality by contract or by law, and has access only as far as the task needs.
6. Security
We take the technical and organisational measures Article 32 GDPR requires, appropriate to the risk: hosting in the EU on Amazon Web Services (AWS), eu-central-1 region (Frankfurt, Germany), encryption in transit and at rest, role-based access inside the Service, and backups that age out. Our Security page describes them. We may improve these measures over time, but never lower the protection they give.
7. Sub-processors
The Controller gives us general authorisation to use sub-processors. We use these:
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Application hosting, database and file storage | EU (Frankfurt, Germany) |
| Amazon SES (AWS) | Sending notification emails | EU (Frankfurt, Germany) |
| Functional Software, Inc. (Sentry) | Error monitoring and performance diagnostics | EU region (Frankfurt, Germany); the company is based in the United States |
| Apple Inc. (Apple Push Notification service) | Delivering push notifications to the iPhone app; sees names and leave and attendance dates in the notification text | United States |
We tell the Controller about any intended addition or replacement by updating this list and its last-updated date at least 30 days before the change, and by email to the owner. The Controller may object on reasonable data-protection grounds within that time. If we cannot resolve the objection, the Controller may delete the organization before the change takes effect. Each sub-processor is bound by a contract with the same data-protection obligations as this DPA, and we remain responsible to the Controller for its work.
8. Transfers outside the EEA
Organization data is stored in the European Union. Where a sub-processor processes it outside the European Economic Area, we rely on an adequacy decision or the European Commission’s Standard Contractual Clauses under Chapter V GDPR.
9. Help with requests from people
The Service gives the Controller the tools to answer the requests people make under Chapter III GDPR: a person can download their own records from each organization, and the owner and admins can export a person’s records, end an employment, and erase the records of a person who has deleted their account or never had one. If a person sends us a request about organization data, we forward it to the owner without undue delay and do not answer it ourselves, other than to tell the person we have forwarded it. Where the tools are not enough, we help the Controller as far as we reasonably can.
10. Personal data breaches
We tell the owner without undue delay after becoming aware of a personal data breach affecting organization data. We give what we know of its nature, the people and records concerned, its likely consequences and the measures taken, and follow up as more becomes known, so the Controller can meet its own duties under Articles 33 and 34 GDPR.
11. Help with impact assessments
We give the Controller the information it reasonably needs about the Service for a data protection impact assessment, or a prior consultation with a supervisory authority, under Articles 35 and 36 GDPR.
12. End of the service and deletion
A person deleting their own account is not an instruction from the organization. Their employments stay open and their organization data stays with the organization until the Controller ends the employment or erases the records.
The Controller ends the service by deleting the organization, which happens when its owner deletes their own account once nobody else with an account still works there. Before that, the owner can download an organization export of its data. When the organization is deleted, we delete its data from our live systems at once, and our backups age out within seven days, unless EU or Czech law requires us to keep it.
13. Audits
We make available to the Controller the information needed to show that we meet Article 28 GDPR. We allow for and contribute to audits, including inspections, by the Controller or an auditor it mandates who is bound to confidentiality, on reasonable written notice and without undue disruption to the Service. Each party bears its own costs.
14. Liability, precedence and law
Liability under this DPA follows the Terms of Service, without limiting any liability that Article 82 GDPR does not allow to be limited. Where this DPA and the Terms differ on the processing of organization data, this DPA prevails. It is governed by the laws of the Czech Republic.
15. Contact
Daniel Hrynusiw OSVČ
Bořetická 4133/6, 628 00 Brno-Židenice, Czech Republic
daniel@hrynusiw.cz