Data Processing Agreement

This data processing agreement (the "Agreement") governs, under Article 28(3) of the General Data Protection Regulation (EU) 2016/679 (the "GDPR"), the processing of personal data in the Attendees attendance system.

1. Parties#

Controller: the customer who set up or ordered the Attendees attendance system. The customer is identified by the address of its system (for example firma.attendees.eu) and by the details from the installation form, the order or the system settings.

Processor: Ing. Matěj Kmínek, a natural person doing business under the Trade Licensing Act, with registered office at Nová Lhota 34, 286 01 Kluky, Company ID 02877961, VAT ID CZ8708210016, e-mail [email protected] (the "Operator").

2. Subject matter and duration#

2.1 The Operator runs the Attendees attendance system for the controller as a service (the "System") and, in doing so, processes the personal data that the controller, its users and its employees enter into the System.

2.2 The Agreement lasts for the term of the licence under the Terms of Service and for as long afterwards as the Operator keeps the data under clause 4.9.

3. Nature, purpose and scope of processing#

3.1 Nature of processing: storing, displaying and editing data, calculating attendance and overtime, producing reports and exports, sending e-mails from the System, backup, restoring and erasure.

3.2 Purpose of processing: recording the attendance and working time of the controller's employees, payroll input, recording journeys in company and private vehicles (vehicle logbook) and internal communication between the controller and its employees (infomail). The controller decides on the purpose and scope of processing.

3.3 Categories of personal data:

• identification data: first name, surname, title, personal number or employee code, job position, username,
• contact data: e-mail, telephone, mobile telephone,
• data on employment and working time: start and end date, working-time fraction, working hours, place of work, superior and subordinates,
• attendance data: time of arrival and departure, type of absence (for example holiday, sickness, doctor, business trip, home office), breaks, overtime, approvals, notes, bonuses,
• identifiers of RFID chips and cards and data on their assignment,
• journey data: vehicle and registration number, date and time of the journey, place of departure and destination, odometer reading, purpose of the journey, refuelling and travel allowance,
• content of bulk e-mails (infomail) and data on their sending,
• records of activity in the System: who changed what and when, IP address and a flag indicating mobile access, time and IP address of the last login,
• login data: password stored exclusively as a hash using the argon2id algorithm.

3.4 Categories of data subjects: employees and other workers of the controller, users of the System (administrators, superiors) and persons who use the terminal at the entrance.

3.5 The System is not intended for processing special categories of personal data under Article 9 GDPR beyond the type of absence. The controller does not enter diagnoses or any other health data into the System.

4. Obligations of the processor#

4.1 Instructions. The Operator processes personal data only on documented instructions from the controller. Instructions are given by this Agreement, by the functions of the System and the settings the controller makes in the System, and by the controller's written (including e-mail) requests. If, in the Operator's opinion, an instruction infringes the GDPR or another regulation, the Operator informs the controller without delay. The Operator processes data without an instruction only where required to do so by Union or Czech law; in such a case it informs the controller in advance, unless that law prohibits it.

4.2 Confidentiality. The Operator keeps the personal data and the security measures confidential. The Operator has no employees; should any other person gain access to the data in future, the Operator will bind that person to confidentiality.

4.3 Security. The Operator has adopted the technical and organisational measures under Article 32 GDPR described in Annex 2 and in the document Technical and Organisational Measures. The Operator may change the measures only if the level of protection is not reduced.

4.4 Sub-processors. The controller gives general authorisation to engage sub-processors. The list of current sub-processors is in Annex 1 and in the document Sub-processors. The Operator informs the controller by e-mail at least 14 days in advance of any intended addition or replacement of a sub-processor. The controller may raise a reasoned objection within 14 days of the notice; if the parties do not reach agreement, the controller may terminate the Agreement and the licence with effect from the date of the change, and the Operator refunds the pro rata part of the subscription for the unused period. The Operator imposes on sub-processors the same data protection obligations as it has itself and is liable for their performance.

4.5 Assistance with data subjects' rights. The System allows the controller to view, rectify, export and erase data. If the controller cannot handle a data subject's request itself, the Operator provides reasonable assistance. A request that a data subject sends directly to the Operator is forwarded by the Operator to the controller without undue delay; the Operator does not handle it itself.

4.6 Assistance with other obligations. The Operator assists the controller in complying with its obligations under Articles 32 to 36 GDPR, in particular by providing information for a data protection impact assessment and for consultation with the supervisory authority.

4.7 Personal data breach. The Operator notifies the controller of a personal data breach without undue delay after becoming aware of it, following the Personal Data Breach Procedure, and provides the information the controller needs to notify the supervisory authority and to inform the data subjects.

4.8 Place of processing. The System's data is stored on a server in the Czech Republic. A transfer to a third country is possible only to the extent stated in Annex 1 and under the conditions of Chapter V GDPR.

4.9 Deletion or return of data. After the licence ends, the Operator, at the controller's choice, returns the data (a database export in SQL format and reports in PDF format) or deletes it, no later than 30 days after the licence ends. If the controller makes no choice by then, the Operator deletes the data after 30 days. Copies in backups expire gradually as the backups are overwritten, no later than 30 days after they were made. This is without prejudice to any obligation to retain data under a specific regulation.

4.10 Audit. On request, the Operator makes available to the controller all information necessary to demonstrate compliance with the obligations under Article 28 GDPR. The controller, or an auditor mandated by it and bound by confidentiality, may carry out an on-site audit once a year with at least 30 days' prior notice in such a way that neither the operation nor the security of other customers' data is disrupted. Each party bears its own costs of the audit. An extraordinary audit is possible after a personal data breach or at the request of the supervisory authority.

5. Obligations of the controller#

5.1 The controller is responsible for having a valid legal basis for processing personal data in the System, for having informed its employees about the processing and for entering into the System only data it needs for its purposes.

5.2 The controller protects the access credentials to the System, assigns user permissions as needed, revokes access for departing employees and notifies the Operator without delay of any suspected misuse of access.

5.3 The controller gives instructions in compliance with the law and notifies the Operator of changes to its contact e-mail address.

6. Liability#

Each party is liable for damage it causes by breaching its obligations under this Agreement or the GDPR, to the extent set out in Article 82 GDPR. The limitation of liability for damages between the parties is governed by the Terms of Service, where the law permits; the limitation does not apply to claims of data subjects or to fines imposed by the supervisory authority on the party that caused them.

7. Duration and termination#

7.1 The Agreement comes into effect upon acceptance under clause 9 and lasts for the duration of the licence. This Agreement ends when the licence ends, except for the obligations under clauses 4.2 and 4.9, which continue until the data has been fully deleted.

7.2 Changes to the Agreement follow the procedure for changing the Terms of Service.

8. Governing law#

The Agreement is governed by the law of the Czech Republic, in particular the GDPR, Act No. 110/2019 Coll., on Personal Data Processing, and Act No. 89/2012 Coll., the Civil Code. Disputes are decided by the general courts of the Czech Republic having jurisdiction according to the Operator's registered office.

9. Acceptance of the Agreement#

The controller accepts the Agreement by ticking the box agreeing to the Terms of Service and the Data Processing Agreement in the installation form, or by ordering or paying for a licence. The person giving that consent declares that they are authorised to act on behalf of the controller. The Agreement is concluded electronically and its wording is permanently available on this page.

Annex 1: Sub-processors#

The document Sub-processors as amended from time to time.

Annex 2: Technical and organisational measures#

The document Technical and Organisational Measures as amended from time to time.