Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between the customer (“Controller”, “you”) and Network Place S.L., C/ Pablo Freire, 10, local 3, 28918 Leganés (Madrid), Spain, NIF B40203689 (“Processor”, “we”). It applies when we process personal data in Customer Data on your behalf under Regulation (EU) 2016/679 (“GDPR”), Spanish Organic Law 3/2018 and, where applicable, the UK GDPR, the Swiss FADP and US state privacy laws (section 13). You accept it when you accept the Terms; it is binding in electronic form (GDPR Art. 28(9)).

1. Subject matter, duration, nature and purpose

1.1 We process Customer Data to provide the Service described in the Terms: storing, organising, retrieving and reporting time and project records; generating and sending invoices and reminders; importing data from third-party services you select; exporting and deleting data on request.

1.2 Duration: for as long as you use the Service, plus the deletion period in clause 9.

1.3 The categories of data subjects and personal data are described in Annex I.

2. Roles

2.1 You are the controller of Customer Data (or a processor acting for your own client, in which case you warrant that you have its authorisation for this DPA, including the sub-processors in Annex III).

2.2 We are your processor for Customer Data.

2.3 Service Data. We are a separate controller for limited data about how the Service is used (account and sign-in records, billing data, usage events, support messages, security logs), which we process under our Privacy Policy only to provide, secure, bill and improve the Service. We never use the content of Customer Data for our own purposes.

2.4 Support and AI. When someone from your organisation writes to support, the AI provider in Annex III may receive the conversation, the page path, non-personal facts about the account (the writer’s role, trial state, which settings are on, the business’s country code, whether a tax ID is set, the Harvest import status) and the error messages that person hit in the app in the last 7 days. Beyond what the writer puts in the conversation, no Customer Data is sent: no time entries, projects, clients, contacts, invoices or amounts, and no names or emails. Writing “no AI” in the request keeps the AI out of it.

3. Instructions

3.1 We process personal data only on your documented instructions, including with regard to transfers to third countries, unless Union or Member State law requires otherwise; in that case we will tell you before processing, unless the law forbids it on important grounds of public interest. Your instructions are this DPA, the Terms, your configuration and use of the Service, and any further written instructions you give that are consistent with the Terms.

3.2 We will tell you immediately if, in our opinion, an instruction infringes the GDPR or other Union or Member State data protection law.

4. Confidentiality and security

4.1 We ensure that anyone authorised to process personal data is bound by confidentiality.

4.2 We implement the technical and organisational measures in Annex II, which may be updated to keep an equivalent or better level of security.

4.3 We assist you, taking into account the nature of the processing and the information available to us, with your obligations under GDPR Articles 32 to 36 (security, breach notification, impact assessments and prior consultation).

5. Data subject requests

5.1 The Service lets you access, correct, export and delete Customer Data yourself.

5.2 If we receive a request from a data subject about Customer Data, we will forward it to you without undue delay and not answer it ourselves unless you instruct us to.

5.3 We will help you answer requests that you cannot handle through the Service.

6. Sub-processors

6.1 You give us general authorisation to engage the sub-processors listed in Annex III.

6.2 We will notify you by email, and update Annex III, at least 30 days before engaging a new sub-processor or replacing one. You may object on reasonable data protection grounds within that period. If we can’t address your objection, you may terminate the affected Service before the change takes effect, and we will refund any prepaid fees for the period after termination.

6.3 We impose on each sub-processor, by contract, data protection obligations equivalent to those in this DPA, in particular sufficient guarantees of appropriate technical and organisational measures.

6.4 We remain fully liable to you for the performance of each sub-processor’s obligations.

7. Personal data breaches

7.1 We will notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Customer Data.

7.2 The notification will describe, as far as then known: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address it and mitigate its effects; and a contact point. We will provide further information in phases as it becomes available.

7.3 Our notification is not an acknowledgement of fault or liability.

8. Information and audits

8.1 We make available the information needed to demonstrate compliance with GDPR Article 28, including this DPA, Annex II and answers to reasonable security questionnaires.

8.2 If that information isn’t sufficient, or a supervisory authority requires it, you may audit us, or have an independent auditor bound by confidentiality do so, once a year, with 30 days’ notice, during business hours and without disrupting the Service or exposing other customers’ data. Each party bears its own costs, unless the audit reveals a material breach by us.

9. Return and deletion

9.1 You can export all Customer Data at any time, in CSV and JSON, from Settings.

9.2 When you close your account, or at the end of the Service (including the retrieval period in section 10 of the Terms), we permanently delete all Customer Data 30 days later, unless Union or Member State law requires us to keep it. This period is your chance to export it or cancel the closure. We do not keep backups of Customer Data. On request we will confirm the deletion in writing.

10. International transfers

10.1 Customer Data is stored in the European Union (Ireland and the Netherlands). Some sub-processors in Annex III are located in, or can access data from, third countries.

10.2 We transfer personal data outside the EEA only (a) to countries or organisations covered by an adequacy decision of the European Commission, including organisations certified under the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795); or (b) under the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914 (Module Three, processor to processor), with an assessment of the importer’s laws and supplementary measures where needed.

10.3 If you are located outside the EEA, Module Four (processor to controller) of the Standard Contractual Clauses applies to our processing for you and is incorporated by reference: clause 7 (docking) does not apply; the optional language in clause 11 does not apply; clause 17: Spanish law; clause 18: courts of Madrid, Spain.

10.4 For transfers subject to the UK GDPR, the UK International Data Transfer Addendum (version B1.0, issued by the Information Commissioner) applies together with the clauses above; for Swiss transfers, the clauses apply with the adaptations the FADP requires.

10.5 If an adequacy decision we rely on is invalidated, the Standard Contractual Clauses apply automatically.

11. Liability

Each party’s liability under this DPA is subject to the limitations in the Terms, except where the GDPR provides otherwise towards data subjects (Art. 82).

12. Precedence and law

In case of conflict, the Standard Contractual Clauses prevail, then this DPA, then the Terms. This DPA is governed by Spanish law, and the courts of Madrid have jurisdiction, except that for customers in the United States the dispute-resolution rules in section 17 of the Terms apply to claims between us.

13. US state privacy laws

13.1 Where the California Consumer Privacy Act (as amended) or another US state privacy law applies to Customer Data, we are your “service provider”, “contractor” or “processor” (as applicable) and you are the “business” or “controller”.

13.2 We will: (a) process personal information only for the limited and specified business purpose of providing the Service under the Terms; (b) not sell or share it, nor retain, use or disclose it for any purpose (including any commercial purpose) other than that business purpose, or outside our direct business relationship with you, except as the law permits service providers to do; (c) not combine it with personal information we receive from others or collect ourselves, except as permitted by law; (d) comply with applicable obligations and provide the same level of privacy protection the law requires of you; (e) notify you if we determine we can no longer meet our obligations; (f) allow you to take reasonable and appropriate steps to stop and remediate unauthorised use; and (g) help you respond to consumer requests.

13.3 We impose these obligations by written contract on our sub-processors.

13.4 We certify that we understand and will comply with these restrictions.

13.5 We will notify you without undue delay, and within 48 hours where possible, of a security breach affecting Customer Data, to allow you to meet your notification obligations under state law.

Annex I: Description of the processing

Data subjects: your staff, contractors and other people you invite or import; your clients and their contacts; recipients of invoices you send through the Service.

Personal data: names; email addresses; phone numbers and addresses of contacts; roles; time entries with dates, durations and notes; billable rates and costs; project assignments; invoice, estimate, payment and expense details; content you write in notes and descriptions; data imported from services you select (for example, Harvest).

Special categories: none intended. You agree not to put special categories of data (GDPR Art. 9) or criminal records data in the Service, except incidentally in free-text notes, under your responsibility.

Frequency: continuous.

Annex II: Technical and organisational measures

• Encryption: TLS for all traffic; encryption at rest by our database provider; import credentials encrypted with AES-256-GCM and deleted when the import finishes, and in any case within 25 hours.
• Separation: every record belongs to one organisation; database row-level security prevents signed-in users from reading other organisations’ data; background jobs use a separate restricted connection.
• Access control: passwordless sign-in with one-time links (PKCE); role-based access inside each organisation (admin, manager, member); production access limited to authorised personnel; credentials kept in the hosting provider’s secret store, not in code.
• Availability: managed infrastructure in the EU. We do not currently keep backups of Customer Data; you can export it at any time (clause 9.1).
• Data minimisation: we collect only what the Service needs; referrers are reduced to the domain; import tokens are never written to logs.
• Monitoring and incidents: error logging with limited retention; breach response with notification to customers within 48 hours where possible.
• Development: automated tests, including tests of database row-level security; dependencies kept up to date.
• People: confidentiality obligations; guidance on data protection and on the use of AI tools.
• Vendors: data processing agreements with every sub-processor; transfer assessments where Standard Contractual Clauses are used.

Annex III: Sub-processors

Contact: [email protected]