1. Scope and roles
This Data Processing Agreement ("DPA") forms part of the Terms of Service. The Customer is the controller of personal data in Customer Data. Katari Technologies Ltd is the processor and processes it only to provide the Service under the Terms.
| Item | Detail |
|---|---|
| Subject matter | Hosting and processing of Customer Data in the Service |
| Duration | The term of the subscription and the retention periods in the Data Retention Policy |
| Nature and purpose | Storage, organisation, retrieval, calculation, transmission and deletion to provide workforce scheduling, attendance, payroll, fleet, supplier, client relationship, reporting, backup and support functions |
| Data subjects | The Customer’s staff, applicants, contractors, clients and their contacts, supplier contacts, and other people the Customer records |
| Categories of data | Identification and contact details, employment and scheduling records, attendance and time records, pay and statutory deduction records, bank details, credentials and certifications, performance records, vehicle and incident records, client and supplier correspondence, audit records. Special categories only where the Customer chooses to record them. |
2. Instructions
We process Customer Data only on the Customer’s documented instructions, which are these Terms, this DPA and the Customer’s configuration and use of the Service, unless the law requires otherwise, in which case we will tell the Customer first where lawful. We will tell the Customer if we believe an instruction breaks the law.
3. Confidentiality and personnel
Everyone we authorise to process Customer Data is bound by confidentiality. Access is limited to people who need it. Support access to a customer’s organisation requires that customer’s approval, is limited in time, and is logged in the customer’s audit trail.
4. Security
We maintain the technical and organisational measures in the Security Policy, and review them at least once a year. We will not materially reduce them during the subscription.
5. Subprocessors
The Customer authorises the subprocessors on the Subprocessors page. We will give at least 30 days’ notice of a new subprocessor by updating that page and e-mailing the billing contact. The Customer may object on reasonable data protection grounds; if we cannot address the objection, the Customer may cancel the affected Service and receive a refund of prepaid fees for the unused period. We remain responsible for our subprocessors.
6. Assistance with data subject requests
The Service lets the Customer access, correct, export and erase personal data, including erasure of client contacts and leads on request. Where the Customer needs more help to respond to a request, we will assist within a reasonable time. We will pass on to the Customer any request we receive directly about Customer Data.
7. Personal data breaches
We will notify the Customer without undue delay, and in any case within 72 hours after becoming aware of a personal data breach affecting Customer Data, with the information we have at the time and updates as we learn more. We will take reasonable steps to contain it and prevent a recurrence.
8. Deletion and return
The Customer can export Customer Data at any time during the subscription and for 90 days after it ends. We then delete Customer Data from the live systems within 30 days, and it leaves our backups as they expire (within 35 days), unless the law requires us to keep it.
9. Audits
On request, and not more than once a year unless there has been a breach, we will answer a reasonable security questionnaire and provide our current security summary. A Customer may carry out an audit at its own cost, with 30 days’ notice, during business hours, subject to confidentiality and without access to other customers’ data.
10. International transfers
Customer Data may be processed in the locations on the Subprocessors page. Where a transfer requires safeguards under applicable law, we will put appropriate contractual safeguards in place.
11. Liability and order of precedence
The limits of liability in the Terms apply to this DPA. If this DPA conflicts with the Terms about personal data, this DPA wins.