Data Processing Agreement

1.1This Data Processing Agreement (“DPA”) is entered into by and between the business entity holding a Navbat7 account (the “Customer”, acting as data controller) and ООО "PT TECHNOLOGIES", a company registered in the Republic of Uzbekistan (the “Processor”, “we”), and forms an integral, legally binding part of the Navbat7 Terms of Service at https://navbat7.techatpt.com/en/legal/offer. In the event of any conflict between this DPA and the Terms of Service regarding data protection matters, the provisions of this DPA shall control.

1.2It applies to the extent the Customer is established in, or the personal data relates to people in, the European Economic Area, the United Kingdom or Switzerland, and to any other Customer that asks for it.

1.3It binds from the moment the Customer accepts the Terms — no separate signature is needed. A Customer that needs a countersigned copy can ask at the address in the Terms and will receive one.

2.1Subject matter: the operation of Navbat7 — shift scheduling, time and attendance, requests, notifications and related reporting — for the Customer’s business.

2.2Duration: for as long as the Customer has an account, plus the retention periods in the Privacy Policy.

2.3Nature and purpose: storing, displaying, transmitting and deriving figures (hours, pay, lateness) from the data the Customer and its staff enter, solely to provide the Service.

• Data subjects: the Customer’s employees and contractors; the Customer’s managers and account owner.
• Categories of data: name; email address, phone number and Telegram identifier where given; job position; pay rate; shift times; clock-in and clock-out times and, where the person allows it, the location at clock-in; where the Customer switches it on for a venue, a photograph taken by the time-clock terminal at each clock-in and clock-out, kept 30 days; leave and availability; messages in the team chat and shift notes; the Customer’s own notes about a person.
• Special categories: none are required by the Service. The Customer must not enter health data beyond “on leave”, or any other special-category data, into free-text fields.

3.1We process personal data only on the Customer’s documented instructions, which are: the Terms, this DPA, and the Customer’s use of the Service’s features. We will tell the Customer if we believe an instruction breaks data protection law.

3.2Everyone with access to the data on our side is bound by confidentiality.

3.3We apply the technical and organisational measures in the Annex, and keep them at least as protective throughout the term.

3.4Data subject rights: taking into account the nature of the processing, we assist the Customer by technical and organisational measures in fulfilling its obligations to respond to data subjects exercising their rights under applicable privacy laws — within the Service where possible (staff can export their own data from their profile; the Customer can edit or delete a person’s records) and otherwise within 10 working days of a request. Where a data subject contacts us directly, we promptly forward the request to the Customer without answering it ourselves, unless authorised by the Customer or required by law.

3.5We help the Customer with security, breach notification and data protection impact assessments, to the extent the information is in our hands.

3.6At the end of the Service we delete all personal data 90 days after the Customer closes its account, as the Privacy Policy sets out; during those 90 days the Customer can export everything.

3.7Audits and inspections: we make available to the Customer all information necessary to demonstrate compliance with Article 28 of the GDPR. On at least 30 (thirty) days’ written notice, the Customer or an independent certified auditor appointed by the Customer may audit our processing operations during normal business hours, at most once a year unless a supervisory authority requires otherwise, provided the audit does not unreasonably interfere with our operations or compromise the confidentiality of other customers. An independent SOC 2 or ISO 27001 audit report, or an equivalent technical security assessment, satisfies this requirement where it covers the point.

4.1The Customer authorises the sub-processors listed at https://navbat7.techatpt.com/en/legal/subprocessors, each bound by written terms no less protective than this DPA. We stay responsible to the Customer for their work.

4.2Before adding or replacing a sub-processor we email the Customer’s account owner at least 30 days in advance. A Customer that objects on reasonable data-protection grounds may end the Service before the change takes effect and will be refunded the unused part of any prepaid period.

5.1The Customer’s data is stored and processed in the European Union (Warsaw). Our staff in Uzbekistan access it to operate and support the Service, and some sub-processors are in the United States.

5.2EU Standard Contractual Clauses: to the extent personal data originating in the EEA is transferred to a country outside the EEA not recognised as providing an adequate level of protection, the parties hereby execute and incorporate by reference the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor). For the purposes of the Clauses:

• the Customer is the data exporter and we are the data importer;
• Clause 7 (the docking clause) applies;
• Clause 9(a), Option 2 (general written authorisation) applies, with a notice period of 30 days for sub-processor changes;
• the optional language in Clause 11 (redress) is omitted;
• Clauses 17 and 18: the governing law and forum are the laws and courts of Ireland;
• Annexes I, II and III are completed by section 2 of this DPA, the Annex below, and our sub-processor list.

5.3For transfers from the United Kingdom, the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner’s Office applies, with the same tables completed in the same way, the parties as above, and the Addendum’s option that either party may end it under section 19.

5.4For transfers from Switzerland, the clauses apply with the adaptations the Federal Data Protection and Information Commissioner requires.

5.5We will tell the Customer if we receive a legally binding request from a public authority for its data, unless the law forbids it, and will challenge a request we believe unlawful.

6.1If we become aware of a breach of security affecting the Customer’s personal data, we tell the Customer’s account owner without undue delay and in any case within 72 hours, with what we know: what happened, whose data and which categories, the likely consequences, and what we have done and recommend. We keep the Customer informed as we learn more.

7.1Each party’s liability under this DPA is subject to the limitation of liability in the Terms, except where data protection law does not permit it to be limited.

7.2This DPA lasts as long as the Terms, and its obligations that by their nature continue — confidentiality, deletion, assistance with a claim — survive its end.

8.1What the Service does to protect data, as of the date above. The list describes the product as built; the code enforcing each point is documented in the product’s source.

• Tenant isolation is enforced in the database itself by row-level security on every table; no query path bypasses it. Managers see their organisation; staff see their own records and the schedule they are on.
• All traffic is encrypted in transit (TLS). Data at rest is encrypted by the database provider (AES-256) in its EU region.
• Authentication: passwords hashed with bcrypt; two-step verification with an authenticator app (TOTP) available to every account with a password, enforced on password sign-in once set up; one-time sign-in links that expire within an hour and work once; terminal PINs hashed with bcrypt; sessions revocable. Card data never reaches the Service — payment is taken by the merchant of record.
• Incoming payment notifications are verified by HMAC signature with replay protection.
• Secrets are held only in the hosting provider’s encrypted configuration, never in source code; an automated check on every release enforces this.
• Least privilege: the database’s privileged role is used only by server-side code; browsers hold a scoped key that row-level security governs.
• Retention is enforced automatically: sent notifications 90 days, team chat 180 days, clock-in coordinates 30 days, the activity log 2 years; a closed account is deleted in full after 90 days.
• An append-only audit log records management actions — who changed what, when.
• Self-service export: the Customer exports its data as Excel/CSV; each member of staff exports their own from their profile.
• Access on our side is limited to the people who operate and support the Service, from named accounts; production access from developer machines is read-only diagnostics.
• Every release passes an automated test suite of roughly a thousand tests, including tests that the database refuses access across tenants.