1. Parties

This data processing agreement ("the agreement") is entered into between the customer who created the company in ShiftFriend and accepted the agreement ("the controller") and Adtimera ApS, CVR 40551867, Industriparken 10, 4100 Ringsted, michael@adtimera.dk ("the processor").

The agreement follows the structure of the Danish Data Protection Agency's standard contractual clauses under Article 28(3) GDPR and forms part of the terms of service.

2. Subject matter, duration, nature and purpose

• Subject matter and purpose: providing ShiftFriend – shift planning, time clock, hours and payroll basis, absence, chat, documents and notifications – for the controller.
• Nature: storage, structuring, display, calculation, sending notifications and emails, export and deletion.
• Duration: as long as the controller uses ShiftFriend, and until data is deleted under section 11.

3. Categories of data subjects and personal data

• Data subjects: the controller's employees, managers and any contact persons.
• General data: name, email, phone, address, birth date, employee number, department and location, shifts, availability, clock-ins and hours, hourly pay and supplements, holiday and absence, chat messages, documents and read receipts, profile photos, push subscriptions and GPS position when clocking in by phone.
• Sensitive data: absence due to sickness (health data under Article 9). The controller should not enter other sensitive data in free-text fields, chat or documents.

4. The controller's instructions

The processor processes personal data only on documented instructions from the controller. The instructions are this agreement, the terms of service and the controller's settings and actions in ShiftFriend.

The processor immediately informs the controller if, in the processor's opinion, an instruction infringes data protection law.

5. Confidentiality

Only persons who need it get access to the personal data, and they are bound by confidentiality. Access is removed when the need ends.

6. Security of processing

The processor has implemented these measures under Article 32:

• All traffic is encrypted with TLS (https).
• Passwords are stored only as bcrypt hashes. Reset and verification links and API keys are stored only as hashes. Login sessions expire, and changing the password signs out other devices.
• Access is controlled by roles and scoping to departments and locations. Data a user may not see (e.g. other people's pay and absence) is removed on the server before it is sent.
• Rate limits and temporary lockouts on login, password reset, invitations and the API.
• Statistics are only used with consent, and all typed text and all fields are masked.
• Automatic deletion jobs: GPS coordinates after 12 months, logs after 24 months, anonymisation 5 years after the end date and deletion of companies after 30 days.
• Backups: [to be completed]. Encryption of stored data: [to be completed]. Penetration testing: [to be completed].

7. Use of sub-processors

The controller gives general authorisation to the sub-processors listed in Appendix A. The processor gives at least 30 days' notice of changes, and the controller may object. If the change is maintained, the controller may terminate the agreement before it takes effect.

The processor imposes the same data protection obligations on sub-processors and remains liable to the controller for their compliance.

8. Transfers to third countries

Transfers outside the EU/EEA only take place to the sub-processors listed in Appendix A, based on the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) or standard contractual clauses.

9. Assistance to the controller

The processor assists in fulfilling data subjects' rights through features in ShiftFriend: export of all company data, the employee's own data export, correction and deletion of employees and immediate anonymisation. The processor also reasonably assists with impact assessments and prior consultation of the supervisory authority.

10. Notification of personal data breaches

The processor notifies the controller without undue delay and no later than 48 hours after becoming aware of a breach, so the controller can notify the supervisory authority within 72 hours. The notice describes the breach, the data concerned and the measures taken, as far as possible.

11. Deletion and return

The controller can download all data as a ZIP with JSON and CSV at any time. When the company is deleted, all personal data is deleted after a 30-day grace period unless law requires retention. Invoices to the controller are kept for 5 years under the Bookkeeping Act.

12. Audit and documentation

The processor makes available the information necessary to demonstrate compliance with Article 28 and allows audits, including inspections, by the controller or an independent auditor. Audits are announced at least 30 days in advance, and the controller bears its own costs.

13. Commencement and termination

The agreement takes effect on acceptance in ShiftFriend and applies as long as the processor processes personal data for the controller. In case of conflict this agreement takes precedence over the terms of service on data protection matters.

Appendix A – Sub-processors

• Emergent (platform provider): hosting, database (MongoDB), file storage, AI gateway and email gateway. All data in ShiftFriend. Region: [to be completed: hosting region].
• Anthropic (Claude) via Emergent's gateway: only when the AI schedule is used. Employee names, availability, rules and shifts.
• Email provider: Resend, Inc. (USA) – transfer based on the EU standard contractual clauses/EU-US Data Privacy Framework. Recipient email and email content (e.g. schedules and reminders).
• PostHog: only with consent. Usage statistics for website and app with masked content.
• Google Fonts (Google): fonts. Visitors' IP address.
• OpenStreetMap Nominatim: address lookup from the manager's browser. Only the address text.
• Apple, Google and Mozilla (web push): delivery of notifications. The notification text.
• Stripe: only if card payments are enabled (currently disabled). Payment data about the customer.
• Twilio: only if SMS is enabled (currently disabled). Phone number and message text.