Data Processing Agreement

1. Parties and scope

This agreement forms part of the Terms of Service between the Customer and LUNA PARK IT DEVELOPMENT D.O.O. BEOGRAD-NOVI BEOGRAD, Novi Beograd, Bulevar Zorana Đinđića 74/2, Serbia, PIB / TIN 113841152 (the Provider).

It applies when the Provider processes personal data on the Customer's behalf to provide Timepunch. The Customer acts as controller and the Provider acts as processor for that processing. Separate processing purposes determined by the Provider are described in the Privacy Policy.

2. Customer instructions

The Customer determines the employment purposes and rules for which it uses the service. The Provider processes the data only on the Customer's documented instructions, including the service agreement, the Customer's configuration and actions by people it authorises, unless processing is required by applicable law. Where legally permitted, the Provider informs the Customer of such a legal requirement before processing.

The Provider informs the Customer if, in its opinion, an instruction infringes applicable data protection law. The Customer is responsible for giving individuals the required information and for issuing lawful instructions.

3. Processing description

The service manages the Customer's working arrangements and time off. Processing includes receiving and storing employee information, applying configured rules, recording requests and decisions, calculating balances, displaying calendars and reports, delivering notifications, assisting authorised support requests, and returning or deleting data.

The people concerned are the Customer's employees, managers and other people authorised to use its workspace. Data includes names, work contact details, team membership, permissions, employment start dates, work schedules, applicable rules, absence types and dates, request and review comments, calendar records and balances.

Sick-leave records or comments may reveal health information. The Customer must establish the required legal grounds, limit the information entered and avoid unnecessary medical details. Access must be limited to people whose duties require it.

Processing continues for the period needed to provide the agreed service and to carry out return and deletion under section 8.

4. Confidentiality and security

The Provider ensures that people authorised to process Customer personal data are bound by confidentiality obligations and have access only as needed for their duties. The Provider maintains technical and organisational measures appropriate to the risks of the processing, including protection against unauthorised access, unlawful alteration, loss and disclosure.

These measures must cover account and administrative access, company separation, encrypted web connections, backup and recovery, protection of sensitive content in logs and email, incident response and secure deletion. The Provider must not materially reduce the agreed protection while processing the Customer's data. Information needed to assess the measures is available to the Customer on request.

5. Service providers

The Customer gives general written authorisation for the Provider to use subprocessors for the following service functions:

• Railway — hosting the application, databases and associated service data; the primary application and database region is Amsterdam, the Netherlands;
• Cloudflare — delivery and protection of service traffic;
• Resend — delivery of account and service notifications, including addresses and email content;
• Sentry — diagnostics and error monitoring when enabled.

The Provider supplies the relevant contracting entities and processing-location information to the Customer on request. Before adding or replacing a subprocessor, the Provider informs the Customer and gives it a meaningful opportunity to object on data protection grounds. The Provider imposes corresponding data protection obligations on subprocessors and remains responsible to the Customer for their performance.

Polar's Merchant of Record activities and Google's font delivery are described separately in the Privacy Policy; their use does not mean that every activity they perform is processing solely on the Customer's instructions.

6. Assistance and incidents

Taking account of the nature of processing and the information available, the Provider assists the Customer with requests from individuals, security obligations, assessment of data protection risks and any required consultation with a competent authority. Where a request concerning Customer-controlled records reaches the Provider directly, the Provider informs the Customer and assists it in responding.

The Provider notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data. The notification includes the information then available about the affected processing, likely consequences, contact point and response measures. Further information may follow as it becomes available.

The Provider assists with containment and the Customer's applicable notification duties; the Customer remains responsible for notifications it is legally required to make. The contact for requests and incident reports is [email protected].

7. International processing

The Provider is established in Serbia. Hosting in the Netherlands does not by itself mean that all authorised access or onward processing occurs there. International processing must follow the Customer's documented instructions and applicable data protection requirements.

Where a transfer requires additional safeguards, the relevant parties must establish them and complete any necessary schedules and assessments before relying on that transfer arrangement. This agreement does not itself execute Standard Contractual Clauses or override mandatory provisions of an applicable transfer instrument. The Provider makes information about relevant transfer arrangements available to the Customer on request.

8. Return and deletion

At the Customer's choice, the Provider returns or deletes Customer personal data when processing services end, subject to applicable legal requirements. The standard service-end process allows 30 days for export, with deletion of workspace data and backup copies completed no later than 60 days after service ends. This is one 60-day maximum period, not 30 days followed by another 60 days.

The standard schedule does not postpone a valid earlier instruction or a shorter legal deadline. While awaiting deletion, copies remain protected and are not used for a new purpose. The Provider confirms completion of deletion to the Customer on request.

Any retention required by applicable law is limited to the relevant data and purpose, rather than used to preserve the entire workspace.

9. Demonstrating compliance

The Provider makes available the information necessary to demonstrate compliance with this agreement and permits and contributes to audits, including inspections, by the Customer or its authorised auditor as required by applicable law.

The parties coordinate practical arrangements while protecting other Customers' information and avoiding unnecessary disruption. Those arrangements must not prevent a legally required check.

Where this agreement and the general Terms conflict on the protection of Customer personal data, this agreement governs that processing, subject to mandatory law and any applicable transfer instrument.