Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Tiemio Terms of Use (the “Terms”) between:

• the employer that uses Tiemio to keep its employees’ working-time records (the “Employer”, the controller); and
• IncubIQ Solutions Ltd, a company registered in England and Wales (Cardiff), company number 08788612, which operates Tiemio (“Tiemio”, “we”, the processor).

The Employer accepts this DPA when its account owner creates its business in the Tiemio app or website. Tiemio records who accepted it, for which business, when, and which version. For a business created before this DPA was published, it becomes part of the Terms as a change to them: Tiemio tells the account owner by email at least 30 days before, and using Tiemio after that date is acceptance (section 13).

1. Definitions

Terms such as personal data, processing, controller, processor, data subject, personal data breach and supervisory authority have the meaning they have in Regulation (EU) 2016/679 (the “GDPR”). “Data protection law” means the GDPR, Spain’s Organic Law 3/2018 (LOPDGDD), and, where they apply, the UK GDPR and the UK Data Protection Act 2018. “Working-time records” means the daily record of each employee’s start and finish of work and its corrections, which the Employer must keep under article 34.9 of the Spanish Workers’ Statute (Estatuto de los Trabajadores, “ET”).

2. Roles and scope

2.1 For the personal data of the people who work for the Employer, as described in Annex I, the Employer is the controller and Tiemio is its processor (GDPR art. 28; LOPDGDD art. 33).

2.2 This DPA does not cover the data Tiemio processes as a controller for its own purposes: the accounts people use to sign in, the Employer’s billing and payment data, website statistics and the security log. Tiemio’s Privacy Policy covers those.

2.3 This DPA lasts as long as the Employer uses Tiemio, and afterwards for as long as Tiemio keeps working-time records under section 10.

3. Instructions

3.1 Tiemio processes the personal data in Annex I only on the Employer’s documented instructions. The Terms, this DPA and the Employer’s use of the Tiemio settings and features (inviting people, approving corrections, downloading timesheets, ending an employment) are those instructions.

3.2 The Employer instructs Tiemio to keep working-time records unchanged (a correction is added as a new entry, never by changing or deleting the original) and to keep them for at least four years from the date each one was made (art. 34.9 ET), also after an employment ends and after the Employer stops using Tiemio (section 10).

3.3 If Tiemio considers that an instruction breaks data protection law, it will tell the Employer and need not follow it until the Employer confirms or changes it. If the law requires Tiemio to process the data otherwise, Tiemio will tell the Employer first, unless the law forbids it.

4. Employer’s responsibilities

The Employer is responsible for: having a legal basis to record its employees’ working time (it is a legal obligation under art. 34.9 ET); informing its employees, and where applicable their legal representatives, that it uses Tiemio and how (GDPR arts. 13–14; LOPDGDD arts. 87–91 and ET art. 64 where relevant); the accuracy of what it enters; and answering its employees’ requests about their records (section 7).

If the Employer creates a read-only API key, it chooses the tool or AI agent that uses it. The data read with a key is then under the Employer’s control and responsibility, and that tool is not a sub-processor of Tiemio.

5. Confidentiality

Tiemio gives access to the personal data only to people who need it to run, support or secure the service, and who are bound by confidentiality. Today that is the IncubIQ Solutions Ltd staff named as administrators; Tiemio has no other staff with access. The AI tools they use to develop Tiemio work on the code and on test data, never on the Employer’s data.

6. Security

6.1 Tiemio applies the technical and organisational measures in Annex II, appropriate to the risk (GDPR art. 32). It may improve them; it will not lower their overall level.

6.2 Personal data breach. Tiemio will notify the Employer without undue delay, and within 48 hours of becoming aware of a breach affecting the Employer’s data, with what is known then (nature, categories and approximate number of people and records, likely consequences, measures taken or proposed, a contact point), and will add information as it learns more. Tiemio does not notify the supervisory authority or the data subjects on the Employer’s behalf unless the Employer asks it to.

7. Helping the Employer

7.1 Data subjects’ requests. If an employee asks Tiemio about records the Employer controls, Tiemio passes the request to the Employer and does not answer it on the Employer’s behalf, except to tell the employee it has done so. The Employer can answer most requests itself in Tiemio: each employee’s records are visible to the Employer, and monthly timesheets can be downloaded as PDF or spreadsheet. Each employee can also download their own records and timesheets in the app.

7.2 Rectification. Because working-time records are evidence, they are corrected by adding a correction (with who asked, who approved, when and why), never by changing the original. The corrected times are what the timesheets show.

7.3 Tiemio gives the Employer reasonable help, taking into account the nature of the processing and the information available to it, with security (art. 32), breach notification (arts. 33–34), data protection impact assessments and prior consultation (arts. 35–36).

8. Sub-processors

8.1 The Employer gives Tiemio a general authorisation to use sub-processors. The current list is Annex III.

8.2 Tiemio will tell the Employer of any intended addition or replacement at least 30 days in advance, by email to the Employer’s account owner and on this page. The Employer may object on reasonable data protection grounds within that period; if the parties cannot resolve it, the Employer may stop using Tiemio and close its account.

8.3 Tiemio imposes on each sub-processor data protection obligations that give at least the same protection as this DPA, and remains responsible to the Employer for its sub-processors.

9. Where the data is processed, and transfers

9.1 Tiemio’s database is stored and processed only in the European Union (Cloudflare D1 with the EU jurisdiction). Its daily backups are kept in two places for redundancy: Spain and the United Kingdom (see 9.2 on the United Kingdom). Emails are sent from the EU (Amazon SES, Ireland; Brevo, France).

9.2 IncubIQ Solutions Ltd is established in the United Kingdom, which the European Commission recognises as giving adequate protection (adequacy decision under GDPR art. 45).

9.3 Some sub-processors are established in, or may process data in, the United States (Annex III). Those transfers rely on the EU–US Data Privacy Framework where the sub-processor is certified, and otherwise on the European Commission’s standard contractual clauses (GDPR art. 46).

10. End of the service, return and deletion

10.1 Before leaving, the Employer can download every month’s timesheet for every employee (PDF and spreadsheet). Each one is signed and can be checked by anyone at tiemio.com/verify with its document number.

10.2 After the Employer stops using Tiemio or closes its account, Tiemio keeps the working-time records, corrections and timesheet issues read-only for at least four years from the date each was made, as instructed in section 3.2, so the Employer can still produce them to its employees, their representatives and the Labour Inspectorate. During that time the Employer may ask Tiemio for a copy of them at any time.

10.3 After that period, Tiemio keeps the records until the Employer asks for them to be returned or deleted. Four years is the minimum the law sets; the Employer decides how much longer it needs them (for example while a claim or an inspection is open). On the Employer’s written request, Tiemio sends it a copy and then deletes the records within 30 days; copies in backups and in the provider’s recovery history are gone within 30 days, as those expire (Annex II).

10.4 Other personal data in Annex I that is not part of the working-time records (for example a person’s profile photo, or the name in an invitation that was never accepted) is deleted when the account it belongs to is deleted, or anonymised where it is linked to records that must be kept.

11. Audits and information

Tiemio makes available to the Employer the information needed to show that it meets art. 28 GDPR: this DPA, Annexes II and III, and answers to reasonable written questions within 30 days, sent to hello [at] tiemio.com. Where that is not enough, the Employer (or an independent auditor bound by confidentiality) may audit, once a year, with 30 days’ notice, at its own cost, without access to other customers’ data.

12. Liability and law

12.1 Each party’s liability under this DPA is subject to the limits in the Terms, except where data protection law does not allow them.

12.2 This DPA is governed by the same law as the Terms (England and Wales). This does not affect the Employer’s or the data subjects’ rights under the GDPR and Spanish law, or the powers of the Spanish Data Protection Agency (AEPD).

12.3 If this DPA and the Terms conflict about personal data, this DPA prevails.

13. Changes

Tiemio may update this DPA to follow the law or the service. It will tell the Employer at least 30 days before a change that reduces the Employer’s protection takes effect; continued use after that date is acceptance, and the Employer may instead close its account. Each version is dated and numbered, and Tiemio records which version each Employer accepted.

Annex I — Description of the processing

• Subject matter: keeping the Employer’s daily working-time records (art. 34.9 ET) and the related team management in Tiemio.
• Duration: while the Employer uses Tiemio, then the retention in section 10.
• Nature and purpose: recording each start, pause, resume and finish of work; showing hours by day, week and month; corrections asked for and approved by the Employer and the employee; monthly timesheets for the Employer, the employee and the Labour Inspectorate; inviting people and managing who works for the Employer; reminders and notifications about these; applying the working conditions the Employer sets (schedules, allowed hours) to remind people and flag time recorded outside them.
• Data subjects: the Employer’s employees and other people it invites to record their working time in Tiemio.
• Categories of personal data:
  • Identification and contact: name, the email address or mobile number used for the invitation or sign-in, DNI/NIE if the person adds it, profile photo if the person adds one.
  • Employment link: the Employer, when the link started and ended, who ended it.
  • Working conditions the Employer sets: for example the working hours or schedule agreed for each person, and rules on when work may be done (such as no work in the hottest hours of summer), used to show, remind about or flag time recorded outside them.
  • Working-time records: each start, pause, resume and finish with the time it counts at, the device time, the time our server received it, whether it was recorded offline, and the platform (web, iPhone/iPad, Android); the hash that links it to the previous one. No location is collected.
  • Corrections: the period, the proposed times, the reason, who asked, who answered and when.
  • Timesheet issues: who downloaded which month’s timesheet and when, the document’s fingerprint and signature.
  • Technical: sessions and device notification tokens for the app.
  • API keys: the read-only keys the Employer creates: their name, when each was created, last used and revoked; the key itself is kept only as a hash.
• Special categories: none. Tiemio does not ask for health, union or other special category data. The Employer must not put such data in free-text fields (names, correction reasons).
• Frequency: continuous.

Annex II — Technical and organisational security measures

• Encryption: all connections use TLS (HTTPS); the database is encrypted at rest by its hosting provider.
• Access control: every request is authenticated and every API route checks, on the server, that the person may see or change the data it asks for (an Employer sees only its own people; an employee only their own records). Sign-in is by a one-time code sent by email (or text message where enabled); there are no passwords to steal. Codes and session tokens are stored only as hashes. Sessions expire.
• API keys: read-only (they cannot record, change, approve or download anything), without the employees’ DNI/NIE, email or phone, shown once and stored only as hashes, limited per key, revocable at once by the Employer.
• Abuse protection: per-IP rate limits on sign-in and other sensitive routes, a bot check on the website’s sign-in, waitlist and contact forms, caps on text messages.
• Integrity of records: working-time records and corrections are append-only: the database itself refuses to change or delete them. Each record is linked to the previous one by a cryptographic hash, so a change or removal would show. Monthly timesheets are signed with a server key (Ed25519) and can be checked by anyone with the document number.
• Recording time: a tap’s time is the time Tiemio’s server received it; the device’s time is kept beside it but never replaces it, except for taps made offline, which are marked as such and refused if implausible.
• Logging: a security log of sign-ins, account changes and administrative actions, kept for two years.
• Backups and recovery: a full backup of the database every day, stored on IncubIQ Solutions Ltd’s own servers in two places (Spain and the United Kingdom), with access limited to IncubIQ Solutions Ltd administrators; the last 14 are kept. In addition, the database provider’s point-in-time recovery covers the last 30 days.
• Separation: test and demonstration environments use their own database, never production data.
• Data minimisation: no location, no biometric data, no advertising or tracking cookies; profile photos are never used to identify anyone.
• People: access to production limited to named IncubIQ Solutions Ltd administrators; AI development tools never see production personal data (maintenance they run reports only counts and fingerprints); secrets kept in the hosting provider’s secret store, never in the app.
• Development: automated tests run on every change, including tests of access control and record integrity; changes to the records, signatures or access control are reviewed before release.

Annex III — Sub-processors

• Cloudflare, Inc. — hosting of the website, the app back end and the database; bot check. Database stored and processed only in the EU (EU jurisdiction); requests may pass through Cloudflare’s network outside the EU; company in the USA (Data Privacy Framework / SCCs). Handles all the data in Annex I.
• Amazon Web Services EMEA SARL (Amazon SES) — sending emails: invitations, sign-in codes, reminders. EU (Ireland). Email address, name, the email’s content.
• Sendinblue SAS (Brevo) — sending emails when Amazon SES is unavailable. EU (France). Email address, name, the email’s content.
• Google LLC (Firebase Cloud Messaging) — delivering app notifications, when the person turns them on. USA (Data Privacy Framework / SCCs). A device token and the notification’s text.
• Twilio Ireland Limited — texting sign-in codes, only for people who sign in with a mobile number. EU (Ireland), Twilio group in the USA (SCCs). Mobile number, the code.

Stripe and Apple take payments for the Employer’s subscription. They process the Employer’s billing data, not the employees’ data, so they are not sub-processors under this DPA.