Data Processing
These terms describe how we process the personal data that your firm puts into the Service, such as employee timesheets and client contacts. They form part of the Terms of Service.
1. Roles
Your firm is the controller of workspace data. We are the processor, and we process it only on your firm's documented instructions, which are given through your use and configuration of the Service.
2. Data and people covered
- People: your employees, contractors, client contacts and anyone else your firm adds
- Data: names, work emails, roles, skills, leave, timesheet entries, rates and costs, project and task records, change requests and invoice details
- Purpose: project planning, time tracking, resource planning, billing and reporting for your firm
3. What we commit to
- Process workspace data only to provide the Service
- Make sure staff with access are bound by confidentiality
- Encrypt data in transit and at rest, and apply role-based access controls
- Never sell workspace data or use it to train models for other customers
- Not collect screenshots, keystrokes or webcam data
- Help your firm respond to requests from people to access, correct or delete their data
- Tell your firm without undue delay, and within 72 hours of becoming aware, of a personal data breach affecting its workspace
4. Sub-processors
We use a small number of sub-processors for hosting, email delivery and payment processing. Each is bound by written terms that protect data at least as well as these. Workspace owners can ask for the current list, and we give notice before adding a new one.
5. International transfers
Where data is transferred outside the country it was collected in, we use safeguards recognised by applicable law. Programme plan customers can choose a hosting region.
6. Deletion and return
When your subscription ends, your firm can export all workspace data for 30 days. After that, we delete it from active systems. Backups are overwritten on their normal cycle.
7. Audits
On reasonable notice, we will provide information that shows we are meeting these terms, such as security documentation and answers to security questionnaires.
8. Questions
Send data protection questions through the Connect with sales page and choose "Security and SSO".