Last updated: October 22, 2026

Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between PunchdIn and the Customer. It is effective as of the date the Customer accepts the Terms of Service (the "Effective Date").

1. Parties and Scope

1.1 Parties

This DPA is entered into between:

The Customer — the entity that has subscribed to the PunchdIn Service and accepts these terms ("Controller" or "Customer"),
PunchdIn — the provider of the Service, with its registered office at Rauenthalerstr. 1, 14197 Berlin("Processor" or "PunchdIn").

1.2 Scope

This DPA applies to the processing of Personal Data by PunchdIn on behalf of the Customer in connection with the Service. It governs the Processing of Personal Data of the Customer's employees and contractors (the "Data Subjects") recorded through the Service, including time punches, break records, and location data captured at the moment of a punch.

1.3 Relationship to the Terms of Service

This DPA supplements the Terms of Service. In the event of any conflict between this DPA and the Terms of Service regarding the processing of Personal Data, this DPA prevails.

1.4 Regulatory Framework

This DPA is designed to satisfy the requirements of:

Regulation (EU) 2016/679 (the "GDPR"), Article 28,
the UK GDPR and Data Protection Act 2018,
the Swiss Federal Act on Data Protection (revFADP),
the Quebec Act respecting the protection of personal information in the private sector (Law 25).

2. Definitions

Capitalized terms used but not defined in this DPA have the meanings given in the GDPR. In addition:

Personal Data: Any information relating to an identified or identifiable natural person processed by PunchdIn on behalf of the Customer in connection with the Service, including employee names, contact details, time entries, and location coordinates captured at the moment of a punch.
Processing: Any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, and deletion.
Controller: The entity that determines the purposes and means of the Processing of Personal Data. For employee data submitted through the Service, the Controller is the Customer (the employer).
Processor: The entity that processes Personal Data on behalf of the Controller. For employee data submitted through the Service, the Processor is PunchdIn.
Sub-processor: Any third party engaged by PunchdIn to process Personal Data on behalf of the Customer. A current list is maintained in Annex III.
Data Subject: The individual to whom Personal Data relates, typically the Customer's employees or contractors.
Supervisory Authority: An independent public authority established under the GDPR, the UK GDPR, or other applicable data protection law.
Standard Contractual Clauses ("SCCs"): The standard contractual clauses for the transfer of personal data to third countries, adopted by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021.
Restricted Transfer: A transfer of Personal Data from the EU/EEA, UK, or Switzerland to a country that has not received an adequacy decision from the relevant authority.

3. Controller and Processor Roles

3.1 Customer as Controller

The Customer is the Controller of the Personal Data processed through the Service. The Customer determines:

which employees and contractors are granted access to the Service,
which sites are configured with geofencing,
how long time and location data is retained,
who within the Customer's organisation has access to the data,
the purposes for which the data is used (e.g., payroll, compliance, workforce management).

3.2 PunchdIn as Processor

PunchdIn acts as a Processor for the Personal Data described in Annex I. PunchdIn processes the Personal Data only on the Customer's documented instructions, as set out in this DPA, the Terms of Service, and the Customer's configuration of the Service.

3.3 PunchdIn as Controller for Account Data

For the account and billing information of the Customer (company name, billing address, payment method), PunchdIn acts as an independent Controller. That processing is governed by our Privacy Policy, not this DPA.

4. Processor Obligations

4.1 Processing on Instructions

PunchdIn processes Personal Data only on the Customer's documented instructions, including with regard to transfers of Personal Data to a third country, unless required to do so by Union or Member State law. In such a case, PunchdIn will inform the Customer of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

4.2 Confidentiality

PunchdIn ensures that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4.3 Security

PunchdIn implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as set out in Annex II. These measures include encryption in transit, hashed passwords, access controls, and audit logging.

4.4 Assistance

PunchdIn assists the Customer in ensuring compliance with the obligations under Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to PunchdIn. This includes assistance with:

data protection impact assessments,
prior consultations with supervisory authorities,
respond to data subject requests (see Section 11).

4.5 No Sale or Unauthorized Use

PunchdIn does not sell Personal Data, does not use Personal Data for its own purposes (including marketing or advertising), and does not share Personal Data with third parties except as permitted by this DPA or required by law.

4.6 Notification of Changes

PunchdIn will notify the Customer without undue delay if it becomes aware of any change in the applicable law or regulatory guidance that materially affects its ability to comply with this DPA.

5. Controller Obligations

5.1 Lawfulness of Processing

The Customer is responsible for ensuring that it has a lawful basis under applicable data protection law for the processing of Personal Data through the Service. This includes, where required:

obtaining the consent of employees to location tracking,
informing employees of the monitoring through a privacy notice,
consulting with employee representatives,
conducting a data protection impact assessment for the monitoring.

5.2 Employee Notice

The Customer is responsible for informing its employees, in a transparent manner, about:

the collection of time and location data,
the purposes for which the data is used,
the retention period,
their rights under applicable law.

5.3 Instructions

The Customer ensures that its instructions to PunchdIn comply with applicable data protection law. The Customer is responsible for the accuracy and lawfulness of the instructions it gives.

5.4 Configuration

The Customer is responsible for configuring the Service in a manner that meets its legal obligations, including the retention period for time and location data, the sites where geofencing is enabled, and which administrators have access to the data.

6. Sub-processors

6.1 Authorization

The Customer provides a general written authorization for PunchdIn to engage Sub-processors to provide the Service, subject to the conditions in this Section 6.

6.2 Current Sub-processors

A current list of Sub-processors is maintained in Annex III and at /legal/subprocessors.php.

6.3 Notification of Changes

PunchdIn will notify the Customer at least 30 days before adding or replacing a Sub-processor. The Customer may object to the change by notifying PunchdIn in writing within 30 days of the notification. If the Customer objects, the parties will discuss the change in good faith. If no agreement is reached within 30 days, the Customer may terminate the affected portion of the Service without penalty.

6.4 Flow-down Obligations

PunchdIn imposes on each Sub-processor, by written contract, data protection obligations that are substantially the same as those in this DPA. PunchdIn remains fully liable to the Customer for the performance of each Sub-processor's obligations.

6.5 Sub-processor Location

Each Sub-processor's processing location is listed in Annex III. Restricted Transfers to Sub-processors are governed by Section 7.

7. International Transfers

7.1 General Principle

PunchdIn does not transfer Personal Data outside the EU/EEA, UK, or Switzerland unless it has implemented an appropriate transfer mechanism under applicable law.

7.2 Transfer Mechanisms

For Restricted Transfers, PunchdIn relies on one or more of:

an adequacy decision of the European Commission, the UK Secretary of State, or the Swiss Federal Council,
the Standard Contractual Clauses (see Section 8),
other lawful transfer mechanisms permitted by applicable law.

7.3 Transfer Impact Assessment

For each Restricted Transfer that relies on the SCCs, PunchdIn has performed a transfer impact assessment (TIA) considering the laws and practices of the destination country, and has implemented supplementary measures where necessary.

8. Standard Contractual Clauses

8.1 Incorporation by Reference

The SCCs are incorporated into this DPA by reference and apply to any Restricted Transfer of Personal Data from the Customer to PunchdIn, as follows:

Module Two (Controller to Processor) applies where the Customer acts as Controller and PunchdIn acts as Processor.
Module Three (Processor to Processor) applies where the Customer acts as Processor and PunchdIn acts as Sub-processor.

8.2 SCC Clause Selections

For the purposes of the SCCs, the parties agree as follows:

SCC Clause	Selection
Clause 7 — Docking clause	Applies.
Clause 9 — Use of sub-processors	Option 2 (general written authorization) applies. PunchdIn will notify the Customer of changes in accordance with Section 6.3 of this DPA.
Clause 11 — Redress	The optional independent dispute resolution language does not apply. Data subjects may lodge complaints with the competent supervisory authority and before the courts of the EU Member State in which they have their habitual residence, place of work, or where the violation occurred.
Clause 17 — Governing law	Irish law.
Clause 18 — Choice of forum	The courts of Ireland, unless the data subject is a consumer in another EU Member State, in which case the courts of that Member State apply.
Annex I — Processing	As set out in Annex I to this DPA.
Annex II — Security	As set out in Annex II to this DPA.
Annex III — Sub-processors	As set out in Annex III to this DPA.

8.3 UK Addendum

For transfers subject to the UK GDPR, the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (the "UK Addendum") applies, completed as follows:

Table 1 (Parties): as identified in Section 1.1 of this DPA.
Table 2 (Selected SCCs): Module Two, with the clause selections in Section 8.2 above.
Table 3 (Appendix Information): as set out in Annexes I–III of this DPA.
Table 4 (Ending the Addendum): either party may end the Addendum as permitted under Section 19 of the Addendum.

8.4 Swiss Adaptations

For transfers subject to the revFADP, the SCCs apply with the following adaptations:

references to the GDPR are read as references to the revFADP,
references to EU Member States are read as references to Switzerland,
the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner (FDPIC),
Clause 17 (governing law) is read as Swiss law to the extent the transfer is subject to Swiss law, and Irish law otherwise.

9. Security Measures

9.1 Technical and Organisational Measures

PunchdIn implements the technical and organisational measures described in Annex II. These measures are designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

9.2 Updates to Measures

PunchdIn may update the measures from time to time, provided the updated measures do not materially decrease the overall level of protection. The current measures will always be reflected in Annex II and the DPA will be updated to reflect them.

9.3 No Certification Claim

PunchdIn does not currently hold ISO 27001, SOC 2 Type II, or similar certifications. If it obtains any such certification in the future, the certificate and its scope will be documented in Annex II. The absence of certification does not relieve PunchdIn of its obligations under this DPA.

10. Data Breach

10.1 Notification

PunchdIn will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Personal Data processed on behalf of the Customer.

10.2 Content of Notification

The notification will include, to the extent available:

a description of the nature of the breach, including the categories and approximate number of Data Subjects and records concerned,
the name and contact details of the point of contact,
a description of the likely consequences of the breach,
a description of the measures taken or proposed to address the breach and mitigate its effects.

10.3 Cooperation

PunchdIn will cooperate with the Customer and take reasonable steps to assist in the investigation, mitigation, and remediation of the breach, including providing the information the Customer reasonably requires to meet its own notification obligations under Articles 33 and 34 GDPR.

10.4 No Admission of Fault

Notification of a breach does not constitute an admission of fault or liability by PunchdIn. PunchdIn will not notify Data Subjects or supervisory authorities directly about a breach affecting the Customer's Personal Data unless required by law or instructed by the Customer.

11. Assistance to Controller

11.1 Data Subject Rights

PunchdIn assists the Customer in responding to data subject requests (access, rectification, erasure, restriction, portability, objection) by:

providing tools in the Service for the Customer to access and export employee data,
forwarding any request received directly from a Data Subject to the Customer without responding to it, unless legally required,
providing reasonable technical assistance where the self-service tools are insufficient.

11.2 Impact Assessments and Prior Consultation

PunchdIn provides reasonable assistance to the Customer in connection with data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of the processing and the information available to PunchdIn.

11.3 Costs

Assistance under this Section 11 is provided at no additional cost where it is within the normal operation of the Service. Where the assistance requires significant effort (for example, custom data extraction or analysis), the parties will agree on reasonable compensation in advance.

12. Audit Rights

12.1 Standard Reports

PunchdIn provides the Customer with reasonable evidence of compliance with this DPA, including:

a copy of the most recent security policy summary,
documentation of the technical and organisational measures in Annex II,
a summary of any security incidents in the previous 12 months affecting the Customer's data.

12.2 Audit

The Customer may audit PunchdIn's compliance with this DPA, no more than once per 12-month period, by:

reviewing the documentation provided under Section 12.1,
submitting a written questionnaire,
conducting an on-site or remote audit, subject to reasonable notice (at least 30 days), during business hours, and at the Customer's expense.

12.3 Auditor Confidentiality

Any auditor engaged by the Customer must sign a confidentiality agreement covering PunchdIn's systems and data. PunchdIn may refuse access to any auditor that is a competitor.

12.4 Regulatory Audits

Where a supervisory authority conducts an audit, inspection, or investigation that involves PunchdIn's processing of the Customer's Personal Data, PunchdIn will cooperate with the authority and inform the Customer, unless legally prohibited.

13. Data Return and Deletion

13.1 Return on Termination

Upon termination of the Service, and upon written request of the Customer, PunchdIn will return all Personal Data to the Customer in a structured, commonly used, machine-readable format (CSV export via the Service or API).

13.2 Deletion

After the Customer has had the opportunity to export the Personal Data (30 days from termination), PunchdIn will delete or anonymize the Personal Data in accordance with the Customer's instructions, unless applicable law requires a longer retention period.

13.3 Legal Retention

Where retention is required by law (for example, payroll record-keeping requirements), PunchdIn will retain the specific data required, will restrict access to that data to what is necessary, and will continue to protect it in accordance with this DPA.

13.4 Certification of Deletion

Upon request, PunchdIn will provide a written certification of deletion after the deletion is complete.

14. Liability

14.1 Allocation of Liability

Each party is liable to the other for breaches of this DPA in accordance with the liability provisions of the Terms of Service. Nothing in this DPA limits either party's liability to Data Subjects where such limitation would be prohibited by applicable law.

14.2 SCC Liability

Where the SCCs apply, the liability provisions of Clause 12 of the SCCs apply to the extent they are more protective of Data Subjects than the liability provisions of the Terms of Service.

14.3 Indemnification

Each party will indemnify the other for third-party claims, including regulatory fines, to the extent the claim arises from the indemnifying party's breach of this DPA, subject to the liability limits in the Terms of Service.

15. Term and Termination

15.1 Term

This DPA is effective as of the Effective Date and remains in force for as long as PunchdIn processes Personal Data on behalf of the Customer.

15.2 Termination

This DPA terminates automatically when the Terms of Service terminates and PunchdIn has returned or deleted all Personal Data in accordance with Section 13. Sections that by their nature survive termination (including confidentiality, liability, and audit rights for pre-termination periods) survive.

16. Miscellaneous

16.1 Order of Precedence

In the event of conflict between this DPA and the SCCs, the SCCs prevail. In the event of conflict between this DPA and the Terms of Service, this DPA prevails.

16.2 Amendments

PunchdIn may amend this DPA to comply with changes in applicable law or regulatory guidance. Material amendments will be communicated to the Customer at least 30 days before they take effect.

16.3 Notices

Notices under this DPA should be sent to the contact addresses in Section 1.1. Notices related to a Personal Data Breach should be sent to dpo@punchdin.com and marked "URGENT — DATA BREACH."

16.4 Entire Agreement

This DPA, together with the Terms of Service and the SCCs (where applicable), constitutes the entire agreement between the parties regarding the processing of Personal Data.

16.5 Counterparts

This DPA may be executed electronically. Acceptance of the Terms of Service constitutes acceptance of this DPA.

Annex I — Details of Processing

A. List of Parties

	Data exporter (Controller)	Data importer (Processor)
Name	The Customer, as identified in their account	PunchdIn
Address	As provided during signup	Rauenthalerstr. 1, 14197 Berlin, Germany
Contact	As provided during signup	dpo@punchdin.com EU representative: eu-rep@punchdin.com
Activities relevant to the transfer	Operation of a workforce management system that records employee work time and location.	Provision of cloud-based time-tracking software and associated services.
Role	Controller	Processor

B. Description of Processing

Category	Details
Categories of data subjects	The Customer's employees and contractors who use the Service to record work time.
Categories of personal data	Employee name, email address, phone number (if provided), job title, employee ID Time entries: clock-in and clock-out timestamps, break start and end timestamps Location: GPS coordinates captured at the moment of a punch when geofencing is enabled Device information: model, OS version, IP address at time of punch
Sensitive data	None. The Service is not designed to process special categories of data under Article 9 GDPR (health, biometric, religious beliefs, etc.). The Customer must not configure the Service to collect such data.
Frequency of transfer	Continuous during the subscription, as employees clock in, clock out, and take breaks.
Nature of processing	Collection, storage, retrieval, aggregation, reporting, transmission to the Controller, deletion.
Purpose of processing	Recording work hours for payroll, workforce management, compliance with labor law, and verification of work location.
Retention period	Determined by the Customer's configuration, or 7 years by default to comply with payroll record-keeping requirements. Deleted or anonymized 30 days after termination, unless a longer period is required by law.

C. Competent Supervisory Authority

Where the SCCs apply and the Customer is established in an EU Member State, the competent supervisory authority is the one identified in accordance with Clause 13 of the SCCs (typically, the authority of the Member State in which the Customer is established, or in which the EU representative is established if the Customer is not established in the EU).

Where the Customer is established in the UK, the competent authority is the Information Commissioner's Office (ICO).

Where the Customer is established in Switzerland, the competent authority is the Federal Data Protection and Information Commissioner (FDPIC).

Annex II — Technical and Organisational Security Measures

This Annex describes the technical and organisational measures implemented by PunchdIn to protect Personal Data. PunchdIn may update these measures from time to time, provided the overall level of protection is not reduced.

1. Access Control

Role-based access control with separate permissions for company administrators, superusers, and regular users.
Multi-tenant data isolation: each query is scoped to the requesting user's company ID.
Biometric authentication available on mobile (Face ID, Touch ID).
Session timeouts after periods of inactivity.
Password reset via time-limited invite tokens (not permanent passwords).

2. Encryption

TLS 1.2 or higher for all data in transit.
Passwords stored as one-way hashes using a modern algorithm (bcrypt or Argon2).
Biometric tokens stored in the device's secure enclave (iOS Keychain, Android Keystore). Only their SHA-256 hash is stored server-side.
Session cookies marked HttpOnly, Secure, SameSite=Lax.

3. Data Minimization

Location is captured only at the moment of a punch, not continuously.
GPS coordinates are truncated to a level of precision sufficient for geofencing, not for identifying a specific building.
IP addresses and device information are collected only for security auditing and geofence verification.

4. Availability and Resilience

Automated daily backups with 30-day retention.
Backups stored in a separate geographic region from production data.
Documented disaster recovery procedure with a 4-hour target restoration time.

5. Logging and Monitoring

Audit logs for administrative actions (user creation, role changes, plan changes, company suspension).
Platform audit logs for superuser actions.
Login history retained for 90 days.
Alerts for authentication anomalies (repeated failed logins, logins from new locations).

6. Incident Response

Documented incident response plan with defined roles.
Breach notification to affected Controllers within 48 hours of awareness (see Section 10 of this DPA).
Post-incident review and root-cause analysis.

7. Personnel

All employees with access to Personal Data are bound by confidentiality agreements.
Background checks where permitted by local law.
Annual data protection training.
Access is removed promptly upon termination of employment.

8. Physical Security

Data hosted in ISO 27001-certified data centers (see Annex III for hosting provider details).
Physical access is limited to authorized data center personnel.
PunchdIn employees do not have physical access to production servers.

9. Vendor Management

All Sub-processors undergo a security review before being engaged.
Sub-processors are bound by contractual data protection obligations equivalent to this DPA.
Sub-processors are reviewed annually.

10. Data Deletion

Deletion is performed by soft-delete followed by hard-delete after 30 days.
Backups containing the deleted data are rotated within 30 days.
Deletion is logged with the identity of the requester and the timestamp.

11. Certifications

PunchdIn does not currently hold SOC 2 or ISO 27001 certification. Any future certification will be documented here.

Annex III — Sub-processors

The following Sub-processors are engaged by PunchdIn to provide the Service. A current list is maintained at /legal/subprocessors.php and will be updated at least 30 days before any change takes effect.

Sub-processor	Service	Processing location	Transfer mechanism
Amazon Web Services EMEA SARL	Cloud hosting and storage	EU (Frankfurt, eu-central-1)	Intra-EEA; no restricted transfer
Postmark (ActiveCampaign, LLC)	Transactional email delivery	USA	SCCs (Module Two) + supplementary measures
Twilio Inc.	SMS delivery for invites	USA	SCCs (Module Two) + supplementary measures
Stripe Payments Europe, Ltd.	Payment processing	EU (Ireland)	Intra-EEA; no restricted transfer

Where a Sub-processor relies on the SCCs, the supplementary measures include: encryption in transit, data minimization before transfer (only the recipient's email or phone number is sent), and a government-access assessment in accordance with the Schrems II ruling.