Data Processing Addendum

Roles

You are the controller of the personal data in your company’s records, and we are your processor. Annex 1 describes the processing. For accounts, billing and the website we are a controller in our own right, as our Privacy notice explains, and this addendum does not cover that data.

You are responsible for having a lawful basis for the personal data you put in Workstamp and for telling the people in your records about it, including your client’s representatives who sign.

Your instructions

We process the personal data only on your instructions. The Terms, this addendum and the way you and your members use Workstamp are your instructions. We will tell you if we think an instruction breaks data protection law, and we may refuse it. If the law makes us process the data in another way, we will tell you first unless that law forbids it.

Our people

Everyone at askrubberduck Ltd who can reach the personal data is bound to keep it confidential. Our staff view a company’s account only to give support, read-only and logged, and the company is told.

Security

We keep the measures in Annex 2 in place and may improve them, but not weaken them.

Sub-processors

You allow us to use the sub-processors listed on our Sub-processors page, which is Annex 3. We bind each to data protection terms that protect the personal data at least as well as this addendum, and we stay responsible to you for their work.

We email account holders at least 30 days before we add or replace a sub-processor, and update the Sub-processors page with the date the change takes effect. If you object on reasonable data protection grounds, write to privacy@workstamp.app before that date; if we cannot resolve it, you may close your account before the change takes effect.

Where the data goes

Your company’s records and their backups stay in the region it chose: Australia, New Zealand or the United Kingdom. Files (photos, signature images, attachments and PDFs) are stored with Cloudflare. We ask it to keep them in Oceania for Australia and New Zealand, and in western Europe for the United Kingdom. Cloudflare treats that as best effort and does not guarantee the location, and New Zealand’s files may be kept in Australia. Email, text messages, billing, error reports, service metrics and push notifications are handled by sub-processors who may process data outside your region, as the Sub-processors page shows.

When you send a sheet or summary to a client company that also uses Workstamp, a copy is stored in the client’s region, which may differ from yours. The client is a party to that document, and you are disclosing it to them.

When personal data leaves the United Kingdom, we rely on UK adequacy regulations or the International Data Transfer Agreement or Addendum. Where the EU GDPR applies, we rely on an adequacy decision or the European Commission’s Standard Contractual Clauses. For Australia and New Zealand, we make sure the recipient protects the data in a way comparable to the Australian Privacy Principles and the New Zealand Information Privacy Principles.

Helping you

We help you, as far as Workstamp allows and the request is reasonable, to:

• answer people who ask to see, correct or erase their personal data. Your admins can do most of this in Workstamp. If someone asks us directly, we pass the request to you;
• carry out data protection impact assessments and consult a regulator;
• meet your own security and breach notification duties.

Erasing someone’s details removes their name, contact details, signature image and photos of them. The record that a signature happened, and its fingerprint, stays, so the remaining evidence can still be checked.

Breaches

If we become aware of a breach of security that affects the personal data, we tell your admins without undue delay, and within 48 hours. We tell you what happened, what data and people it affects as far as we know, and what we are doing about it, and we keep you updated. Telling you is not an admission of fault.

Ending the service

When the service ends, you choose whether we return or delete all the personal data we process for you:

• Return: for 90 days after your account closes, your admins can download everything your company keeps in Workstamp, and on request we give you any other personal data we hold for you in a common machine-readable format.
• Deletion: at the end of those 90 days, or sooner if you ask, we delete all of it, including the copies held by us and our sub-processors. It leaves our backups within a further 30 days.

We keep personal data longer only where the law requires it, for as long as it requires, and still under this addendum. Copies already delivered to other companies stay with them, as the Terms say. We confirm the deletion in writing if you ask.

Checks

We make available the information you reasonably need to show that we meet this addendum. If that is not enough, or a regulator requires it, you may audit us, or have an independent auditor do so, once a year on 30 days’ written notice, during business hours and at your cost. The auditor must keep what they learn confidential.

Liability

Each party’s liability under this addendum is subject to the limits in the Terms.

Contact

privacy@workstamp.app

Annex 1: Processing details

• Subject matter and purpose: running Workstamp for you: recording work on sheets, collecting and checking signatures, approvals and summaries, delivering them to the people you send them to, and support.
• Duration: while your company has an account, then until deletion as described under Ending the service.
• People: your members, your client’s representatives, the people named on sheets or shown in photos, and anyone else whose details you add.
• Data: names, email addresses and phone numbers, roles, signatures and the time, IP address and device of each signature, photos, attachments, the location of an in-person signature or a photo if the phone allowed it, and support messages and screenshots.
• Special categories: Workstamp is not built for health, biometric or other special category data. Do not record it beyond what a photo of a work site unavoidably shows.

Annex 2: Security measures

• connections are encrypted, and stored records, files and backups are encrypted at rest;
• each company’s records and backups stay in the region it chose, apart from the copies it sends, and files are stored as Where the data goes describes;
• passwords are stored as one-way hashes, and admins must set up a second factor within 30 days;
• files are private and served only by short-lived links;
• signed sheets cannot be edited, and each has a fingerprint that shows if it has changed;
• every region is backed up, and restoring from backups is rehearsed every quarter;
• access by our staff is limited to support, read-only and logged.

Annex 3: Sub-processors

The Sub-processors page, including how changes are announced and how to object.