Data Processing Agreement

1. Scope, purpose and duration

The Processor supplies employee administration, scheduling, availability/leave, time recording, team communication, tips, selected POS/inventory integrations, notifications, private media storage and optional AI Import. Processing includes collecting, organising, storing, retrieving, transmitting, calculating, correcting, restricting, exporting and deleting records as needed for those functions. Processing is ongoing for the service relationship and, where needed, the agreed return/deletion period. This DPA remains in force until entrusted personal data is returned or deleted, subject to lawfully retained copies.

2. Data subjects and categories

Optional calendar display adds customer-selected calendar identifiers, authorisation credentials, event identifiers, titles, locations, times/all-day dates, source links and synchronisation metadata. Data subjects can also include people named in the selected calendar's titles or locations. This processing is solely for read-only display to the workplace's managers with schedule access, following the customer's connection and calendar selection; it does not change employee availability or shifts. Select a business calendar and exclude unrelated or sensitive personal events. The existing instructions, security, subprocessor and deletion provisions apply; Google supplies the customer-selected source service under that connected account's terms.

Data subjects are customer owners/managers, employees, invited staff, other authorised users and people whose details the customer lawfully includes in service records.

Leave reasons and free text can incidentally reveal health or other Art. 9 GDPR data. Such processing is permitted only on lawful, documented customer instructions with the necessary Art. 9 condition and safeguards. Medical documents, diagnoses and unrelated sensitive records are not required by the service and should not be uploaded. The service does not require criminal-conviction data.

3. Instructions and customer obligations

The agreement, enabled features, authorised configuration and customer actions are documented instructions. Additional instructions may be given in text form to [email protected] by an authorised representative. The Processor processes entrusted data only on those instructions, including international transfers, unless EU/member-state law requires otherwise; it informs the customer of that requirement beforehand unless the law prohibits it on important public-interest grounds. It immediately informs the customer if, in its opinion, an instruction infringes applicable EU/member-state data-protection law, and may pause that instruction pending resolution.

The Controller establishes lawful processing, staff notices and permissions, data minimisation, retention periods and any required employee-representation involvement. It reviews AI/scheduling outputs and keeps export/backup arrangements appropriate for its own statutory records. The Processor does not use entrusted data for unrelated purposes or to train its own general AI models.

4. Confidentiality, security and assistance

The Processor binds authorised personnel to confidentiality, limits access to need, and implements appropriate measures under Art. 32 GDPR considering risk and the nature of the data. It assists the Controller, taking account of the processing and available information, with rights requests and obligations under Arts. 32–36, including security, breach assessment/notification, impact assessments and prior consultation. Requests received directly are promptly referred to the Controller; the Processor does not independently resolve them except where law requires.

The Processor notifies the Controller without undue delay after becoming aware of a personal-data breach. Available information includes the nature, affected categories/approximate numbers, contact point, likely consequences and remedial measures; missing information is supplied in stages without undue delay. The Controller remains responsible for its own supervisory-authority/data-subject notifications; the Processor does not wait for a 72-hour deadline to inform the customer.

This assistance also covers applicable local security/breach-notification duties, including Florida Statutes § 501.171 where applicable. ShiftPriority's own statutory duties remain unaffected.

5. Subprocessors and objections

The Controller gives general written authorisation for the following suppliers insofar as they process entrusted data. Independent account/billing/marketing processing, and customer-contracted POS providers, are described separately in the Privacy Policy.

The Processor imposes substantially the same data-protection obligations on subprocessors in a binding agreement and remains responsible to the Controller for their performance. It provides workspace owners an email identifying any intended addition or replacement, function/location and proposed start, at least 14 days before that supplier starts the affected processing. The Controller can object on reasonable data-protection grounds by emailing [email protected] during that period. The parties seek a reasonable alternative or remedy; the affected processing does not start while an unresolved justified objection remains. If no remedy is reasonably possible, the Controller may terminate the affected service before the change and receive a refund of unused prepaid charges for it.

6. International processing

The database project is in Frankfurt. This does not promise EEA-only email, edge compute, support or optional AI/diagnostics. Transfers require documented customer instructions and compliance with Chapter V GDPR, including an applicable adequacy decision or valid safeguards such as the applicable Standard Contractual Clauses and necessary supplementary measures. The Processor supplies information and copies of the applicable safeguards on request, with proportionate protection of third-party confidential information. A new supplier cannot start merely because its name was added to a website.

7. Technical and organisational measures

• HTTPS/TLS for client/service connections and provider-managed encryption at rest for hosted database/storage.
• Tenant ownership/scoping and row-level security for tenant-accessible data; role checks and explicitly restricted privileged server operations.
• Password/PIN hashing, session authentication, limited device pairing, abuse/rate-limit controls and server-side secrets outside browser bundles.
• Private uploaded-photo/logo buckets, authenticated access, file ownership/byte validation and limited rendering of private media.
• Access restricted to authorised personnel, confidentiality, incident handling and assistance with breach notification.
• Return/export and verified deletion procedures; backup/restore safeguards are governed by the configured hosting arrangements. The actual backup schedule, expiry and restore options are documented in the operating record and available on request; point-in-time recovery is not promised as a universal feature.

Measures may improve with the service without reducing the agreed protection. Specific algorithms, security certifications or an absolute guarantee of isolation/security are not promised merely by this list.

8. Information and audits

The Processor makes available all information necessary to demonstrate compliance with Art. 28 and allows and contributes to audits, including inspections, by the Controller or its mandated auditor. Normally the parties arrange scope, confidentiality, protection of other customers and a reasonable date with 14 days' notice, and use relevant documents/reports first where sufficient. These arrangements do not impose an absolute annual audit cap or block shorter-notice/additional audits required by law, a supervisory authority, a material incident or reasonable evidence of non-compliance.

9. Return and deletion

At the Controller's choice, the Processor returns or deletes entrusted personal data at service end and deletes existing copies, unless EU/member-state law requires storage. Data return is in a structured, commonly used machine-readable format, with customer files and reasonable assistance; the Controller can request a complete return beyond the supported in-app export. Where applicable, the Data Act transition/retrieval period in the Terms is respected before deletion, unless the customer requests earlier deletion.

After a verified deletion instruction and any applicable retrieval period, active workspace data is deleted without undue delay, normally within 30 days. Cancelling payment alone is not a deletion instruction. Backup copies remain isolated until configured expiry, are not used for ordinary processing, and deletion is reapplied following restoration. The Processor explains any legally retained categories/basis and remaining backup expiry on request and confirms completion. The DPA continues to protect any retained data.

10. Agreement and changes

Express agreement to a published proposed Terms/DPA version can also be recorded by an authorised workspace owner in the app, separately from the original signup evidence. The proposed version takes effect no earlier than the notified date or the owner's express agreement, whichever is later; existing instructions and protection continue until a valid amendment or lawful service end.

Workspace creation records the authorised customer's acceptance of the dated Terms/DPA. A copy or countersigned version is available at [email protected]. Material contractual amendments require express agreement or another legally valid basis; notice, silence or continued use alone is not acceptance. Planned material amendments are notified by dedicated email normally at least 14 days in advance. Subprocessor changes follow section 5 rather than being treated as a new consent request to each employee.