Data Processing Agreement

1. Subject matter and duration

This DPA governs Almaware S.r.l.'s processing of personal data on the Controller's behalf for as long as the Controller has an active WorkingClock subscription, and until that data is deleted or returned under §12.

2. Scope and purpose of processing

Almaware S.r.l. processes personal data solely to provide the WorkingClock service: storing, displaying, and reporting on the time entries, projects, tasks, and team data the Controller and its users enter, strictly on the Controller's documented instructions (the Terms of Service and the Controller's configuration of the service).

3. Categories of data and data subjects

Data subjects: the Controller's employees, contractors, and other team members who use WorkingClock, and — where the Controller records this — names of clients associated with projects.

Data categories: name, email address, time entries, project/task/client names and notes, and organizational role.

4. Processor obligations

• Process personal data only on the Controller's documented instructions, including regarding international transfers
• Ensure personnel authorized to process the data are bound by confidentiality
• Implement appropriate technical and organizational security measures (Article 32 GDPR) — see §7
• Engage sub-processors only as permitted under §5 and impose equivalent data-protection obligations on them by contract
• Assist the Controller in responding to data subject requests and in meeting its own Article 32–36 obligations, taking into account the nature of processing
• Notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data
• At the Controller's choice, delete or return all personal data at the end of the subscription, per §12
• Make available the information necessary to demonstrate compliance with this Article and allow for audits per §9

5. Sub-processors

The Controller authorizes Almaware S.r.l. to engage the sub-processors listed on our Sub-processors page. Before adding a new sub-processor, we will update that page and notify Controllers on this DPA with at least 30 days' advance notice, giving the Controller an opportunity to object on reasonable data-protection grounds.

6. International transfers

Where a sub-processor is located outside the EU/EEA, transfer relies on the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework, as detailed on the Sub-processors page.

7. Security measures

• Encryption in transit (TLS) and at rest
• Role-based access control and tenant isolation between organizations
• Authenticated, logged access to production systems
• Regular backups with a defined retention window

8. Assistance with data subject rights

WorkingClock provides self-serve data export and account/organization deletion tools the Controller can use directly. Where a request requires our assistance beyond what self-serve tooling provides, contact support@workingclock.app.

9. Audit rights

The Controller may request evidence of our compliance with this DPA (such as a summary of our security measures). On-site or third-party audits may be arranged by mutual agreement, with reasonable advance notice, no more than once per year absent a specific incident.

10. Term and termination

This DPA is coextensive with the underlying subscription. It terminates automatically when the Terms of Service terminate.

11. Liability

Liability under this DPA is governed by the limitation of liability set out in the Terms of Service.

12. Data return and deletion

On termination of the subscription, the Controller may export its data before the account is closed. Personal data is then deleted after the grace period described in our Privacy Policy, except where we are required by law to retain it (e.g. invoices).

13. Requesting a signed copy

Organizations on the Team or Enterprise plan can request a countersigned copy of this DPA by writing to support@workingclock.app.