הסכם עיבוד נתונים

This Data Processing Agreement ("DPA") forms an integral part of the agreement for the provision of the TimeClock 365 services (the "Service Agreement") between TimeClock 365 Ltd., company no. 516135183, of 15 HaHaresh St., Hod HaSharon ("Supplier"), and the entity that has entered into the Service Agreement with Supplier ("Customer") (each, a "Party"). This DPA governs the Processing of Personal Data by Supplier on behalf of Customer in the course of providing the Services.

This DPA takes effect on the date on which it is accepted or signed as part of the Service Agreement. In the event of any conflict between this DPA and the Service Agreement regarding the Processing of Customer Data, this DPA shall prevail.

1. Definitions

1.1 "Applicable Data Protection Law" means all laws and regulations relating to privacy and data protection that apply to the Processing of Customer Data under this DPA, as amended from time to time, including, where applicable, the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR, and U.S. state privacy laws such as the California Consumer Privacy Act ("CCPA"). "Customer Data" means Personal Data that Customer or its Users enter into the Services, or that is collected or generated through the Services on behalf of Customer. "Biometric Data" means Personal Data resulting from specific technical processing relating to the physical characteristics of a natural person that allow or confirm the unique identification of that person, including biometric templates and photographs used for identification, and any equivalent term under Applicable Data Protection Law. "Security Incident" means a breach of security of systems under the control of Supplier or its Sub-processors leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data; it does not include unsuccessful attempts or activities that do not compromise the security of Customer Data, such as pings, port scans, failed log-in attempts and blocked denial-of-service attacks. "Users" means persons authorized by Customer to use the Services. "Sub-processor" means a third-party service provider engaged by Supplier that Processes Customer Data in the course of providing the Services. "Services" means the services provided by Supplier to Customer under the Service Agreement.

1.2 The terms "Personal Data", "Processing", "Controller", "Processor" and "Data Subject" have the meanings given to them in Applicable Data Protection Law, and include equivalent terms under that law (such as "personal information", "business" and "service provider" under the CCPA). Other capitalized terms not defined in this DPA have the meanings given to them in the Service Agreement.

2. Roles of the Parties and Customer Responsibilities

2.1 Customer is the Controller of Customer Data, and Supplier is a Processor acting on Customer’s behalf. Customer alone determines the purposes of the Processing and the types of data entered into the Services.

2.2 Customer is solely responsible for the lawfulness of the collection and use of Customer Data, including: (a) providing any notice required by law to its employees and other Data Subjects; (b) establishing a lawful basis for the Processing and obtaining any consent required by law, including under applicable employment and labor laws; (c) any registration, appointment of a data protection officer or representative, records of processing and data protection impact assessment, to the extent required by law; (d) determining the level of security that applies to Customer Data and fulfilling the obligations that Applicable Data Protection Law imposes on Controllers; and (e) managing Users, permissions, passwords and the settings it configures in the Services. Customer represents that its instructions to Supplier and the settings it configures in the Services comply with Applicable Data Protection Law.

2.3 Supplier provides a technology platform only, and does not review and is not responsible for whether Customer’s use of the Services complies with the law. Nothing in this DPA or in the Services constitutes legal advice.

2.4 Customer shall indemnify Supplier against any claim, demand, administrative fine or reasonable expense (including reasonable attorneys’ fees) arising from Customer’s breach of its obligations under Section 2.2 or from Supplier’s compliance with Customer’s instructions, provided that Supplier notifies Customer within a reasonable time and allows Customer to defend the claim.

3. Scope of Processing

3.1 The types of data that Supplier may Process, the purposes of the Processing, the systems that Supplier may access and the types of Processing operations are set out in Annex A.

3.2 Supplier shall Process Customer Data solely to provide, maintain, secure and support the Services, in accordance with the settings and requests that Customer and its Users make in the Services and with Customer’s documented instructions, unless Supplier is required to Process the data by law; in such a case, Supplier shall inform Customer of that legal requirement before Processing, unless the law prohibits this. Supplier shall not sell Customer Data or use it for any other purpose.

3.3 Notwithstanding the above, Supplier may create and use aggregated statistical data that does not identify, and cannot reasonably be used to identify, any individual, for the purpose of analyzing and improving the Services.

3.4 If Supplier believes that an instruction of Customer infringes Applicable Data Protection Law, Supplier shall inform Customer and may refrain from carrying out the instruction until the matter is resolved. Instructions that go beyond the standard functionality of the Services will be carried out only with Supplier’s consent and for a fee to be agreed between the Parties.

3.5 Customer shall handle requests from Data Subjects to exercise their rights under Applicable Data Protection Law using the tools available in the Services. Supplier shall forward to Customer any such request it receives directly. Taking into account the nature of the Processing and the information available to it, Supplier shall provide Customer with reasonable additional assistance where required in responding to such requests and in carrying out data protection impact assessments and prior consultations with supervisory authorities, where required by Applicable Data Protection Law.

3.6 If Supplier is required by law to disclose Customer Data to a competent authority, Supplier shall notify Customer in advance, to the extent permitted by law, and shall disclose only the data it is required to disclose.

3.7 To the extent the CCPA applies, Supplier shall not: (a) sell or share Customer Data; (b) retain, use or disclose Customer Data for any purpose other than the business purposes set out in this DPA and the Service Agreement; (c) retain, use or disclose Customer Data outside the direct business relationship between the Parties; or (d) combine Customer Data with personal information it receives from other sources, except as permitted by the CCPA. Supplier shall comply with its applicable obligations under the CCPA and provide the level of privacy protection required by the CCPA, and shall notify Customer if it determines that it can no longer meet those obligations. Customer may take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Data by Supplier.

4. Information Security

4.1 Supplier shall implement the technical and organizational security measures set out in Annex B with respect to the components of the Services under its control.

4.2 Supplier may update its security measures from time to time, provided that the overall level of protection of Customer Data is not materially reduced.

4.3 The security of end-user devices, hardware devices installed at Customer’s premises, User accounts and permissions, and interfaces that Customer connects to the Services is Customer’s responsibility.

5. Supplier Personnel and Access to Data

5.1 Supplier shall grant access to Customer Data only to employees and service providers who require such access to provide the Services, and shall require them to undertake in writing to maintain confidentiality, to use the data only in accordance with this DPA and to comply with information security obligations.

5.2 Access by Supplier’s support team to Customer Data for the purpose of handling a support request shall take place after Customer has approved it, through a support ticket, approval by a Customer administrator or another documented method.

5.3 Notwithstanding Section 5.2, Supplier may access Customer Data without prior approval where necessary to handle a Security Incident, a security threat or a critical malfunction of the Services. Such access shall be limited to the extent necessary and shall be documented.

6. Biometric Data and Location Data

6.1 The Services include optional features for Processing Biometric Data, photographs and location data ("Sensitive Features"). Customer alone decides whether to activate a Sensitive Feature, for which employees and for which purposes.

6.2 Before activating a Sensitive Feature, Customer is solely responsible for: assessing its lawfulness, proportionality and necessity; providing employees with appropriate notice; obtaining any consent or written release required by law, including under laws specifically governing biometric data (such as the Illinois Biometric Information Privacy Act); offering an alternative to employees who do not consent, where required; and adopting and, where required, publishing a retention and destruction policy for Biometric Data. Any such notice, consent and release shall expressly cover the collection, storage and use of Biometric Data by Supplier and its Sub-processors on Customer’s behalf. Customer is responsible for deleting an individual’s Biometric Data from the Services and from its devices when it is no longer needed, including when the individual’s employment ends. Customer represents that it has complied with these requirements before entering any data into a Sensitive Feature.

6.3 Customer shall indemnify Supplier against any claim, demand, administrative fine or reasonable expense (including reasonable attorneys’ fees) arising from Customer’s failure to comply with Section 6.2, provided that Supplier notifies Customer within a reasonable time and allows Customer to defend the claim.

6.4 Biometric templates may be stored on hardware devices installed at Customer’s premises, in Supplier’s cloud environment, or both, depending on the device settings. Deleting data from such devices and securing them is Customer’s responsibility. Supplier does not transfer Customer Data to hardware manufacturers.

7. Sub-processors

7.1 Customer grants Supplier a general authorization to engage Sub-processors to provide the Services. The Sub-processors engaged as of the date of this DPA are listed in Annex C.

7.2 Supplier shall give notice of any intended addition or replacement of a Sub-processor by updating the list published on Supplier’s website (www.timeclock365.com) at least thirty (30) days in advance. Customer may object to the change on reasonable data protection grounds by written notice within that period. If the Parties do not resolve the objection, Customer’s sole remedy is to discontinue use of the affected part of the Services.

7.3 Supplier shall engage Sub-processors only under a written agreement that includes information security and confidentiality obligations not materially less protective than those set out in this DPA.

8. Security Incidents

8.1 Supplier shall notify Customer of a Security Incident without undue delay, and no later than seventy-two (72) hours after becoming aware of it, and shall provide Customer with the information then available to it regarding the nature of the incident, the data affected and the measures taken. Further information shall be provided as it becomes available.

8.2 Supplier shall take reasonable steps to contain and remediate the Security Incident. Any notification to supervisory authorities or Data Subjects, where required by Applicable Data Protection Law, is Customer’s sole responsibility as Controller, and Supplier shall provide Customer with the reasonable information it requires for that purpose.

8.3 Notification or handling of a Security Incident shall not constitute an admission of fault or liability.

9. Information and Audits

9.1 Upon Customer’s written request, and no more than once per calendar year, Supplier shall provide Customer with written information regarding its compliance with this DPA. Such information may be provided in the form of a valid ISO/IEC 27001 certificate, a security statement, or responses to a reasonable security questionnaire. All reports, certificates, test results and security documents provided by Supplier are Supplier’s confidential information, and Customer shall use them solely to assess Supplier’s compliance with this DPA.

9.2 Customer may audit Supplier’s compliance with this DPA only if the information provided under Section 9.1 is insufficient to demonstrate such compliance, following a Security Incident, or where required by a supervisory authority, a court order or mandatory law. Any audit shall: take place no more than once in any twelve (12) month period, unless required by a supervisory authority or mandatory law; be subject to at least thirty (30) days’ prior written notice and a scope agreed in advance; be conducted during normal business hours, remotely where possible, by Customer or by an independent auditor that is bound by confidentiality and is not a competitor of Supplier; not include access to data of other customers or to information subject to confidentiality obligations to third parties; and be carried out at Customer’s expense.

10. Data Location and Transfers

10.1 Customer Data in the production environment of the Services, including backups, is stored in Microsoft Azure data centers in Western Europe. Customer authorizes such storage.

10.2 Supplier and its Sub-processors may access or Process Customer Data from other locations, as set out in Annex C, to the extent required to provide the Services. Any transfer of Customer Data to a country that is not recognized as providing an adequate level of protection shall be carried out in accordance with Applicable Data Protection Law, including, where applicable, on the basis of an adequacy decision, the EU-U.S. Data Privacy Framework (including its UK Extension) or the Standard Contractual Clauses approved by the European Commission (together with the UK International Data Transfer Addendum, where applicable).

11. Term, Return and Deletion

11.1 This DPA shall remain in effect for as long as Supplier Processes Customer Data.

11.2 Upon termination of the Service Agreement, Customer may export Customer Data within ninety (90) days. At the end of that period, Supplier shall delete Customer Data from the production environment, unless it is required to retain it by law. Backup copies shall be deleted in the ordinary backup cycle, no later than ninety (90) additional days, and until deleted shall be protected and not used.

11.3 Upon Customer’s written request, Supplier shall confirm the deletion of Customer Data in writing.

11.4 Customer is solely responsible for exporting Customer Data within the period set out in Section 11.2 and for retaining it for any period required by law, including attendance, working hours and payroll records. Data shall be exported using the export tools available in the Services, in their standard format. Supplier shall have no liability for data that was not exported as aforesaid and was deleted in accordance with this DPA.

12. Limitation of Liability

12.1 Supplier’s liability in connection with this DPA is subject to the limitations of liability set out in the Service Agreement, and the liability cap set out in the Service Agreement applies to the Service Agreement and this DPA together and is not an additional cap. If the Service Agreement does not include a liability cap, Supplier’s aggregate liability shall not exceed the amounts paid by Customer to Supplier for the Services during the twelve (12) months preceding the event giving rise to the claim.

12.2 In no event shall Supplier be liable for any indirect or consequential damages, including loss of profits, loss of revenue or damage to reputation.

12.3 Nothing in this Section limits any liability that cannot be limited under applicable law.

13. Governing Law and Jurisdiction

13.1 This DPA is governed by the law, and subject to the exclusive jurisdiction of the courts, set out in the Service Agreement, except where Applicable Data Protection Law mandatorily requires otherwise.

14. General

14.1 This DPA may be accepted electronically as part of the Service Agreement. Supplier may update this DPA by publishing an updated version on its website, provided that the update does not materially reduce the overall level of protection of Customer Data, or is required by Applicable Data Protection Law. Supplier may update Annexes B and C in accordance with Sections 4.2 and 7.

14.2 Notices under this DPA shall be sent to the contact details set out in the Service Agreement or in the account settings. Supplier’s contact for privacy and information security matters: [email protected].

14.3 Assistance provided by Supplier to Customer beyond the standard Services, including audits under Section 9.2, assistance under Section 3.5, data exports not made through the export tools available in the Services, and the handling of a Security Incident not caused by Supplier’s breach of this DPA, shall be provided for a fee in accordance with Supplier’s standard rates.

Annex A – Description of the Processing

Annex B – Security Measures

Supplier implements the following security measures:

• Hosting: data is stored in Microsoft Azure data centers in Western Europe, which are subject to physical and environmental security controls and independent certifications. Backups are also stored in Western Europe.
• Access control: personal user accounts; role-based permissions based on the principle of least privilege; multi-factor authentication for administrative access; periodic access reviews; revocation of access upon termination of employment or change of role.
• Encryption: encryption of data in transit using TLS 1.2 or higher and encryption of data at rest using AES-256; secure key management.
• Backup and recovery: daily automated backups; periodic restoration tests; incident response procedures.
• System security: regular security updates; vulnerability management and periodic penetration tests; separation of development, testing and production environments; logging of privileged actions.
• Personnel: confidentiality undertakings; information security training upon onboarding and periodically thereafter.
• Biometric Data: logical separation and restricted access to biometric templates stored in the cloud.
• Certification: ISO/IEC 27001 certification.

Annex C – Sub-processors

Support access: Supplier’s support team, via remote access and with Customer’s approval, as set out in Section 5.

Signatures