Last updated: 9 November 2026

Data Processing Agreement

This Data Processing Agreement ("DPA") sets out the terms under which AdeptTime processes personal data on behalf of its customers, as required by Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"). It forms part of the Terms of Service between AdeptTime and the customer and applies automatically when the customer uses the service.

1. Parties and roles

The customer — the organization that has created or is responsible for a workgroup in AdeptTime — is the data controller. Adept Works ApS (CVR 45721833), Denmark, which provides the AdeptTime service ("AdeptTime"), is the data processor and processes personal data only on the controller's behalf. If the customer is itself a processor for a third party, AdeptTime acts as its sub-processor, and this DPA applies accordingly.

Where AdeptTime processes data for its own purposes (for example user account administration, security and billing of the customer), AdeptTime is an independent controller, as described in our privacy notice.

2. Scope of processing

The subject matter, nature, purpose and duration of the processing, and the categories of personal data and data subjects, are described in Appendix A.

3. Instructions

AdeptTime processes personal data only on documented instructions from the controller, including with regard to transfers to third countries, unless required to do so by EU or member state law. The agreement, this DPA and the controller's use and configuration of the service constitute the controller's instructions. AdeptTime will inform the controller without delay if, in its opinion, an instruction infringes data protection law.

4. The controller's obligations

The controller is responsible for having a lawful basis for the processing, for informing data subjects, and for ensuring that the personal data it enters into or collects through the service — including location data from geofence-based presence tracking — is processed lawfully. The controller decides which features and integrations are enabled for its workgroup.

5. Confidentiality

AdeptTime ensures that persons authorised to process the personal data are bound by confidentiality and only have access to the extent necessary to deliver, support and secure the service.

6. Security of processing

AdeptTime implements appropriate technical and organisational measures in accordance with Article 32 GDPR, taking into account the state of the art, the cost of implementation and the risks to data subjects. The current measures are described in Appendix C. AdeptTime may update the measures provided the overall level of protection is not reduced.

7. Sub-processors

The controller gives AdeptTime general authorisation to engage sub-processors. The sub-processors in use are listed in Appendix B. AdeptTime will give at least 30 days' notice by email to the customer's administrator before adding or replacing a sub-processor. The controller may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the controller may terminate the affected part of the service.

AdeptTime imposes the same data protection obligations on each sub-processor as set out in this DPA and remains responsible to the controller for the sub-processor's performance.

Third-party services that the controller chooses to connect to its workgroup — for example an accounting or payroll system — are not sub-processors of AdeptTime. Data is sent to such services on the controller's instruction, and the controller's own agreement with that provider governs its processing.

8. Transfers outside the EU/EEA

Personal data is primarily stored and processed within the EU/EEA. AdeptTime transfers personal data to a country outside the EU/EEA only where a valid transfer mechanism under Chapter V GDPR is in place, such as an adequacy decision (including the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses.

9. Assistance to the controller

Taking into account the nature of the processing, AdeptTime assists the controller with appropriate measures in responding to requests from data subjects exercising their rights (access, rectification, erasure, restriction, portability and objection). Much of this can be done directly by workgroup administrators in the service. If AdeptTime receives such a request directly, it will forward it to the controller without undue delay and will not respond itself unless instructed to.

AdeptTime also assists the controller, on request, in ensuring compliance with Articles 32–36 GDPR, including data protection impact assessments and prior consultation with a supervisory authority, using the information available to AdeptTime.

10. Personal data breaches

AdeptTime notifies the controller without undue delay, and where feasible no later than 48 hours, after becoming aware of a personal data breach affecting the controller's data. The notification will, as far as possible, describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. AdeptTime will take reasonable steps to contain and remedy the breach.

11. Deletion and return of data

When the service ends, the controller can export its data through the service or request an export from AdeptTime. AdeptTime deletes the controller's personal data within 90 days after termination, unless EU or member state law requires continued storage. Data in backups is overwritten in line with the normal backup cycle.

12. Audit and information

AdeptTime makes available to the controller the information necessary to demonstrate compliance with Article 28 GDPR and allows for and contributes to audits, including inspections, conducted by the controller or an auditor mandated by it. Audits must be requested with reasonable notice, be limited to what is necessary, respect the confidentiality of other customers' data, and be carried out at the controller's expense. AdeptTime may first answer by providing written documentation.

13. Term, liability and precedence

This DPA applies for as long as AdeptTime processes personal data on the controller's behalf. Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service or another agreement between the parties, except where GDPR does not allow such limitation. In case of conflict between this DPA and other terms between the parties regarding the processing of personal data, this DPA prevails.

AdeptTime may update this DPA to reflect changes in law or in the service. Material changes will be notified to customers in advance. A signed copy can be provided on request.

14. Governing law

This DPA is governed by Danish law. Disputes are settled by the Danish courts.

Appendix A — Details of the processing

• Subject matter and purpose — provision of the AdeptTime service: time registration, approval of work, schedules, cases/jobs, teams, expenses and mileage, geofence-based presence tracking, reporting, invoicing support and integrations enabled by the controller.
• Nature of processing — collection, storage, organisation, retrieval, calculation, display, transmission on the controller's instruction, and deletion.
• Data subjects — the controller's employees, contractors and other users of the service; contact persons at the controller's customers.
• Categories of personal data — name, email address, phone number, address, profile photo, role and position; workgroup and team membership; time, work, expense and mileage registrations, including descriptions and attached documents; schedules and approvals; pay and invoice rates; device location while geofence-based check-in is enabled; device push tokens; customer contact details; technical logs.
• Special categories of data — none are intended. The controller should not enter special categories of data (Article 9 GDPR) or national identification numbers in free-text fields or attachments.
• Duration — for the term of the agreement, followed by deletion as described in section 11.

Appendix B — Sub-processors

• Microsoft Ireland Operations Ltd. (Microsoft Azure) — hosting, database, file storage, transactional email and application monitoring. Location: EU.
• 650 Industries, Inc. (Expo) — delivery of push notifications to the mobile app (device push token and notification content). Location: USA, transfer under the Standard Contractual Clauses or the EU-US Data Privacy Framework.
• Google Ireland Ltd. / Google LLC (Google Maps Platform) — maps and address lookup in the web dashboard (addresses and job-site locations). Location: EU/USA, transfer under the EU-US Data Privacy Framework.

Appendix C — Technical and organisational measures

• Encryption — all traffic is encrypted in transit with TLS. Data is encrypted at rest by the hosting platform. Credentials for third-party integrations are additionally encrypted at application level.
• Access control — authentication with signed, time-limited tokens. Every request is scoped to the user's workgroup and role, and this separation between customers is enforced in the database queries.
• Internal access — access to production systems is limited to the personnel who need it, protected by multi-factor authentication.
• Availability — managed database with automated backups and point-in-time restore.
• Logging and monitoring — application and security events are logged and monitored for errors and misuse.
• Data minimisation — location data is only processed while geofence-based check-in is enabled for the workgroup, and only to record presence at job sites.

Contact

Questions about this DPA, or requests for a signed copy, can be sent to privacy@adepttime.dk.

Adept Works ApS · CVR 45721833 · Denmark