Data processing agreement (DPA)

Conclude online

Admins conclude the DPA in the app under Settings → DPA & legal and receive it as a PDF.

1. Subject matter and duration

The processor processes personal data on behalf of the controller to provide the "zeitfair" software (working-time recording, absences, project time, analytics). The term equals the term of the main agreement.

2. Nature and purpose of processing

Collection, storage, analysis and erasure of working-time, break, absence and project data to fulfil the controller’s working-time recording obligations and project billing.

Optional and only if enabled by the controller: AI-assisted analysis (categorisation, budget and utilisation signals) by the subprocessor MiniMax.

3. Categories of data subjects and data

Data subjects: employees, trainees, freelancers and administrators of the controller.

Data: name, email, role, employee number, contractual hours, time entries (start, end, breaks, project, description), absences (type, period – no diagnoses), log data (change history, truncated IP addresses). Optional: activity categories from devices the data subject has paired themselves.

4. Obligations of the processor

Processing only on documented instructions of the controller (Art. 28(3)(a) GDPR).

All persons with access are bound to confidentiality.

Assistance with data subject rights (Art. 12–23 GDPR), in particular via export and erasure features.

Notification of personal data breaches without undue delay, at the latest within 48 hours of becoming aware.

Deletion or return of all data at the end of the agreement unless statutory retention applies.

5. Technical and organisational measures (Art. 32 GDPR)

Data stored in the EU (Frankfurt, AWS eu-central-1); encryption in transit (TLS 1.2+) and at rest (AES-256).

Tenant isolation at database level (row-level security); role-based access (owner, admin, manager, employee).

Immutable, hash-chained audit log; changes to time entries only with reason and history.

Data minimisation: no screenshots, no keystrokes, no window titles; team analytics only above a minimum group size.

Configurable retention and automated deletion; regular backups with point-in-time recovery.

6. Subprocessors

The controller approves the companies in the subprocessor list. Changes are announced at least 30 days in advance; the controller may object.

Transfers to third countries only with appropriate safeguards (Art. 44 et seq. GDPR), in particular EU standard contractual clauses.

7. Audit rights

The controller may verify compliance by requesting information or certificates or, with reasonable notice, by inspections.

8. Final provisions

German law applies. In case of conflict this agreement prevails over the data protection provisions of the main agreement.