Data Processing Agreement

This Data Processing Agreement (DPA) forms part of the Terms of Service between Digi Pioneers Inc. (Processor, we) and the organization using Smart Employee Monitor (Customer, you). It applies to personal data that we process on your behalf when providing the Service (Customer Personal Data). Terms such as controller, processor, data subject and personal data breach have the meaning given in the EU/UK GDPR; where other laws apply, the equivalent concepts apply (for example "organization" and "third-party processor" under PIPEDA, "data fiduciary" and "data processor" under India's DPDP Act, and "business" and "service provider" under US state laws).

1. Roles and instructions

1.1 You are the controller of Customer Personal Data and we are your processor. You decide what is collected through the monitoring settings you configure.

1.2 We process Customer Personal Data only on your documented instructions. These Terms, this DPA and your configuration of the Service are your complete instructions. We will tell you if we believe an instruction breaks the law.

1.3 We will not sell Customer Personal Data, use it for our own purposes (including advertising or training AI models), or combine it with other data, except as needed to provide and secure the Service.

2. Details of the processing (Annex 1)

• Subject matter and duration: providing the Service for the term of the subscription and until deletion under section 9.
• Nature and purpose: recording and displaying work time, and, where enabled by you, screenshots, activity counts, idle time and application usage; reports, storage and deletion tools; support.
• Data subjects: your employees and contractors who use the Windows app; your administrators, managers and other users.
• Categories of data: names, email addresses, roles, team and manager assignments, time zones; work session times and breaks, corrections; screenshots of work computers taken at random times during work sessions; keyboard and mouse event counts per 5 minutes (not content); idle periods; foreground application names; device name, OS and app version, IP address of check-ins; monitoring notice acknowledgements; personal-data requests and notes; audit logs.
• Special categories: none are intended. Screenshots may incidentally show any information that is on screen during work. You should instruct employees to avoid personal or sensitive content while working and configure excluded applications (for example password managers).
• Excluded by design: typed content, passwords, window titles, webcam, microphone, location, activity outside work sessions or during breaks.

3. Confidentiality

We ensure that anyone authorized to process Customer Personal Data is bound by confidentiality. Our support staff do not have access to screenshot or activity contents; account-level support tools show account information only.

4. Security (Annex 2)

We implement and maintain appropriate technical and organizational measures, including:

• encryption in transit (TLS) and at rest; application-layer AES-256-GCM encryption of each screenshot with keys held separately from the storage;
• logical separation of each customer's data, enforced in code and covered by automated isolation tests;
• role-based access control, least privilege, two-factor authentication (mandatory for our platform staff);
• secure development practices, dependency updates and review;
• rate limiting, security headers and monitoring of errors and abuse;
• audit logging of administrative actions, exports, deletions and support actions;
• daily encrypted backups in a separate region, with documented restore procedures that we test;
• on the Windows app: per-user installation, visible status at all times, encrypted local storage of pending data, deletion of local screenshots after upload.

We may update these measures as long as the overall level of protection is not reduced.

5. Subprocessors

5.1 You authorize us to use the subprocessors listed on our Subprocessors page. We impose data-protection obligations on them that are no less protective than this DPA and remain responsible for their performance.

5.2 We will give at least 30 days' notice of a new subprocessor by updating the list and emailing account owners. You may object on reasonable data-protection grounds; if we cannot address the objection, you may terminate the affected Service and receive a pro-rated refund of prepaid fees.

6. Assistance with data subject rights

The Service gives you tools to respond to requests: viewing and exporting an employee's records, correcting timesheets, deleting screenshots for an employee or period, and a built-in personal-data request workflow for employees. If we receive a request directly, we will forward it to you without responding ourselves, unless the law requires otherwise. We will provide further reasonable assistance on request.

7. Personal data breaches

We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information reasonably available to help you meet your obligations, and we will update you as more becomes known. We will take reasonable steps to contain and remedy the breach.

8. Assistance, records and audits

We will provide reasonable assistance with data protection impact assessments and consultations with authorities relating to the Service. On request, we will provide information necessary to demonstrate compliance with this DPA, such as security documentation and answers to reasonable security questionnaires. If that is not sufficient or a regulator requires it, you may audit our compliance once per year with 30 days' notice, during business hours, at your cost, under confidentiality, and without access to other customers' data.

9. Deletion and return

During the subscription you can export and delete data with the Service's tools. After termination, you may export your data for 30 days; we then delete Customer Personal Data from live systems within 90 days, and backups are overwritten within 35 days thereafter, unless the law requires us to keep it. On request we will confirm deletion in writing.

10. International transfers

We are located in Canada, which the European Commission recognizes as providing adequate protection for commercial organizations subject to PIPEDA. Our hosting provider stores data in the United States. Where Customer Personal Data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, the parties agree to the European Commission's Standard Contractual Clauses (Module 2, controller to processor, or Module 3 where applicable), with the UK Addendum or Swiss amendments as needed, which are incorporated by reference. In case of conflict, the Standard Contractual Clauses prevail.

11. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms, except where the law does not allow it. If this DPA conflicts with the Terms on data protection, this DPA prevails.

12. Contact

Data-protection questions: info@smartemployeemonitor.com, Digi Pioneers Inc., 12 Barlow Place, Paris, Ontario, Canada.