Data Processing Agreement
Last updated 31 October 2026
Draft: company details are still being added to this document.
This DPA applies automatically to every Customer that accepts our Terms. If you need a signed copy for your records, write to privacy@tascimo.com.
1. Parties and scope
This Data Processing Agreement (“DPA”) is part of the Terms of Service between the Customer (the “Controller”) and the provider of Tascimo (the “Processor”):
TODO: Company legal name (e.g. Tascimo LLC)
TODO: Registered address, USA
TODO: State of formation and registration / EIN
Email: privacy@tascimo.com
It applies to personal data that the Processor processes on the Controller’s behalf when providing the Service (“Customer Personal Data”), and is intended to meet Article 28 of Regulation (EU) 2016/679 (“GDPR”) and, for data from the UK, the UK GDPR. If the DPA and the Terms conflict, the DPA prevails.
2. Details of the processing
| Subject matter | Providing the Tascimo work management, time tracking and activity platform. |
|---|---|
| Duration | For as long as the Service is provided, and until Customer Personal Data is deleted or returned under section 10. |
| Nature and purpose | Hosting, storing, organising, displaying, analysing and transmitting data so the Controller can plan work, record working time and review activity. |
| Data subjects | The Controller’s employees, contractors and other users it invites, and people mentioned in workspace content. |
| Categories of data | Identification and contact data (name, email, photo, job title); account and role data; workspace content and files; working time and attendance records; desktop activity data (application and window titles, website domains and page titles, per-second keyboard and mouse activity without key contents, idle time, screenshots of all connected screens, device identifier and timezone); audit log entries including IP addresses and device information. |
| Special categories | None intended. Screenshots may incidentally show any content that is on screen; the Controller should configure tracking to minimise this. |
3. Processing on instructions
The Processor processes Customer Personal Data only on the Controller’s documented instructions, which are the Terms, this DPA and the Controller’s use and configuration of the Service, unless the law requires otherwise. The Processor will tell the Controller if it believes an instruction infringes data protection law.
4. Controller obligations
The Controller is responsible for the lawfulness of the processing, including having a legal basis for tracking its staff and informing them about the scope, purpose and method of tracking before it starts, as required by the data protection and employment laws that apply to it.
5. Confidentiality
The Processor ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality.
6. Security
The Processor implements technical and organisational measures appropriate to the risk, as required by Article 32 GDPR. The current measures are described in Annex 2 and on our Security page, and may be improved over time without lowering the overall level of protection.
7. Sub-processors
The Controller authorises the sub-processors listed in Annex 1. The Processor will inform the Controller of any intended addition or replacement at least 30 days in advance, giving the Controller the opportunity to object. The Processor imposes data protection obligations on each sub-processor equivalent to those in this DPA and remains responsible for them.
8. Assistance and data subject rights
Taking into account the nature of the processing, the Processor assists the Controller in responding to requests from data subjects and in meeting its obligations under Articles 32 to 36 GDPR. If the Processor receives a request directly from a data subject, it forwards it to the Controller without undue delay.
9. Personal data breaches
The Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and provides the information the Controller needs to meet its own notification obligations.
10. Deletion or return of data
When the Service ends, the Processor deletes Customer Personal Data, or returns it if the Controller asks before the end date, unless the law requires it to be kept. Deletion from backups is completed within the backup retention cycle.
11. Information and audits
The Processor makes available the information needed to demonstrate compliance with Article 28 GDPR and allows for audits by the Controller or an auditor it appoints, on reasonable notice, during business hours and subject to confidentiality.
12. International transfers
The Processor is based in the United States. Where Customer Personal Data from the EEA or the UK is transferred to, or accessed from, a country without an adequacy decision, the Processor relies on the European Commission’s Standard Contractual Clauses (and, for UK data, the UK International Data Transfer Addendum), or on another mechanism under Chapter V GDPR.
13. Annex 1: Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services EMEA SARL | File storage (attachments, screenshots, images) and application servers | EU: files in Stockholm, Sweden; servers TODO: confirm EC2 region |
| TODO: Database hosting provider (e.g. MongoDB Atlas) | Workspace database | TODO: region |
| TODO: Email delivery provider | Sending account, invitation, notification and report emails | TODO: region |
| Slack Technologies (Salesforce) | Only if an organisation connects Slack: posting clock-in and clock-out notifications to its channel | USA (EU–US Data Privacy Framework) |
14. Annex 2: Technical and organisational measures
- Passwords stored only as bcrypt hashes; session refresh tokens and API keys stored only as hashes; single-use, expiring password reset and invitation links.
- Role-based access within each workspace (Admin, Manager, Employee, guest).
- Audit log of security-relevant events with time, actor, IP address and device information.
- Encrypted connections (HTTPS) between the web app, desktop app and API.
- Trash with a retention period before deleted projects and tasks are removed.
- The desktop app does not record the content of keystrokes.