Data Processing Agreement

Effective Date: September 22, 2026
Last Updated: September 22, 2026

This Data Processing Agreement (“DPA”) forms part of the agreement between TrackMySquad (“TrackMySquad,” “Processor,” “we,” “us,” or “our”) and the customer using TrackMySquad’s Services (“Customer,” “Controller,” “you,” or “your”).

This DPA governs the processing of Personal Data by TrackMySquad on behalf of the Customer in connection with the TrackMySquad services, applications, software, APIs, integrations, and related services (collectively, the “Services”).

This DPA is intended to establish the parties’ respective responsibilities regarding the processing and protection of Personal Data and to support compliance with applicable data protection and privacy laws.

If there is a conflict between this DPA and another agreement between the parties concerning the processing of Personal Data, this DPA will control with respect to such processing to the extent required by applicable law.

1. Definitions

For purposes of this DPA:

“Applicable Data Protection Law” means any privacy, data protection, cybersecurity, or similar law or regulation applicable to the processing of Personal Data under the Services, including, where applicable, the General Data Protection Regulation (“GDPR”), the UK GDPR, applicable U.S. state privacy laws, and other applicable privacy legislation.

“Controller” means the person or entity that determines the purposes and means of processing Personal Data.

“Processor” means the person or entity that processes Personal Data on behalf of the Controller.

“Data Subject” means an identified or identifiable individual whose Personal Data is processed.

“Personal Data” means information relating to an identified or identifiable individual, or information otherwise treated as personal information under Applicable Data Protection Law.

“Processing” or “Process” means any operation performed on Personal Data, including collection, recording, organization, storage, alteration, retrieval, consultation, use, disclosure, transmission, restriction, deletion, or destruction.

“Subprocessor” means a third party engaged by TrackMySquad to process Personal Data on behalf of the Customer.

“Security Incident” means a confirmed breach of TrackMySquad’s security resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to Personal Data processed by TrackMySquad.

2. Roles of the Parties

For Personal Data processed through the Services on behalf of the Customer:

  • The Customer acts as the Controller or, where applicable, as a processor acting on behalf of another controller.
  • TrackMySquad acts as the Processor.
  • TrackMySquad will process Personal Data on behalf of and in accordance with the Customer’s documented instructions, subject to this DPA and Applicable Data Protection Law.

The Customer remains responsible for determining the purposes and lawful means of processing Personal Data submitted to the Services.

Where the Customer acts as a processor for another organization, the Customer represents that it has authority to provide TrackMySquad with the applicable processing instructions.

3. Scope and Subject Matter of Processing

TrackMySquad may process Personal Data in order to provide, maintain, secure, support, and improve the Services in accordance with the Customer’s agreement with TrackMySquad.

Depending on the Services and features enabled by the Customer, processing may include:

  • Account administration;
  • Employee and workforce management;
  • Attendance tracking;
  • Time tracking;
  • Timesheet management;
  • Productivity monitoring;
  • Activity monitoring;
  • Screenshot collection and storage, where enabled;
  • Reporting and analytics;
  • Customer support;
  • Authentication and access management;
  • Service security and fraud prevention;
  • System maintenance and troubleshooting; and
  • Other processing necessary to provide the Services.

TrackMySquad will not process Customer Personal Data for unrelated purposes except as permitted by Applicable Data Protection Law or as otherwise agreed with the Customer.

4. Categories of Personal Data

Depending on the Services and features used by the Customer, TrackMySquad may process categories of Personal Data including:

  • Name;
  • Business or personal email address;
  • Username or account identifier;
  • Employee or user identification information;
  • Contact information;
  • Login and authentication information;
  • IP address;
  • Device and browser information;
  • Operating system information;
  • Time zone and location-related information where enabled and lawfully collected;
  • Attendance information;
  • Working hours;
  • Time tracking records;
  • Timesheet information;
  • Productivity and performance-related information;
  • Application and website activity;
  • Activity logs;
  • Device or system activity;
  • Screenshots, where enabled;
  • Project, task, and work-related information;
  • Leave and schedule information;
  • Reports and analytics generated from Customer data; and
  • Other information submitted or generated through the Services at the Customer’s direction.

The Customer is responsible for determining whether any particular category of Personal Data is appropriate and lawful to process through the Services.

5. Special Categories and Sensitive Personal Data

The Customer should not submit special categories of personal data, sensitive personal information, health information, financial information, government identification information, biometric information, or other specially regulated information to the Services unless:

  1. The Customer has determined that such processing is lawful;
  2. The Customer has an appropriate legal basis and authorization;
  3. The processing is necessary and proportionate to the intended purpose;
  4. Appropriate notices and safeguards have been provided; and
  5. The use is permitted under the applicable TrackMySquad agreement and Services.

TrackMySquad does not require Customers to submit sensitive or special-category data to use the core Services.

Where the Customer elects to process such information, the Customer remains responsible for ensuring compliance with Applicable Data Protection Law.

6. Processing Instructions

TrackMySquad will process Personal Data only:

  • To provide and support the Services;
  • In accordance with the Customer’s documented instructions;
  • As necessary to comply with applicable law;
  • As necessary to protect the security and integrity of the Services; or
  • For other purposes expressly permitted by the applicable agreement and Applicable Data Protection Law.

If TrackMySquad determines that an instruction from the Customer violates Applicable Data Protection Law, TrackMySquad may notify the Customer and may suspend the relevant processing where legally required.

7. Customer Responsibilities

The Customer is responsible for:

  • Establishing a lawful basis for processing Personal Data;
  • Providing appropriate privacy notices to Data Subjects;
  • Obtaining consent where consent is legally required;
  • Ensuring that processing is necessary and proportionate;
  • Ensuring that employee and workforce monitoring complies with applicable employment and privacy laws;
  • Configuring the Services appropriately;
  • Ensuring that Personal Data submitted to TrackMySquad is accurate and lawfully obtained;
  • Responding to Data Subject requests where the Customer is responsible for doing so;
  • Maintaining appropriate internal privacy and security policies;
  • Managing user access and permissions; and
  • Providing TrackMySquad with lawful and documented processing instructions.

TrackMySquad provides technology and does not provide legal advice regarding the Customer’s specific privacy, employment, monitoring, or data protection obligations.

8. Confidentiality

TrackMySquad will ensure that persons authorized to process Customer Personal Data are subject to appropriate confidentiality obligations.

TrackMySquad will limit access to Personal Data to personnel, contractors, and service providers who require access to perform their authorized responsibilities.

TrackMySquad will take reasonable measures to prevent unauthorized use or disclosure of Personal Data.

9. Security Measures

TrackMySquad will maintain reasonable technical and organizational measures designed to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, alteration, or disclosure.

Depending on the nature and risks of the processing, such measures may include:

  • Access controls;
  • Authentication mechanisms;
  • Role-based permissions;
  • Encryption or equivalent protections where appropriate;
  • Secure transmission mechanisms;
  • Security monitoring;
  • Logging and audit mechanisms;
  • Backup and recovery procedures;
  • Vulnerability management;
  • System and application security controls;
  • Employee confidentiality obligations;
  • Security awareness measures;
  • Incident response procedures; and
  • Business continuity and disaster recovery measures.

Security measures may be updated from time to time to reflect technological developments, security risks, and operational requirements, provided that such changes do not materially reduce the overall security of the Services.

10. Security Incidents

TrackMySquad will notify the Customer without undue delay after becoming aware of a confirmed Security Incident involving Customer Personal Data, where notification is required by Applicable Data Protection Law.

Where reasonably available and legally permitted, the notification may include:

  • The nature of the Security Incident;
  • The categories of Personal Data affected;
  • The approximate number of Data Subjects or records affected;
  • The likely consequences of the incident;
  • Measures taken or proposed to address the incident; and
  • Relevant contact information for further communication.

TrackMySquad will take reasonable steps to investigate and mitigate a Security Incident.

The Customer is responsible for determining whether notification to regulators, employees, customers, Data Subjects, or other third parties is required and for making such notifications where legally required.

TrackMySquad will reasonably cooperate with the Customer in connection with such obligations.

11. Data Subject Requests

Where reasonably necessary and legally required, TrackMySquad will provide reasonable assistance to the Customer in responding to requests from Data Subjects concerning their Personal Data.

Such requests may include requests relating to:

  • Access;
  • Correction;
  • Deletion;
  • Restriction;
  • Data portability;
  • Objection; and
  • Other rights available under Applicable Data Protection Law.

Where TrackMySquad receives a Data Subject request relating to Personal Data controlled by the Customer, TrackMySquad may direct the individual to the Customer where appropriate.

The Customer remains responsible for responding to Data Subject requests unless otherwise agreed.

12. Assistance With Compliance

Taking into account the nature of processing and the information available to TrackMySquad, TrackMySquad will provide reasonable assistance to the Customer with:

  • Security obligations;
  • Data breach response;
  • Data Subject requests;
  • Data protection impact assessments where reasonably necessary;
  • Regulatory consultations where legally required; and
  • Other compliance obligations applicable to the processing performed by TrackMySquad.

The Customer is responsible for providing TrackMySquad with the information reasonably necessary to provide such assistance.

Unless otherwise agreed, the Customer may be responsible for reasonable costs associated with assistance that is materially beyond TrackMySquad’s standard Services.

13. Subprocessors

TrackMySquad may engage third-party service providers to assist in providing the Services.

These providers may include:

  • Cloud hosting providers;
  • Infrastructure providers;
  • Analytics providers;
  • Payment processors;
  • Customer support providers;
  • Communication service providers;
  • Security service providers;
  • Monitoring and logging providers; and
  • Other vendors necessary to operate and support the Services.

TrackMySquad will require applicable Subprocessors to enter into contractual obligations relating to the protection and confidentiality of Personal Data that are appropriate to the services they provide.

TrackMySquad remains responsible for its Subprocessors’ processing of Personal Data to the extent required by Applicable Data Protection Law.

14. Subprocessor Changes

TrackMySquad may add or replace Subprocessors from time to time.

Where required by Applicable Data Protection Law, TrackMySquad will provide appropriate notice of material changes to Subprocessors.

Where legally required, the Customer may object to the appointment of a new Subprocessor on reasonable data protection grounds.

If the parties cannot reasonably resolve such an objection, the parties may discuss commercially reasonable alternatives.

15. International Data Transfers

Personal Data may be processed or transferred across jurisdictions in connection with the provision of the Services.

Where Applicable Data Protection Law imposes requirements for international transfers, TrackMySquad will implement appropriate safeguards as required by applicable law.

Depending on the circumstances, such safeguards may include:

  • Adequacy decisions;
  • Standard Contractual Clauses;
  • UK International Data Transfer Agreements or Addendums;
  • Other legally recognized transfer mechanisms; or
  • Other appropriate safeguards permitted by Applicable Data Protection Law.

The parties will reasonably cooperate to implement additional transfer safeguards where required by applicable law.

16. Government and Law Enforcement Requests

TrackMySquad may disclose Personal Data where required by applicable law, valid legal process, court order, regulatory requirement, or governmental authority.

Where legally permitted, TrackMySquad will take reasonable steps to notify the Customer of such requests before disclosing Personal Data.

TrackMySquad may not provide notice where prohibited by law or where an applicable legal requirement requires confidentiality.

17. Data Retention

TrackMySquad will retain Customer Personal Data for as long as reasonably necessary to provide the Services and fulfill the purposes described in the applicable agreement.

Retention periods may vary depending on:

  • Customer configuration;
  • Service requirements;
  • Account status;
  • Legal obligations;
  • Security requirements;
  • Backup and disaster recovery requirements; and
  • Applicable contractual requirements.

The Customer is responsible for configuring retention settings where such controls are made available through the Services.

18. Data Deletion and Return

Upon termination or expiration of the Customer’s use of the Services, TrackMySquad will handle Customer Personal Data in accordance with the applicable agreement and its standard deletion procedures.

Unless otherwise required by law or agreed between the parties, TrackMySquad will delete or return Customer Personal Data within a commercially reasonable period following termination.

Data retained in backups may remain for a limited period until such backups are overwritten or securely deleted in accordance with TrackMySquad’s backup procedures.

TrackMySquad may retain information where required by law or where reasonably necessary to establish, exercise, or defend legal claims.

19. Audits and Compliance Information

Where required by Applicable Data Protection Law, TrackMySquad will make available reasonable information necessary to demonstrate compliance with its obligations under this DPA.

Subject to confidentiality and security requirements, the Customer may request reasonable documentation relating to TrackMySquad’s security and data protection practices.

Where an audit is legally required, the parties will cooperate in good faith to establish an appropriate scope, timing, and methodology.

Audits must:

  • Be conducted during reasonable business hours;
  • Minimize disruption to TrackMySquad’s operations;
  • Protect the confidentiality of TrackMySquad and other customers;
  • Not compromise the security of the Services; and
  • Not provide access to Personal Data belonging to other customers.

The Customer will bear its own audit costs unless otherwise required by Applicable Data Protection Law or agreed in writing.

20. Records and Documentation

TrackMySquad will maintain appropriate documentation relating to its processing activities where required by Applicable Data Protection Law.

TrackMySquad may provide reasonable information to assist the Customer in meeting its own regulatory obligations.

21. Data Protection Impact Assessments

Where required by Applicable Data Protection Law, the Customer is responsible for determining whether a Data Protection Impact Assessment (“DPIA”) is necessary for its processing activities.

Where reasonably necessary and legally required, TrackMySquad will provide appropriate information regarding the Services to assist the Customer with a DPIA.

TrackMySquad does not determine whether the Customer’s particular processing activities require a DPIA.

22. Data Accuracy

The Customer is responsible for the accuracy, quality, legality, and relevance of Personal Data submitted to the Services.

TrackMySquad will not be responsible for inaccuracies in Personal Data provided by the Customer or its authorized users.

23. Data Minimization

The Customer should only collect and process Personal Data that is reasonably necessary for its legitimate business purposes and applicable legal obligations.

Customers should avoid using the Services to collect unnecessary sensitive or excessive Personal Data.

24. Employee and Workforce Monitoring

Where the Services are used for employee monitoring, time tracking, attendance tracking, productivity monitoring, screenshot collection, or similar workforce-management activities, the Customer is responsible for ensuring that such use complies with Applicable Data Protection Law and applicable employment and labor requirements.

The Customer is responsible for determining:

  • Whether monitoring is lawful;
  • Whether employee notice is required;
  • Whether consent is required;
  • Whether another lawful basis applies;
  • What information may be collected;
  • How long information may be retained;
  • Which employees or contractors may be monitored;
  • Which monitoring features should be enabled; and
  • Whether local or collective employment requirements apply.

TrackMySquad does not determine the legality of the Customer’s workforce-monitoring practices.

25. Privacy by Design and Default

TrackMySquad will consider reasonable privacy and security principles in the design and operation of the Services.

The Customer remains responsible for configuring available controls in a manner appropriate for its intended processing activities.

Where privacy or security settings are available, the Customer should use them according to its legal and operational requirements.

26. Personal Data Breach Cooperation

The parties will reasonably cooperate in good faith regarding confirmed incidents involving Personal Data.

The Customer will provide TrackMySquad with relevant information necessary to investigate incidents arising from the Customer’s own systems, credentials, configurations, or authorized users.

Neither party will make public statements regarding a Security Incident that incorrectly attribute responsibility to the other party without first establishing the relevant facts, except where disclosure is legally required.

27. Customer Instructions and Lawful Processing

The Customer represents that it has all necessary rights, permissions, notices, and lawful bases required to provide Personal Data to TrackMySquad for processing.

The Customer’s instructions to TrackMySquad must comply with Applicable Data Protection Law.

TrackMySquad is not responsible for determining whether the Customer’s instructions are lawful except to the extent required by Applicable Data Protection Law.

28. Confidentiality of Customer Data

TrackMySquad will treat Customer Personal Data as confidential and will not disclose it except:

  • To authorized personnel;
  • To authorized Subprocessors;
  • To provide the Services;
  • At the Customer’s documented direction;
  • As required by law; or
  • As otherwise permitted under the applicable agreement.

29. Relationship With Privacy Policy

TrackMySquad’s Privacy Policy describes how TrackMySquad may collect and process information relating to visitors, account holders, users, and other individuals in connection with its websites and Services.

This DPA specifically governs Personal Data processed by TrackMySquad on behalf of the Customer in its role as Processor.

Where TrackMySquad processes information as an independent Controller for its own legitimate business purposes, such processing may be governed by the Privacy Policy rather than this DPA.

30. Liability

Each party remains responsible for complying with the obligations applicable to it under Applicable Data Protection Law.

Nothing in this DPA limits any liability that cannot lawfully be limited or excluded.

Any contractual limitations of liability applicable to the Services will apply to this DPA unless Applicable Data Protection Law requires otherwise.

31. Term and Termination

This DPA will remain in effect for as long as TrackMySquad processes Customer Personal Data on behalf of the Customer.

The obligations relating to confidentiality, data protection, security, deletion, and any other provisions intended by their nature to survive termination will continue to apply as required by the applicable agreement or Applicable Data Protection Law.

32. Changes to This DPA

TrackMySquad may update this DPA from time to time to reflect:

  • Changes in Applicable Data Protection Law;
  • Changes to the Services;
  • Changes in security practices;
  • Changes in Subprocessors;
  • Regulatory developments; or
  • Changes to industry standards.

Where an amendment materially affects the Customer’s rights or obligations, TrackMySquad may provide reasonable notice where required by law or contract.

33. Governing Agreement

This DPA is incorporated into and forms part of the agreement governing the Customer’s use of the Services.

Except where this DPA specifically addresses data protection matters, the applicable Terms of Conditions or other governing agreement will continue to apply.

34. Severability

If any provision of this DPA is determined to be invalid, unlawful, or unenforceable, the remaining provisions will remain in effect to the extent permitted by applicable law.

The parties will cooperate in good faith to replace any invalid provision with a valid provision that most closely reflects the original intent.

35. Contact

Questions regarding this Data Processing Agreement or TrackMySquad’s data protection practices may be directed to TrackMySquad through the contact information provided on the TrackMySquad website.

TrackMySquad
Website: https://trackmysquad.com/

Appendix 1 — Description of Processing

Subject Matter of Processing:
Provision of workforce management, time tracking, attendance, productivity monitoring, activity monitoring, reporting, analytics, and related Services.

Duration of Processing:
For the duration of the Customer’s subscription or use of the Services, plus any applicable retention period required by contract, law, security, backup, or legitimate business requirements.

Nature of Processing:
Collection, recording, organization, storage, retrieval, consultation, use, transmission, analysis, reporting, support, maintenance, deletion, and other processing necessary to provide the Services.

Purpose of Processing:

  • Providing the Services;
  • Managing Customer accounts;
  • Managing employee and workforce records;
  • Tracking attendance and working time;
  • Supporting productivity and activity monitoring;
  • Generating reports and analytics;
  • Providing customer support;
  • Maintaining service security;
  • Preventing fraud and abuse;
  • Maintaining and improving service reliability; and
  • Fulfilling contractual and legal obligations.

Categories of Data Subjects may include:

  • Customer account administrators;
  • Employees;
  • Contractors;
  • Workforce members;
  • Authorized users;
  • Customer representatives; and
  • Other individuals whose information the Customer elects to process through the Services.

Categories of Personal Data may include:

  • Identification and contact information;
  • Account information;
  • Authentication information;
  • Device and technical information;
  • IP addresses;
  • Attendance information;
  • Time and timesheet information;
  • Activity and productivity information;
  • Project and task information;
  • Application and website activity;
  • Screenshots where enabled;
  • Schedule and leave information; and
  • Other Personal Data submitted by the Customer through the Services.

Sensitive Data:
The Services are not intended to require the processing of sensitive or special-category Personal Data. Where a Customer elects to process such information, the Customer is responsible for ensuring that the processing is lawful and appropriately protected.

Appendix 2 — Technical and Organizational Security Measures

TrackMySquad maintains reasonable technical and organizational safeguards appropriate to the nature and risks of the processing.

These safeguards may include:

  1. Access Control
    • Role-based access controls;
    • Authentication controls;
    • User access management;
    • Administrative access restrictions; and
    • Periodic review of access permissions where appropriate.
  2. Data Security
    • Appropriate encryption or equivalent safeguards;
    • Secure communications;
    • Protection of stored information;
    • Backup and recovery procedures.
  3. Infrastructure Security
    • Network security controls;
    • System monitoring;
    • Logging;
    • Vulnerability management;
    • Security updates and patches.
  4. Personnel Security
    • Confidentiality obligations;
    • Appropriate access authorization;
    • Security awareness measures;
    • Access removal when personnel no longer require access.
  5. Incident Management
    • Security incident response procedures;
    • Investigation and mitigation procedures;
    • Customer notification procedures where legally required.
  6. Business Continuity
    • Backup procedures;
    • Disaster recovery measures;
    • Service availability and recovery procedures appropriate to the Services.

TrackMySquad may modify its technical and organizational measures over time provided that the overall level of protection is not materially diminished.

Appendix 3 — Subprocessors

TrackMySquad may use third-party Subprocessors to provide infrastructure, hosting, analytics, payment processing, customer support, security, communications, monitoring, and other services necessary to operate the Services.

TrackMySquad will maintain appropriate contractual and operational safeguards for Subprocessors that process Customer Personal Data.

Where required by Applicable Data Protection Law, TrackMySquad will provide appropriate information regarding its Subprocessors and applicable changes.

Document Version: 1.0
Last Updated: September 22, 2026

Scroll to Top