Data Processing Agreement (DPA)

between the Customer (controller) and Eray Yilmaz, trading as InClox, Europaring 90, 53757 Sankt Augustin, Germany (processor, "InClox").

1. Subject matter and duration

1.1 InClox processes personal data on behalf of the Customer in order to provide the Service under the Terms of Service. Details (data, data subjects, purposes) are in Annex 1.
1.2 This DPA applies for as long as InClox processes personal data for the Customer.

2. Instructions

2.1 InClox processes personal data only on documented instructions of the Customer, including with regard to transfers to third countries, unless EU or Member State law requires otherwise; in that case InClox informs the Customer beforehand unless the law prohibits this (Art. 28(3)(a) GDPR).
2.2 The Terms, this DPA and the Customer's settings and use of the Service (e.g. screenshot interval, enabled functions, deletions) are the Customer's complete instructions. Further instructions must be in text form.
2.3 InClox informs the Customer without delay if it believes an instruction infringes data protection law and may suspend it until confirmed or changed.

3. Customer's responsibility

The Customer is responsible for the lawfulness of the processing, in particular for the legal basis, informing team members, involving works councils and carrying out a data protection impact assessment where required (see section 6 of the Terms).

4. Confidentiality

InClox ensures that persons authorised to process the data are bound to confidentiality (Art. 28(3)(b) GDPR). InClox is currently operated by its owner; any staff or freelancers will be bound in writing before receiving access.

5. Security

5.1 InClox implements the technical and organisational measures in Annex 2 (Art. 32 GDPR).
5.2 InClox may adapt the measures to technical progress as long as the level of protection is not reduced.

6. Sub-processors

6.1 The Customer gives general authorisation to engage sub-processors. The sub-processors approved on conclusion are listed in Annex 3.
6.2 InClox informs the Customer of any intended addition or replacement at least 30 days in advance by email or in the app. The Customer may object on reasonable data-protection grounds within this period. If no solution is found, the Customer may terminate the affected Service with effect from the change.
6.3 InClox imposes on each sub-processor data protection obligations equivalent to this DPA and remains liable to the Customer for its sub-processors (Art. 28(4) GDPR).

7. Transfers outside the EU/EEA

7.1 InClox stores the database and file storage in the EU (Frankfurt). Transfers to or access from third countries by sub-processors take place only under Chapter V GDPR (adequacy decision, in particular the EU-US Data Privacy Framework where the recipient is certified, or EU Standard Contractual Clauses).
7.2 Customers outside the EU/EEA: where the Customer is established in a third country and not subject to the GDPR, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Four (processor to controller), are incorporated by reference for the transfer of personal data from InClox to the Customer. For Clause 17 the parties choose German law; for Clause 18 the courts of Germany have jurisdiction. Clause 7 (docking clause) does not apply. Annex I of the Clauses is completed by Annex 1 of this DPA.

8. Assistance

8.1 InClox supports the Customer with appropriate technical and organisational measures in responding to data subject requests (Chapter III GDPR). Requests addressed to InClox are forwarded to the Customer without delay; InClox does not respond itself except on instruction.
8.2 InClox assists the Customer with Art. 32–36 GDPR (security, breach notification, impact assessment, prior consultation), taking into account the information available to it.
8.3 InClox notifies the Customer without undue delay, and in any case within 48 hours after becoming aware of a personal data breach affecting the Customer's data, with the information required under Art. 33(3) GDPR as far as available.

9. Audits

9.1 InClox provides the Customer with all information necessary to demonstrate compliance with Art. 28 GDPR.
9.2 The Customer may carry out audits, including inspections, itself or through an independent auditor bound to confidentiality, with at least 30 days' notice, during normal business hours and without disturbing operations, generally no more than once per year unless there is a specific reason (e.g. a data breach). InClox may first offer written information, current certificates or audit reports of its sub-processors. The Customer bears its own costs; InClox may charge reasonable costs for time spent beyond one business day per year.

10. Deletion and return

10.1 After the end of the contract InClox enables the Customer to export its data for 30 days and then deletes all personal data processed for the Customer, unless EU or Member State law requires storage (Art. 28(3)(g) GDPR).
10.2 Backups are overwritten in the normal backup cycle within a further [30] days.
10.3 Screenshots are deleted automatically after the retention period set in the workspace (default 90 days) also during the contract.

11. Liability, precedence

11.1 Liability is governed by Art. 82 GDPR and otherwise by section 11 of the Terms.
11.2 In case of conflict, this DPA takes precedence over the Terms with regard to data protection.

Annex 1 — Details of the processing

Annex 2 — Technical and organisational measures (Art. 32 GDPR)

Confidentiality

• Data centre security: provided by the hosting sub-processors (AWS for Supabase; Netlify), which hold ISO 27001 / SOC 2 certifications.
• Access control: login with email/password (hash stored, never plain text), role model (administrator, manager, team member), every database table protected by row-level security so that each workspace only sees its own data (tenant isolation).
• Screenshots in a non-public storage bucket; viewing only by authorised users via short-lived signed links.
• Administrative access to production systems only by the owner, with two-factor authentication on Supabase, Netlify, Stripe, GitHub and the email account.
• Secrets (API keys) stored in protected environment variables, not in source code.
• Separation: production and test data are kept in separate projects.

Integrity

• Encryption in transit with TLS 1.2 or higher for all connections between apps, browser and servers.
• Changes to tracking data are logged with the role that made them.
• Code changes via version control (Git) with history.

Availability and resilience

• Daily backups of the database by the hosting provider; restore tested at least once per year.
• Encryption at rest (AES-256) of database and storage by the hosting provider.
• The apps buffer recorded time locally if the connection drops and synchronise later.

Regular review

• Security updates of dependencies at least monthly; critical vulnerabilities without delay.
• Review of these measures at least once per year and after significant changes.
• Incident process: detection, assessment, notification of the Customer within 48 hours (section 8.3).

Privacy by design and default

• Recording only during a session started by the team member, with a visible timer; no hidden mode, no keylogging.
• Activity is measured only as idle time, not as content.
• Screenshot interval and retention configurable by the Customer; automatic deletion after the retention period.
• Team members can view their own data in the portal.

Annex 3 — Approved sub-processors

Not a sub-processor: Stripe (Stripe Payments Europe, Ltd., Ireland / Stripe, Inc., USA) processes only the Customer's billing data, for which InClox is controller; Stripe does not receive team-member data.