Data Processing Agreement

"Data Protection Law" means the UK GDPR and Data Protection Act 2018, and where applicable Regulation (EU) 2016/679 and implementing laws. "Controller", "Processor", "Data Subject", "Personal Data", "Processing" and "Personal Data Breach" have the meanings given in Data Protection Law.

You are the Controller. We (Africa Procurement Group Ltd (company number 10553435)) are the Processor in respect of Customer Personal Data you submit to TimeSpan — typically data about your employees, technicians, drivers and the customers they serve.

We act as an independent Controller only for our own account and billing records, security logs and website analytics. That processing is described in our Privacy Policy, not here.

We will:

(a) Process only on your instructions. We process Customer Personal Data only on your documented instructions, which comprise this DPA, the Terms, and your use of the Service's features. We will tell you if, in our opinion, an instruction infringes Data Protection Law. If we are required by law to process otherwise, we will inform you first unless that law prohibits it.

(b) Impose confidentiality. Personnel authorised to process Customer Personal Data are bound by written confidentiality obligations and are granted access strictly on a need-to-know basis.

(c) Secure the data. We implement and maintain the technical and organisational measures in Annex 2, appropriate to the risk, as required by Article 32.

(d) Control sub-processors. See clause 3.

(e) Assist with Data Subject rights. Taking account of the nature of the processing, we will assist you by appropriate technical and organisational measures, insofar as possible, to respond to requests to exercise rights of access, rectification, erasure, restriction, portability and objection. The Service's export and deletion features allow you to satisfy most requests directly. If we receive a request relating to your data, we will not respond to it substantively but will refer the Data Subject to you without undue delay.

(f) Assist with security, breach and impact assessments. We will assist you in complying with Articles 32 to 36, taking into account the nature of processing and the information available to us.

(g) Notify Personal Data Breaches. We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will describe, to the extent known, the nature of the breach, the categories and approximate volume of data and Data Subjects affected, the likely consequences, and the measures taken or proposed. We will provide further information as it becomes available. It is your responsibility as Controller to notify the supervisory authority and Data Subjects where required.

(h) Delete or return. On termination, and at your choice, we will delete or return Customer Personal Data. Absent a written instruction to return, we delete it within 30 days of termination, except where retention is required by law. Backups containing the data are retained for no longer than the backup retention period in Annex 2 and are then destroyed on rotation.

(i) Demonstrate compliance. We will make available information reasonably necessary to demonstrate compliance with Article 28 and allow for and contribute to audits under clause 5.

You give us general written authorisation to engage sub-processors to provide the Service. Our current sub-processors are listed at /legal/subprocessors, which forms Annex 3 to this DPA.

We impose on each sub-processor, by written contract, data protection obligations no less protective than those in this DPA, and we remain fully liable to you for their performance.

We will give at least 30 days' notice before adding or replacing a sub-processor, by updating that page and notifying account owners who have subscribed to notifications. You may object on reasonable data protection grounds within that period. If we cannot provide a reasonable alternative, you may terminate the affected part of the Service without penalty and receive a pro-rata refund of prepaid fees.

Customer Personal Data is hosted in the region selected for your project. Some sub-processors may process data outside the UK or EEA. Where we transfer Customer Personal Data to a country without an adequacy decision, we do so on the basis of appropriate safeguards under Article 46 — the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses for UK transfers, and the EU Standard Contractual Clauses (Module Two, controller to processor) for EEA transfers — together with a transfer risk assessment and supplementary measures such as encryption in transit and at rest.

Where the EU SCCs apply, they are incorporated by reference: Annex 1 below populates their Annex I, Annex 2 populates their Annex II, and the governing law and forum are those of England and Wales to the extent the SCCs permit.

On reasonable written notice, no more than once in any 12-month period (unless required by a supervisory authority or following a Personal Data Breach), we will provide information reasonably necessary to demonstrate compliance. Where a third-party audit report or certification is available, we may satisfy this obligation by providing it. Any on-site audit must be at your cost, during business hours, subject to confidentiality, and conducted so as not to disrupt the Service or the data of other customers.

Each party's liability under this DPA is subject to the limitations and exclusions in clause 13 of the Terms, except where Data Protection Law does not permit that limitation. Nothing in this DPA affects a Data Subject's rights under Article 82.

Subject matter: provision of the TimeSpan scheduling and routing optimisation platform.

Duration: the term of your subscription, plus the deletion window in clause 2(h).

Nature and purpose: hosting, storage, structuring, computation and retrieval of workforce and job data in order to generate proposed schedules and routes; provision of dashboards, exports, webhooks and AI-assisted recommendations; support, security monitoring and backup.

Categories of Data Subject: your employees, contractors, technicians and drivers; your personnel who hold TimeSpan user accounts; and, where you supply it, the customers or sites those personnel are scheduled to attend.

Types of Personal Data: names and identifiers; work contact details; job roles, skills, qualifications and certifications; employment attributes relevant to scheduling such as contracted hours, availability, shift preferences, leave and rest requirements; assignment and timesheet records; site or delivery addresses and geographic coordinates; route and sequence data; and account credentials, API key metadata and audit logs for your users.

Access control and tenancy isolation. Every application table enforces PostgreSQL row-level security, so a request can only reach rows belonging to the authenticated user or their organisation. Privileged database functions run with a fixed search path and fail closed when a caller cannot be verified. Administrative access is restricted to an explicit allowlist.

Authentication. User authentication is delegated to a managed identity provider with password hashing and session management. API access uses per-key secrets stored only as hashes, which can be revoked instantly, with revocation taking effect on the next request.

Two-factor authentication. Authenticator-app (TOTP) second factors are available to all users and required for administrator accounts, limiting the impact of a stolen password.

Data subject tooling. Controllers can export and permanently erase account data self-serve, so most access and erasure requests can be satisfied without our involvement.

Encryption. Data is encrypted in transit with TLS, and at rest by the hosting provider. Off-site backups are encrypted before leaving the platform with keys held separately from the backup store.

Resilience and backup. The database is backed up by the hosting platform, and in addition an encrypted logical backup is written nightly to storage held with a different vendor and under a separate credential set, so that compromise of the primary platform does not compromise the backups. Restores are tested periodically.

Rate limiting and abuse containment. API endpoints apply per-caller and per-IP rate limits and per-plan usage allowances, so that a compromised or runaway client is contained rather than able to exhaust platform capacity.

Logging and monitoring. Application errors and security-relevant events are captured, alerted on, and retained for investigation. Access to production systems is limited to personnel who need it.

Secure development. Source code is held in a private repository with access limited to authorised personnel. Secrets are held in the deployment platform's encrypted environment store and never committed to source control.

The current detailed position is published on our security page. We may update these measures provided the level of protection is not reduced.

The authorised sub-processor list is maintained at /legal/subprocessors and forms part of this DPA.