This data processing agreement is an appendix to the terms and applies when the customer uses AnnoTracker. It meets the requirements of Article 28 of the General Data Protection Regulation (GDPR).
1. Parties and roles
The customer (the company that has an account in AnnoTracker) is the controller. Anno One Corporation Ltd, registration number HE 442910, Larnaca, Cyprus, is the processor and processes personal data on the customer's behalf.
2. What is processed
- Purpose: to provide AnnoTracker – time tracking, follow-up, reports, import and the Chrome extension – and support to the customer.
- Data: name, email address, language, role and permissions, reported time with comments, change log, last log-in, notes and questions about time, and IP addresses in server logs. Also what the customer itself enters about its customers and projects.
- People: the customer's users, people the customer adds without a log-in (for example through import), and contact persons at the customer's customers if the customer enters them.
- Duration: as long as the agreement about AnnoTracker applies, and after that until the data has been deleted under section 9.
The customer should not put special categories of personal data (for example about health) into AnnoTracker.
3. Instructions
We process the personal data only on the customer's documented instructions. The instructions are the terms, this agreement and the choices the customer makes in the service. If we believe an instruction breaks data protection rules, we tell the customer.
4. Confidentiality
The people at our end who have access to the personal data are bound by confidentiality and use it only to provide the service.
5. Security
Our measures include (Article 32):
- all traffic to AnnoTracker is encrypted (https)
- passwords are stored only as one-way hashes, and log-in can be done with passkeys
- each company's data is kept apart, and every database query is limited to the logged-in company
- roles and permissions decide who sees and changes what, and changes to time are logged
- access to the server is by SSH key only, never by password
- the database is backed up every night and the backups are kept for 14 days on the server; extra copies taken before updates are kept for at most 30 days
6. Sub-processors
The customer gives a general authorisation for us to engage sub-processors. We have an agreement with each one that gives the same protection as this agreement. Today:
| Sub-processor | Task | Location |
|---|---|---|
| STRATO AG | Server, database and files | Germany |
| Plus Five Five, Inc. (Resend) | Sending email from AnnoTracker | USA – transfer under the EU Standard Contractual Clauses and the EU–US Data Privacy Framework |
| Microsoft Ireland Operations Limited (Microsoft 365) | The support mailbox (hello@annoone.com) | EU/EEA under Microsoft's terms |
Before we engage a new sub-processor we tell the account owner by email at least 30 days in advance. The customer can object by ending the agreement before the change applies.
7. Helping the customer
We help the customer answer requests from data subjects, for example for access, correction and erasure. Much of this the customer can do in the service: change and deactivate people, and take out reports and exports. We also help with impact assessments and contacts with the supervisory authority when needed.
8. Personal data breaches
If we become aware of a personal data breach affecting the customer's data, we tell the customer without undue delay, and at the latest within 48 hours. We describe what happened, which data is affected and what we are doing about it.
9. When the agreement ends
The customer can take out its data with the service's reports and export before the agreement ends. After that we delete the customer's personal data within 90 days, unless the law requires it to be kept longer. Copies in backups disappear when the backups are pruned.
10. Audits
We give the customer the information needed to show that this agreement is followed. The customer can ask for an audit; it is done at the customer's cost, with reasonable notice and without revealing other customers' data.
11. Contact
Questions about personal data go to hello@annoone.com.