Draft for legal review. Fill in the hosting details in site/config.json and have a lawyer review this agreement before launch, then remove this note.
1. Roles
This Data Processing Agreement (“DPA”) is between the customer (“you”) and Kelnova Labs (“we”, “us”), the company that makes Smart Punch, and forms part of the Terms of Service. For personal information about your employees and other people that you or your users put into Smart Punch (“Employee Data”), you are the organization responsible under BC’s Personal Information Protection Act and, where it applies, Canada’s Personal Information Protection and Electronic Documents Act. We handle Employee Data on your behalf as your service provider.
2. Using Employee Data only for you
- We process Employee Data only to provide, secure and support Smart Punch for you, as described in the Terms and as you direct through the app.
- We don’t sell Employee Data, use it for advertising, or combine it with data from other customers, except in a form that no longer identifies anyone, to operate and improve the service.
- If we believe an instruction from you breaks the law, we will tell you.
3. Our people
Only staff who need access to support or run the service may access Employee Data, and they are bound by confidentiality. Our support console is designed so support staff can help with sign-in problems without seeing payroll data. Every support action is recorded with a reason and shows in your audit log.
4. Security
We maintain safeguards appropriate to payroll information, including:
- encryption of Social Insurance Numbers and bank account numbers at rest (AES-256-GCM), and HTTPS for all connections;
- passwords stored with bcrypt, account lockout after repeated failures, and sign-out of other devices when a password changes;
- access limited by role, with only owners able to view full SINs or change bank details, and an audit log of sensitive actions;
- two-step sign-in for Smart Punch’s support staff;
- daily backups, kept for 30 days; and
- for time clock location checks, storing only the result and distance, never the location.
5. Subprocessors
You agree that we may use the following service providers (“subprocessors”). Each is bound by a written contract with protections at least as strong as this DPA.
| Subprocessor | Purpose | Location |
|---|---|---|
| our hosting provider | Hosting, database and backups | the region we confirm in writing on request |
| xAI LLC (Grok), only when the owner turns the optional assistant model on | AI model for the optional assistant. Used only when someone uses the assistant, and receives only the details needed to answer or prepare the change they asked for (never SINs, addresses, contact details or bank details) | United States |
We will give you at least 30 days’ notice before adding or replacing a subprocessor. If you object on reasonable privacy grounds and we can’t address your concern, you may end your subscription and receive a prorated refund of prepaid fees.
6. Where data is stored
Employee Data is stored in the region we confirm in writing on request. Information handled by a subprocessor outside Canada may be accessible to that country’s courts and authorities. You are responsible for telling your employees about this where the law requires.
7. Helping you with requests
If an employee asks us for access to or correction of their information, we’ll send the request to you rather than answer it ourselves, unless the law requires otherwise. We’ll help you respond, for example by exporting the records you need. Most information can be viewed, corrected and exported directly in Smart Punch.
8. Security incidents
If we become aware of unauthorized access to, or loss of, Employee Data in our care, we will tell you without undue delay, and in any case within 72 hours of confirming it. We’ll tell you what happened, what information was involved, what we are doing about it, and how we can help you meet any duty you have to notify employees or regulators.
9. Requests from authorities
If a government or court asks us for Employee Data, we will refer it to you where we can, disclose only what we are legally required to, and tell you about the request unless the law forbids it.
10. When the agreement ends
You can export Employee Data for 60 days after your subscription ends. We then delete it from the live service within a further 30 days and from backups within 30 days after that, unless the law requires us to keep it. Keeping payroll records for as long as employment and tax laws require is your responsibility.
11. Checking our compliance
On reasonable request, no more than once a year, we will answer written questions about our security and privacy practices and provide relevant documents. Any further review must be agreed in advance and kept confidential.
12. Liability
The limits on liability in the Terms of Service apply to this DPA.
Contact
Privacy Officer, Kelnova Labs, Kelowna, British Columbia. Email the form on our Contact page.