Time by NISS: Data Processing Agreement (DRAFT)

Status: working draft `draft-2026-10`. Not legal advice. Must be reviewed by a solicitor before launch (spec §13, §18.2). This agreement forms part of the Terms of Service between NISS (processor) and the customer (controller). It is intended to meet Article 28 of the UK GDPR.

1. Subject matter and duration

NISS processes personal data to provide Time by NISS for as long as the customer uses it, and then until the data is deleted as set out in section 8.

2. Nature and purpose

NISS hosts, stores and displays staff scheduling data, sends notifications, calculates coverage and labour-cost estimates, and produces exports, all on the customer’s instructions given through the Service.

3. Categories of data and data subjects

Data subjects: the customer's staff and managers.

Data:

• names and work email addresses
• roles and qualifications, with their dates
• shifts, availability and leave
• hourly pay rates, if entered
• absence categories (no free-text or medical detail)

No special category data is required. The customer must not enter health details.

4. NISS’s obligations

NISS will:

1. process data only on documented instructions (the Service’s functions are those instructions);
2. ensure that its staff are bound by confidentiality;
3. apply the security measures in Annex A;
4. use subprocessors only as set out in section 5;
5. help the customer respond to data subject requests (export, correction, erasure tools are built in);
6. notify the customer of a personal data breach without undue delay, and within [48] hours of becoming aware of it;
7. help with DPIAs where reasonably required;
8. delete or return data at the end of the service (section 8);
9. make available information needed to show compliance, and allow reasonable audits on [30] days' notice.

5. Subprocessors

The customer authorises the subprocessors listed at /legal/subprocessors. NISS will give [30] days' notice of new subprocessors, and the customer may object. NISS remains responsible for its subprocessors.

6. International transfers

Where data is transferred outside the UK, NISS will rely on UK adequacy regulations or the ICO International Data Transfer Addendum, plus a transfer risk assessment. [To be completed.]

7. Customer obligations

The customer is responsible for:

• having a lawful basis for the data it enters;
• giving privacy information to its staff;
• the accuracy of that data;
• not entering data the Service doesn’t need.

8. End of processing

The customer can export data at any time, including while the venue is read-only. After a subscription ends, data is deleted after the 30-day read-only and 60-day owner-only periods, or 7 days after a deletion request. Exceptions are billing and audit records NISS must keep by law.

Annex A: security measures

• Encryption: TLS in transit; encryption at rest by the hosting provider.
• Separation: venue data is kept apart by row-level security in the database, as well as by application checks.
• Pay data: restricted to authorised roles at the database layer, and never written to logs.
• Audit: an append-only audit log of changes.
• Least privilege: separate database roles for the application, the background worker and migrations.
• Backups: daily encrypted backups. Recovery point objective: 24 hours or less. Recovery time objective: 8 hours or less. Restore tests are run quarterly.
• Account security: two-step sign-in for owners and managers.
• Rate limiting: limits on sensitive actions.