This DPA is incorporated into and forms part of the AttendIQ Terms of Service.
Terms used but not defined here have the meanings given in the Terms of Service. "UK GDPR" means the UK General Data Protection Regulation as it forms part of UK law by virtue of the European Union (Withdrawal) Act 2018. "Personal Data", "Controller", "Processor", "Data Subject", "Processing", and "Supervisory Authority" have the meanings given in the UK GDPR.
AttendIQ processes personal data on behalf of the Customer for the purpose of providing the platform described in the Terms of Service.
Processing continues for the duration of the Terms of Service and until all personal data is deleted or returned in accordance with clause 7 below.
Storage, retrieval, transmission, display, and deletion of personal data via the AttendIQ platform and its supporting infrastructure.
Workers, subcontractors, site visitors, and other individuals whose records are uploaded to or created within the platform by the Customer.
Name, contact details, date of birth, National Insurance number, employment details, qualification and card records, right to work documentation, attendance and clock-in records, photographic identity, and any other data the Customer uploads to the platform.
Where the Customer uploads data falling under Article 9 UK GDPR (such as health surveillance records or drug and alcohol test results), the Customer is responsible for ensuring it has an appropriate lawful basis and condition for processing that data. AttendIQ stores such data with additional technical safeguards including column-level encryption.
AttendIQ will:
AttendIQ implements technical and organisational measures appropriate to the risk, including:
AttendIQ may update these measures from time to time provided the overall level of protection is not materially reduced.
The Customer grants AttendIQ general authorisation to engage sub-processors. A current list of sub-processors is available at attendiq.co.uk/sub-processors.
AttendIQ will give at least 14 days' notice of any material change to its sub-processor arrangements (by updating the sub-processors page and notifying admin users by email). The Customer may object in writing within that period. If AttendIQ cannot accommodate a reasonable objection, the Customer may terminate the agreement without penalty.
AttendIQ imposes data protection obligations on sub-processors equivalent to those in this DPA.
AttendIQ will notify the Customer without undue delay (and in any event within 72 hours where feasible) after becoming aware of a personal data breach affecting Customer data. Notification will include: the nature of the breach, categories and approximate number of data subjects and records affected, likely consequences, and measures taken or proposed. Where information is not available at the time of initial notification, AttendIQ will provide it as soon as reasonably practicable.
On termination of the Terms of Service, AttendIQ will, at the Customer's written request made within 30 days of termination, either return or securely delete all personal data processed on the Customer's behalf. After 30 days, AttendIQ may delete the data. Certain data may be retained for longer where required by applicable law, in which case AttendIQ will notify the Customer.
AttendIQ stores all Customer personal data in the UK or EEA. Where any sub-processor is located outside the UK or EEA, AttendIQ ensures appropriate transfer safeguards are in place (such as standard contractual clauses or an adequacy decision).
Questions about this DPA should be directed to privacy@attendiq.co.uk.