Data Processing Addendum (DPA)

TC-LEGAL-003·Privacy

Data Processing Addendum (DPA) — TimeCampus

Document ID: TC-LEGAL-003 Title: Data Processing Addendum (DPA) Version: 1.1 Last updated: 2026-10-24 Publisher: Timecampus Technologies Pvt. Ltd. (Burdenoff Group) Canonical location: https://burdenoff.com/contracts/timecampus/TC-LEGAL-003 Burdenoff Group Contract Registry — root at https://burdenoff.com/contracts (one subgroup per product). The contracts referenced in this document belong to the TimeCampus subgroup at https://burdenoff.com/contracts/timecampus/. Every referenced contract is identified by its Document ID (TC-LEGAL-### / TC-PRICING-###) and incorporated by reference.

Status: Published v1.1 — effective 2026-10-24. Reviewed against the production platform and approved for publication by the founder (India jurisdiction); outside-counsel review checkpoints are tracked in TC-LEGAL-REG. Parties: Timecampus Technologies Pvt. Ltd. (CIN U72900TN2019PTC131007, PAN AAHCT4604P, registered at "VISWAM", Plot No. 43, Veeramani Nagar, 2nd Cross Street, Nanmangalam, Chennai - 600117, India) ("Timecampus", "Processor") and the Customer identified in the applicable Order Form ("Customer", "Controller" / "Data Fiduciary"). Where international invoicing applies, Algoshred Technologies Corp (Delaware, USA; EIN 35-2845680) ("Algoshred US") is bound by this DPA on equivalent terms in respect of any Personal Data it processes incidental to payment processing. Effective Date: the later of (a) the Effective Date of the Order Form and (b) the date this DPA is executed. Relationship to MSA: This DPA forms part of, and is subject to, the Master SaaS Agreement (the "MSA"). In case of conflict on Personal Data matters, this DPA prevails. Data Protection Officer / Grievance Officer (DPDP Act): Vignesh T.V. (legal name: Tinnaneri Venkatanarayanan Vignesh), Founder, CEO & CTO of Timecampus — contactable at contact@timecampus.com.

Why this DPA matters for TimeCampus. TimeCampus is a time-intelligence platform: Customer's use of it inherently involves processing the Personal Data of employees, team members and contractors at scale — including captured app/email/browsing activity, calendar and meeting data, location/geofence events, time entries, expense inputs, bank and tax identifiers, and (where Customer enables it) export confirmations. This DPA therefore applies to essentially all Customer use and is treated as executed wherever a Customer processes such data.

1. Scope and roles

1.1 This DPA applies whenever Timecampus processes Personal Data on behalf of the Customer in connection with the Service.

1.2 For the purposes of:

  • the Digital Personal Data Protection Act, 2023 ("DPDP Act") — Customer is the Data Fiduciary and Timecampus is the Data Processor.
  • the Information Technology Act, 2000 and the Reasonable Security Practices and Procedures and Sensitive Personal Data or Information Rules, 2011 ("SPDI Rules") — Customer is the "body corporate" responsible for collection and Timecampus provides services.
  • the EU/UK GDPR, where Customer data subjects are located in the EEA/UK — Customer is the Controller and Timecampus is the Processor.
  • the California Consumer Privacy Act / CPRA, where applicable — Customer is the Business and Timecampus is a Service Provider.
  • other applicable laws (PDPA Singapore, PIPL China subject to separate review, LGPD Brazil) — equivalent role-mapping applies.

1.3 Timecampus will process Personal Data only on documented instructions from Customer, which are: (a) the MSA and this DPA; (b) the Customer's configuration of the Service; (c) Order Form; and (d) any other instructions provided in writing and agreed by Timecampus. Timecampus will inform Customer if it considers an instruction infringes applicable data protection law.

1.4 Operational processing. Personal Data is managed and processed by Timecampus (as the contracting Processor) using personnel of Burdenoff Consultancy Services Pvt. Ltd. ("Burdenoff Consultancy"), which acts as the Burdenoff Group's manpower house and employs the engineering, support, security, and operations personnel who deliver the Service on Timecampus's behalf. Burdenoff Consultancy personnel act under Timecampus's instructions and intra-group confidentiality, access-control, and data-protection arrangements, and are treated as Timecampus's personnel for the purposes of this DPA. Timecampus remains the Customer's contractual Processor and is fully responsible for their acts and omissions in connection with Personal Data. Storage of Personal Data, the underlying compute that processes it, and incident-relevant logging are performed on managed cloud services (Amazon Web Services in the ap-south-1 Mumbai region for all backend and frontend hosting, with Cloudflare at the edge) acting as Subprocessors and listed in Annex 3.

1.5 Shared platform quotas. Customer acknowledges that Timecampus operates a shared technical platform across the Burdenoff Group's products and that certain platform quotas and resources (storage, compute, infrastructure, observability) are shared. Tenant isolation, access controls, and security commitments in this DPA and the Security Exhibit apply regardless of resource sharing, and Timecampus shall not allow Customer Personal Data to be accessed by an unauthorised party or another tenant. Heightened access controls apply to expense, document and monitored-activity data.

1.6 Controller responsibilities for team data. Customer, as Controller / Data Fiduciary, is responsible for the lawful basis, notices and consents for processing employee, team member and worker Personal Data; for lawful use of monitored time and activity data and correct worker classification; and for any deployer obligations relating to automated time-and-activity analytics tools (e.g., monitoring-transparency focus-score assessment and team member notice under applicable employee-monitoring transparency law, the EU AI Act for high-risk automated time-and-activity analytics, or applicable state laws). Timecampus is the processor and provides reasonable assistance as set out in §4.

2. Definitions

Capitalised terms not defined here have the meaning in the MSA, the DPDP Act, the SPDI Rules, or the GDPR (as the case requires).

  • "Personal Data" — any data relating to an identified or identifiable natural person, including "personal data" under the DPDP Act and "sensitive personal data or information" under the SPDI Rules.
  • "Processing" — has the meaning in the DPDP Act / GDPR.
  • "Subprocessor" — any third party (including Timecampus Affiliates) engaged by Timecampus to process Personal Data.
  • "Personal Data Breach" — a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
  • "Restricted Transfer" — a transfer of Personal Data to a country that, in the absence of safeguards, would breach applicable data protection law.

3. Processing details

The subject-matter, nature, purpose, duration, types of Personal Data and categories of data subjects are set out in Annex 1 (Processing Details).

4. Timecampus obligations

Timecampus shall:

4.1 Process Personal Data only on Customer's documented instructions and for the purposes set out in Annex 1.

4.2 Ensure that personnel authorised to process Personal Data are bound by appropriate confidentiality obligations.

4.3 Implement and maintain the technical and organisational security measures set out in Annex 2 (Technical and Organisational Measures), taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks to data subjects — with heightened controls for sensitive team data (expense and billing, documents, export confirmations).

4.4 Assist Customer, taking into account the nature of processing, in fulfilling Customer's obligations to respond to data principal / data subject requests under DPDP, GDPR or other applicable law (Sections 11–14 DPDP; Articles 12–22 GDPR), to the extent practicable through Service features or reasonable assistance. Where a request comes from an employee, team member, contractor or team member, Timecampus will route it to Customer as the Controller.

4.5 Assist Customer with data protection impact assessments (large-scale time-and-activity monitoring is DPIA-prone), prior consultations with regulators (e.g., the Data Protection Board of India), and security and breach notification obligations.

4.6 Make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, including certifications and audit summaries (see Section 8).

4.7 At Customer's choice, delete or return all Personal Data after the end of the Subscription Term in accordance with MSA §5.5, unless retention is required by law or instructed by Customer (e.g., statutory employment/expense and billing/tax retention), in which case Timecampus will isolate and protect such Personal Data.

4.8 Notify Customer without undue delay, and in any event within 72 hours of becoming aware, of any Personal Data Breach affecting Customer's Personal Data. Notification will include the information specified by Section 8.6 of the DPDP Act / Article 33(3) GDPR to the extent then known, and updates as further information becomes available.

4.9 Maintain records of processing activities under Article 30(2) GDPR / equivalent under DPDP.

4.10 Not use Customer Personal Data to train, fine-tune or evaluate any machine-learning or large-language model, and not build behavioural profiles of individual workers from Customer Data.

5. Customer obligations

Customer shall:

5.1 Be solely responsible for the accuracy, quality, legality and means of collection of Personal Data, and for ensuring it has all rights, consents and notices required (including under DPDP Act Sections 5–7, GDPR Articles 6–9, the SPDI Rules, and applicable employment-data law) to provide Personal Data to Timecampus for processing — in particular for team-member, time, expense and monitored-activity data.

5.2 Configure the Service appropriately (RBAC, SSO, audit log retention, access reviews) and not introduce categories of Personal Data outside the scope of Annex 1 — including special-category data — without first updating Annex 1 by written notice and obtaining any Order-Form authorisation.

5.3 Provide notices to data principals (employees, team members, contractors, team members) about Timecampus acting as Processor and any cross-border transfers, and deploy any team member fair-processing notice that applicable law requires.

5.4 Not instruct Timecampus to process Personal Data in violation of applicable law, including using AI-assisted features for automated employment decisions without the human review, consents and notices the law requires.

5.5 Discharge any deployer obligations for automated employment-decision tools (monitoring-transparency focus-score assessment, team member notice, AI transparency) under applicable law.

6. Subprocessors

6.1 Customer provides general authorisation for Timecampus to engage Subprocessors. The current list is in Annex 3 (Subprocessors).

6.2 Timecampus shall (a) impose on each Subprocessor data protection obligations no less protective than this DPA, and (b) remain liable for the Subprocessor's acts and omissions in connection with Personal Data.

6.3 Timecampus will notify Customer of intended additions or replacements of Subprocessors at least 30 days in advance (by updating the public Subprocessor list and email to the Customer's privacy contact, where provided). Customer may object on reasonable data-protection grounds within 14 days; the parties will discuss a workaround, failing which Customer may terminate the affected Service by written notice and receive a pro-rata refund of prepaid, unused Fees.

6.4 Payroll/accounting export & integration providers are engaged as Subprocessors only when Customer enables the relevant integration; they are added to Annex 3 at enablement and process only the data needed for the exports Customer commissions.

7. International transfers

7.1 Where Timecampus or its Subprocessors transfer Personal Data across borders, Timecampus shall ensure an appropriate transfer mechanism applies, including:

  • the EU Standard Contractual Clauses (Module 2: Controller-to-Processor) for transfers from the EEA, and the UK International Data Transfer Addendum, incorporated into this DPA by reference and deemed completed with the parties as data exporter (Customer) and data importer (Timecampus), Clause 7 docking optional, Clause 9 Option 2 (general authorisation, 30 days), Clause 11 redress not enabled, Clause 17 Option 1 (law of an EU Member State to be specified by Customer; default: Ireland), Clause 18 forum: courts of that EU Member State;
  • the Indian DPDP Act cross-border rules including transfers to countries not restricted under Section 16 of the DPDP Act;
  • for sensitive personal data under the SPDI Rules, transfers only to entities ensuring the "same level of data protection" as the SPDI Rules require, and only with prior consent or where necessary for performance of a lawful contract.

7.2 Where neither party qualifies for SCCs (e.g., transfer originates in India and lands in India), no SCCs are required, and Sections 4–8 of this DPA govern the transfer.

7.3 Team-data localisation. Where Customer requires employee or other team data to remain in a specific country, that localisation is configured on the Order Form and Timecampus will store the relevant Personal Data in the agreed region.

8. Audits

8.1 Timecampus makes available to Customer (a) the most recent third-party audit report or certification (e.g., ISO 27001, SOC 2 Type II — where obtained), (b) the Security Exhibit, (c) Annex 2 of this DPA, and (d) responses to a standard security questionnaire (SIG / CAIQ).

8.2 If, after reviewing the materials in 8.1, Customer reasonably requires further audit, Customer may request, no more than once per 12-month period (except in case of a Personal Data Breach or where required by a competent authority), an audit by a mutually agreed independent third-party auditor under reasonable confidentiality terms, at Customer's cost, during business hours, with at least 30 days' written notice, and limited to controls relevant to the Service. Timecampus may redact information confidential to other customers, security-sensitive details, and trade secrets.

9. DPDP Act–specific provisions

9.1 Timecampus acknowledges its obligations as a Data Processor under Section 8(2) of the DPDP Act, including processing only as authorised, ensuring confidentiality, security safeguards under Section 8(5), assistance with data principal requests under Sections 11–14, and breach notification.

9.2 Customer remains accountable as the Data Fiduciary, including for grievance redressal (Section 8(10)) and, if applicable, Significant Data Fiduciary obligations (Section 10) — which large employers managing substantial volumes of employee Personal Data may attract.

9.3 Timecampus's role does not extend to direct interaction with data principals except as Customer instructs through the Service.

9.4 Notice of any contact from the Data Protection Board of India or other regulator about Customer's Personal Data will be provided to Customer without undue delay, unless prohibited by law.

10. Liability

The liability provisions of the MSA (including caps and exclusions) apply to claims under or relating to this DPA, except where applicable law (including the DPDP Act and GDPR Article 82) imposes mandatory direct liability to data subjects/principals, in which case those provisions apply.

11. Term, conflict, severability

11.1 This DPA remains in force for the duration of the MSA and for so long as Timecampus processes Personal Data.

11.2 If any provision is invalid under any applicable law, it is severed and the remainder remains effective.

11.3 In case of conflict between this DPA and the SCCs/UK Addendum on cross-border transfers of EEA/UK data, the SCCs/UK Addendum prevail.

Annexes

  • Annex 1 — Processing Details (TC-LEGAL-003A)
  • Annex 2 — Technical and Organisational Measures (TC-LEGAL-003B)
  • Annex 3 — Subprocessors (TC-LEGAL-003C)
  • Annex 4 — DPIA Template (TC-LEGAL-003D) — APPROVED v1.0, effective 2026-10-24; provided to Customers under §4.5

Reference and incorporation

All Burdenoff Group contracts, addenda, exhibits, policies and registers referenced in this document are identified by their Document ID (TC-LEGAL-### or TC-PRICING-###) and are published at https://burdenoff.com/contracts. Each such referenced document is incorporated into this document by reference. The version of a referenced document that applies is the version published at https://burdenoff.com/contracts as at the Effective Date of the applicable Order Form (or, where no Order Form exists, the version current at the date of acceptance), unless an executed Order Form specifies a frozen version.

Back to TimeCampus Contracts