Annex 1 — Processing Details

Document ID: TC-LEGAL-003A Title: DPA Annex 1 — Processing Details Version: 1.1 Last updated: 2026-10-24 Publisher: Timecampus Technologies Pvt. Ltd. (Burdenoff Group) Canonical location: https://burdenoff.com/contracts/timecampus/TC-LEGAL-003A Burdenoff Group Contract Registry — root at https://burdenoff.com/contracts (one subgroup per product). The contracts referenced in this document belong to the TimeCampus subgroup at https://burdenoff.com/contracts/timecampus/. Every referenced contract is identified by its Document ID (TC-LEGAL-### / TC-PRICING-###) and incorporated by reference.

A. Subject-matter and duration

• Subject-matter: provision of the TimeCampus time-intelligence platform (unified time capture and timeline, projects and tasks, time entries and timesheets, meetings, focus and productivity, expenses, work patterns, location/geofence, billable projects and client portals, team analytics) to Customer.
• Duration: for the duration of the Subscription Term and any retention period under MSA §5.5 / DPA §4.7 (including statutory time-and-attendance / expense / tax retention Customer instructs).

B. Nature and purpose of processing

Timecampus processes Personal Data to:

• authenticate users and manage tenants, roles and access;
• capture and categorise activity across connected tools and assemble the unified timeline (time entries, app/email usage, calendar/meeting events, browsing categories) where Customer enables capture;
• run time-and-project workflows (projects, tasks, time entries, time approvals, resource plans, client portals, billable-time logs and invoices);
• deliver focus and productivity features (focus/pomodoro sessions, focus goals and plans, focus-score values, work-pattern trends, productivity reports);
• run core time operations (member setup/removal, expense capture, time-and-attendance, leave, work-pattern reviews);
• store and serve documents and receipts (expense receipts, contracts, supporting files);
• relay billable-time and expense exports to payroll/accounting providers Customer enables and store the export records Customer commissions;
• provide AI-assisted categorisation, summarisation and recommendations (assistive only; no autonomous decisions about individuals);
• deliver internal communications, notifications and channel events configured by Customer;
• generate audit logs, usage telemetry and analytics (aggregate-by-default team views);
• provide customer support and respond to data principal requests;
• detect and prevent fraud, abuse and security incidents;
• comply with legal obligations.

C. Categories of data subjects

• Customer's Authorized Users, administrators (time-ops admins, project managers, expense approvers), and managers.
• Team members whose time and activity are tracked in Customer's workspace.
• Contractors and collaborators assigned to Customer's billable projects.
• Clients of Customer who access shared project/time data through a client portal.
• References, emergency contacts and other individuals mentioned within Customer Data, to the extent Customer provides them.

D. Categories of Personal Data

Category	Examples
Identification & contact	Name, work and personal email, username, profile photo, phone, address
Account & authentication	Password hash (where local auth used), SSO subject ID, MFA factors
Authorisation	Roles, tenant memberships, RBAC assignments, manager relationships
Time entries & timesheets	Tracked time entries, durations, billable/non-billable flags, project and task assignments, approval status
Captured activity & usage	Application-usage records, email-time entries, browsing-category data, calendar/meeting metadata, UI-session activity — captured only where Customer and the individual enable capture
Meetings	Meeting metadata, participants, durations, action items, meeting-cost analytics
Focus & work patterns	Focus/pomodoro sessions and settings, focus goals and plans, focus-score values, work-pattern trends, productivity reports
Expenses & financial inputs	Expense amounts and categories, receipts, reimbursable-cost data, billable rates, and (where the Customer enters them for export) bank-account or tax identifiers (PAN/equivalent)
Time, attendance & leave	Clock-in/out records, schedules, geo/IP check-in metadata and geofence events (where Customer and the individual enable it), leave balances and applications
Billable projects & client portals	Project and client records, contractor/collaborator assignments, rate cards, billable-time logs, milestones, invoices and payment-status records, client-portal access records
Device & connection	IP address, user agent, OS, geolocation (city-level), device metadata
Product analytics	Pages visited, features used, navigation, notification interactions, AI-assist metadata
Content & documents	Expense receipts, contracts, uploaded files, communications and notes
Billing	Billing contact, billing address, GSTIN/PAN (Indian customers), VAT ID, tokenised card identifier (actual card data held by payment processor)
Support	Support ticket content, screen recordings (only if shared), call transcripts

E. Sensitive personal data / Special categories

Timecampus does not require Customer to upload "sensitive personal data or information" under the SPDI Rules or special-category personal data under Article 9 GDPR. Customer shall not upload, and shall instruct Authorized Users not to upload, such categories (health data, biometric IDs, Aadhaar numbers, religion, caste, political opinions, sexual orientation, trade-union membership, or criminal-record data) unless expressly authorised under an Order Form with appropriate additional controls and a lawful basis. Because TimeCampus may capture activity, app/email-usage and location/geofence data where Customer enables those features, Customer is responsible for providing employee-monitoring notices and obtaining any consents required by applicable law; such captured data is processed strictly as Customer instructs and TimeCampus is designed to keep team views aggregate rather than individually surveillant.

F. Retention periods

• Account profile data: while account is active + 90 days, unless legal hold.
• Time and team records (time entries, timesheets, projects, expenses, work patterns, focus data): for the Subscription Term on Customer's instructions; then export within 30 days and delete, subject to statutory time-and-attendance/expense/tax retention Customer directs.
• Documents in the file store: until deleted by Customer or account closure.
• Audit logs: per Plan (default 30 days; longer for Enterprise).
• Analytics events: per Plan; user-level up to 13 months.
• Backups: rolling 30 days hot, 90 days cold (default).
• Support tickets: 24 months after closure unless Customer requests earlier deletion.
• Billing records: 8 years (Indian tax/Companies Act retention).

G. Sub-processing

See Annex 3. Payroll/accounting export and calendar/communication integrations are added only when Customer enables them.

H. Transfer mechanisms

Default storage region(s) as specified on the Order Form (AWS ap-south-1, Mumbai, India for all backend services, databases and frontend assets). International transfers under DPA §7 use SCCs/UK Addendum, DPDP-permitted destinations, and SPDI-equivalent contractual safeguards as applicable. Team-data localisation as configured on the Order Form.

Reference and incorporation

All Burdenoff Group contracts, addenda, exhibits, policies and registers referenced in this document are identified by their Document ID (TC-LEGAL-### or TC-PRICING-###) and are published at https://burdenoff.com/contracts. Each such referenced document is incorporated into this document by reference. The version of a referenced document that applies is the version published at https://burdenoff.com/contracts as at the Effective Date of the applicable Order Form (or, where no Order Form exists, the version current at the date of acceptance), unless an executed Order Form specifies a frozen version.