DPA Annex 4 — DPIA Template
TC-LEGAL-003D·Privacy
Annex 4 — Data Protection Impact Assessment (DPIA) Template
Document ID: TC-LEGAL-003D
Title: DPA Annex 4 — Data Protection Impact Assessment (DPIA) Template
Version: 1.0
Status: APPROVED v1.0 — Effective 2026-10-24. Approved for customer distribution.
Last updated: 2026-10-24
Publisher: Timecampus Technologies Pvt. Ltd. (Burdenoff Group)
Canonical location: https://burdenoff.com/contracts/timecampus/TC-LEGAL-003D
Burdenoff Group Contract Registry — root at https://burdenoff.com/contracts (one subgroup per product). The contracts referenced in this document belong to the TimeCampus subgroup at https://burdenoff.com/contracts/timecampus/. Every referenced contract is identified by its Document ID (TC-LEGAL-### / TC-PRICING-###) and incorporated by reference.
This template fulfils Timecampus's commitment in DPA §4.5 to "assist Customer with data protection impact assessments." It gives the Customer's DPO or privacy team the facts about how TimeCampus processes team members' Personal Data, so they can complete their own assessment without reverse-engineering the product. It is information supplied by a processor; it is not legal advice to the Customer.
How to use this template
- Who owns the DPIA. The Customer is the controller (Data Fiduciary) for its team members' Personal Data processed through TimeCampus (DPA §2, Annex 1). Under GDPR Art. 35 and comparable regimes, the Customer, not Timecampus, conducts and owns the DPIA before deploying systematic monitoring of its workforce.
- What Timecampus has filled in. Sections 1–6 describe Timecampus's own processing, verified against the live product (
wspace-timecampus-svc, release line 2026.10xx, as deployed to production on 2026-10-24) and the current DPA and Annexes. - What the Customer fills in. The fields in italics, the likelihood/severity scoring in Section 5, the jurisdiction checks in Section 7 that apply to it, and the conclusion and sign-off in Section 8.
- Getting it. This template is published at the canonical location above, is provided with every Enterprise Order Form, and is available to any Customer on request at contact@timecampus.com. Timecampus answers factual follow-up questions about its processing within 10 business days.
- Keeping it current. Timecampus re-verifies Sections 2–6 whenever a release changes what personal data is collected, who can see it, or how AI features use it, and at least every six months. The version history at the end of this document records each re-verification.
1. Assessment scope and trigger
| Field | Value |
|---|---|
| Processing activity assessed | Customer's use of the TimeCampus time-intelligence platform (full subject matter in Annex 1 §A) |
| Why a DPIA is likely required | Systematic monitoring of employees' time and activity is a standard DPIA trigger (GDPR Art. 35(3) and the EDPB/WP29 criteria: systematic monitoring, vulnerable data subjects — employees, and innovative technology). Optional AI-assisted features add an automated-processing dimension |
| Assessment owner | Customer's DPO / Grievance Officer (name and contact) |
| Timecampus contact for this assessment | DPO / Grievance Officer, Vignesh T.V. — contact@timecampus.com |
| Modules and capture sources the Customer will enable | Customer to list, from its Order Form and workspace settings |
| Date started / target completion | Customer to fill in |
2. Description of the processing
Summarised from Annex 1 (TC-LEGAL-003A); Annex 1 prevails if the two ever differ.
- Nature and purpose: authentication and tenancy, activity capture and a unified timeline, time and project workflows, focus and productivity insights, time and attendance, document storage, payroll/accounting export relay, assistive AI categorisation, internal communications, audit and analytics, support, fraud prevention and security, and legal compliance (Annex 1 §B).
- Data subjects: the Customer's Authorized Users, admins and managers; team members whose time and activity are tracked; contractors and collaborators on billable projects; client-portal users; individuals referenced in Customer Data (Annex 1 §C).
- Categories of Personal Data: identification and contact, account and authentication, authorisation, time entries and timesheets, captured activity and usage, meeting metadata, focus and work-pattern data, expense and financial inputs, time/attendance/leave (including location check-in where enabled), billable-project and client-portal records, device and connection data, product analytics, documents, billing data and support data (Annex 1 §D).
- The data-model elements that matter most for a monitoring DPIA (verified against the production schema on 2026-10-24):
| Element | What is stored | Default | Who can see an individual's records |
|---|---|---|---|
LocationEntry, GeofenceEvent | Latitude, longitude, accuracy, address, start/end time and duration; geofence enter/exit events | Off. Enabled per workspace and per person | The individual only. Managers see aggregate LocationStats |
WorkPattern | Focus, meeting and break hours, interruptions, deep-work sessions, peak hours, a productivity score, and self-reported mood, stress and energy | Recorded by or for the individual | The individual only. In the Team Activity feed, other members see a teammate's hours but not their productivity score, mood, stress or energy. Managers see workspace averages through teamWorkPatternSummary |
FocusScore | Daily focus score and sub-scores (deep work, consistency, task completion, distraction resistance, energy management) | Computed for the individual | The individual only. A regular member or manager who asks for another person's scores is served their own instead |
CaptureEvent, ApplicationUsage | Source (browser extension, desktop, mobile, IDE, CLI, API), application, URL, window/page title, duration, suggested category; per-app time, sessions, switches and a productive/neutral/distracting category | Off. Each capture source is installed and enabled by the individual | The individual only |
EmailTimeEntry | Subject, sender, recipients, duration, response time, category, thread ID, importance flag. Email bodies are never ingested | Off. Enabled per mailbox connection | The individual only |
- Special-category data: TimeCampus does not ask for special-category or sensitive personal data, and the Customer must not upload it (Annex 1 §E). Mood, stress and energy are optional self-reports, not health diagnoses, but the Customer should treat them as potentially sensitive (see risk 6).
- Retention: per Annex 1 §F. The Customer controls retention and export; data is exported or deleted on the Customer's instruction at the end of the term. The mutation audit trail is kept for up to 7 years.
- Recipients and sub-processors: per Annex 3 (TC-LEGAL-003C). All hosting is on AWS in ap-south-1 (Mumbai, India), with Cloudflare at the network edge.
- International transfers: data is stored in India by default. Transfers outside India (for example to a non-Indian Customer's users, or support tooling listed in Annex 3) rely on DPA §7: the EU SCCs and UK Addendum where GDPR applies, and DPDP-permitted destinations.
3. Necessity and proportionality: the facts the Customer can rely on
- Individual data stays with the individual. Raw location, work-pattern, focus-score, application-usage, capture and email records are readable only by the person they describe. The API enforces this on the server: requests from a regular member or manager for another person's records are answered with the caller's own records. Only platform service accounts and Timecampus super-administrators (for support and operations, under DPA §5 confidentiality) bypass this.
- Team views are aggregates, with one bounded exception. Managers' analytics are workspace aggregates (
LocationStats,WorkPatternSummary,teamWorkPatternSummary). The Team Activity feed lists each member's logged hours so a team can coordinate, but redacts every teammate's productivity score and self-reported mood, stress and energy (enforced on the server since release 2026-10-24). - Capture is opt-in. Activity, application, browsing, email and location capture only run where the Customer enables the module and the individual installs or connects the capture source. Unused modules generate no Personal Data.
- No automated decisions about people. The AI features (focus scores, work-pattern insights, activity categorisation, the assistant) describe and suggest; none of them takes an action that affects a person's job, pay or access. The AI Product Terms (TC-LEGAL-012 §4) require a human decision for any outcome with a legal or similarly significant effect, and from 2026-10-24 also prohibit using the outputs to monitor or evaluate individual workers (TC-LEGAL-012 §4.4).
- No emotion recognition. TimeCampus never infers emotions from biometric data. Mood, stress and energy are only what the person chooses to report about themselves.
- No screenshots, keystroke logging, webcam or microphone capture.
Customer to record: the business purpose for each module it enables, why a less intrusive option would not meet it, and which capture sources it will leave off.
4. Consultation
- Internal: the Customer's DPO or Grievance Officer, HR/People team, and employee representatives or works council where local law requires consultation before monitoring is introduced.
- Data subjects: Customer to describe how team members are told about the processing and, where required, consulted. Timecampus provides a team-member notice template on request (register item Q-DPA-4).
- Timecampus: available at contact@timecampus.com for factual questions about this processing. Timecampus does not advise the Customer on the Customer's own legal obligations.
- Prior consultation: if the Customer's assessment leaves a high residual risk it cannot mitigate, GDPR Art. 36 requires prior consultation with the supervisory authority. Customers under India's DPDP regime should follow any consultation or audit duties that apply to them as a Data Fiduciary (including Significant Data Fiduciary duties, if designated).
5. Risk register
Timecampus has pre-filled the description, the product controls and its own view of residual risk. The Customer scores likelihood and severity for its workforce and records any extra mitigations.
| # | Risk | Product controls | Timecampus view of residual risk | Customer score / extra mitigation |
|---|---|---|---|---|
| 1 | Team members experience the tool as surveillance; trust erodes | Opt-in capture; individual data visible only to the individual; aggregate team views; no screenshots or keystrokes | Low, if the Customer gives clear notice | |
| 2 | Location data reveals sensitive patterns (health visits, places of worship, union meetings) | Off by default; individual-only visibility; managers see aggregates; Timecampus infers nothing from location | Low to medium, depending on whether the Customer enables geofencing outside work sites | |
| 3 | Focus scores or productivity scores are used to judge or discipline individuals | Scores visible only to the individual; teammates' scores redacted in the team feed; AI Terms §4 and §4.4 prohibit evaluative and automated employment use | Low, provided the Customer follows TC-LEGAL-012 §4.4 | |
| 4 | Time tracking of contractors creates co-employment or misclassification exposure for the Customer | The product records what the Customer configures and never sets classification, hours or tools; see TC-LEGAL-013 §1–2 | Customer-specific; depends on how the Customer engages contractors | |
| 5 | Granular activity data is kept longer than needed | Customer-controlled retention and export; deletion on instruction at term end | Low | |
| 6 | Self-reported mood, stress or energy is read as mental-health monitoring | Optional self-report; individual-only; redacted from teammates; redacted from audit previews | Low | |
| 7 | Email metadata exposes communication patterns or sensitive correspondents | Off by default; bodies never ingested; individual-only visibility | Low to medium; subject lines can be revealing, so the Customer should decide whether to enable email tracking at all | |
| 8 | Sub-processor flows the Customer has not reviewed | Annex 3 list; 30 days' notice of changes (DPA §6) | Low | |
| 9 | Transfer of employee data to or from India without adequacy | India-by-default storage; SCCs/UK Addendum (DPA §7) | Low to medium for EU/UK Customers; the Customer completes its own transfer assessment |
6. Security and organisational measures already in place
- Access control: actor-based RBAC enforced at the API gateway on every query and mutation; tenant and workspace isolation; server-side owner filtering of individual records (Security Exhibit TC-LEGAL-004; Annex 2 TC-LEGAL-003B).
- Hosting and encryption: AWS ap-south-1 (Mumbai). TLS 1.2+ in transit; AES-256 at rest with AWS KMS-managed keys for the databases (Amazon RDS PostgreSQL, Amazon Neptune), the cache and event layer (Amazon ElastiCache Valkey) and object storage (Amazon S3); application secrets in AWS Secrets Manager.
- Network: Cloudflare WAF and DDoS protection in front of the public load balancers; services on private networks inside Amazon EKS; service-to-service traffic over private internal gateways only.
- Audit logging: every mutation is audit-logged. Credential-like values, GPS coordinates, mood, stress, energy and date of birth are redacted from the audit trail's request and response previews. Email subject and recipient fields are not yet redacted from those previews; Customers enabling email tracking should take that into account.
- Incident response: CERT-In-aligned reporting within 6 hours, 180-day log retention, and breach notification to the Customer under DPA §8.
- Export and deletion: Customer Data is exported or deleted on the Customer's instruction, including at the end of the term (Annex 1 §F).
7. Jurisdiction checklist
The Customer ticks the regimes that apply to its workforce and records how it meets them.
- EU / EEA / UK GDPR: Art. 35 DPIA (this document); Art. 13/14 notice to team members; lawful basis (legitimate interests or legal obligation; consent is rarely valid in employment); Art. 88 and national employee-data rules; works-council co-determination where applicable (for example Germany, BetrVG §87(1) no. 6); Art. 36 prior consultation if high residual risk remains.
- EU AI Act: the Customer is the deployer of TimeCampus's AI features. Used as intended (TC-LEGAL-012 §4.4), they are not Annex III high-risk systems; see TC-LEGAL-013 §3 and §7 for the feature information sheet. AI-literacy duties for staff who operate the tool (Art. 4) apply to the Customer. A Customer that uses the outputs to monitor or evaluate individual workers is using the system outside its intended purpose and takes on the obligations that follow (Art. 25).
- India — Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025: notice in the prescribed form, a lawful ground (including the legitimate use for employment purposes under s. 7(i)), data-principal rights handling, breach notification to the Data Protection Board, and Significant Data Fiduciary duties if designated.
- United States — electronic-monitoring notice laws: for example New York Civil Rights Law §52-c, Connecticut Gen. Stat. §31-48d and Delaware Code tit. 19 §705 require prior written notice of electronic monitoring; California (CCPA/CPRA) applies to employee personal information.
- Other jurisdictions: Customer to add.
8. Conclusion and sign-off (Customer)
- The processing is necessary for the purposes recorded in Section 3, and less intrusive options would not meet them.
- Residual risk after mitigation is acceptable, or prior consultation has started.
- Notice and consultation duties for each applicable jurisdiction in Section 7 are met.
- Review date set (recommended: annually, or when enabling a new module or capture source).
| Role | Name | Date | Signature |
|---|---|---|---|
| Customer DPO / Grievance Officer | |||
| Customer business owner |
9. Approval and version history (Timecampus)
| Version | Date | Change | Approved by |
|---|---|---|---|
| 0.1-DRAFT | 2026-07-23 | First engineering draft | — |
| 0.2-DRAFT | 2026-08-03 | Populated with the real data model | — |
| 1.0 | 2026-10-24 | Re-verified Sections 2–6 against production; corrected hosting to AWS (Azure decommissioned 2026-08-15); added FocusScore and team-feed redaction facts, the risk-register residual view, the jurisdiction checklist and the distribution mechanism; approved for customer distribution | Timecampus DPO (Vignesh T.V.), under the owner's 2026-10-24 delegation recorded in BOFF-5107 |
Reference and incorporation
All Burdenoff Group contracts, addenda, exhibits, policies and registers referenced in this document are identified by their Document ID (TC-LEGAL-### or TC-PRICING-###) and are published at https://burdenoff.com/contracts. Each such referenced document is incorporated into this document by reference. The version of a referenced document that applies is the version published at https://burdenoff.com/contracts as at the Effective Date of the applicable Order Form (or, where no Order Form exists, the version current at the date of acceptance), unless an executed Order Form specifies a frozen version.