Data processing agreement

You are the controller. You determine what is captured, for what purpose, and for how long. Kronosense Technologies L.L.C-FZ is the processor and processes personal data only on your documented instructions, of which your configuration of the service is part.

Subject matter: provision of the ActivityPulse time attribution service. Duration: the term of your subscription, plus the thirty-day export window that follows it.

Categories of data subject: your personnel whose devices are enrolled, and your authorised administrative users.

Categories of personal data: identity and account data (name, email, role, team); device identifiers; sign-in records (first and last sign-in, and — recorded once, at first sign-in — approximate location to city level, browser and operating system family, and the referring domain and campaign tags of the link followed); captured activity metadata (foreground application and window identity, durations, idle state, project attribution); on a paid plan, the billing administrator's contact and payment details, held by our payment sub-processor; and, only where you enable them, screenshots and input-activity data.

No special category data is processed by design. The service does not capture keystroke content, webcam or microphone input, or document contents.

We process only on your instructions; ensure personnel with access are bound by confidentiality; implement the technical and organisational measures below; assist you with data subject requests, impact assessments and consultations to the extent you cannot action them in the product; and notify you without undue delay on becoming aware of a personal data breach.

At your election on termination we delete or return the personal data, except where retention is required by law.

You give general authorisation for us to engage the sub-processors published at /sub-processors. We impose data protection obligations on each that are no less protective than these terms, and we remain liable for their performance.

We will give notice before adding or replacing a sub-processor, and you may object on reasonable data protection grounds.

Where personal data is transferred outside the UK or EEA, the transfer is made under an appropriate safeguard — the European Commission's Standard Contractual Clauses, or the UK International Data Transfer Addendum, as applicable — together with any supplementary measures required by the transfer risk assessment. Data residency options are available from the Teams plan upwards: an organisation's database can be placed in United States — East, United States — West, Asia-Pacific or Oceania. Residency within the European Union is not offered at present; where it is required, contact us before contracting.

We make available the information necessary to demonstrate compliance with Article 28 and will contribute to audits conducted by you or an auditor you mandate, on reasonable notice, no more than once a year unless a supervisory authority requires otherwise.

Kronosense Technologies L.L.C-FZ (Formation No. 2529704 · Licence No. 2529704.01), Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E. Notices under this agreement may be sent to that address or to contact@activitypulse.ai. A countersigned copy is available on request for customers who need one for their records.