Data Processing Agreement

1. Subject matter and duration

We process personal data to provide Chronaro to the customer as described in the Terms of Service. This DPA applies for as long as we process personal data on the customer’s behalf.

2. Nature and purpose of processing

Hosting, storing, organizing, displaying, reporting and exporting the customer’s time-tracking data, including providing reports through the reporting API to systems the customer chooses; authenticating its users; providing support; and keeping the service secure and available.

3. Personal data and data subjects

• Data subjects: the customer’s users (such as employees and contractors) and any persons the customer mentions in its workspace content.
• Personal data: names, email addresses, teams and roles; time entries with dates, times and durations; descriptions; billing classifications; client, task and group names where they contain personal data; and related technical and security logs.

The customer should not enter special categories of personal data (such as health data) into Chronaro.

4. Instructions

We process the personal data only on the customer’s documented instructions. The Terms, this DPA and the customer’s use and settings of Chronaro are the customer’s instructions. When the customer’s administrator creates an API key and connects a system to it, that is the customer’s instruction to provide the company’s reports to that system. Systems the customer connects are the customer’s own choice and responsibility; they are not our sub-processors. We will tell the customer if, in our opinion, an instruction infringes data protection law, unless law prohibits this.

5. Confidentiality

Everyone we authorize to process the personal data is bound by confidentiality.

6. Security

We maintain appropriate technical and organizational measures, including encrypted connections, separation of data by company enforced in the database, role-based access, optional two-factor authentication for users, read-only API keys that are stored only as one-way hashes, require two-factor authentication to create, are limited to one company, are rate-limited and stop working when their creator is no longer an administrator, restricted administrative access and the security programs of our service providers. Our measures may change over time but will not reduce the overall level of protection.

7. Sub-processors

The customer gives general authorization for us to use sub-processors. We currently use:

• Supabase – database and user authentication, hosted in the European Union (Frankfurt, Germany).
• Netlify – hosting and delivery of the web application.
• Google – sign-in with a Google account, if a user chooses it, and email used for support.

We will update this list and give reasonable advance notice of new sub-processors here. The customer may object on reasonable data protection grounds; if we cannot resolve the objection, the customer may stop using Chronaro. We impose data protection obligations on our sub-processors that are equivalent in substance to this DPA and remain responsible for their performance as required by the GDPR.

Stripe processes payment data for our own billing as a separate service provider and does not receive workspace content.

8. International transfers

Where personal data is transferred outside the European Economic Area (for example to the United States or Singapore), we rely on recognized safeguards such as adequacy decisions, the European Commission’s standard contractual clauses or, where applicable, the EU–US Data Privacy Framework.

9. Assistance and personal data breaches

Taking into account the nature of the processing, we help the customer respond to data subjects’ requests and meet its obligations on security, data protection impact assessments and prior consultation. Chronaro lets administrators download their company’s data, also through the API, and lets users download their own hours and delete their own accounts.

We notify the customer without undue delay after becoming aware of a personal data breach affecting its data, with the information reasonably available to us.

10. Deletion at the end of the service

The customer can download its data at any time while it has access. We delete the customer’s workspace data within 90 days after the customer relationship has ended, unless law requires us to keep it. The relationship ends when the last account of the company is deleted, when a subscription or invoicing ends without being renewed, when no payment method has been chosen after the free period, or when access has been suspended for non-payment and not restored. Backups are overwritten in their normal cycle.

11. Information and audits

We make available the information reasonably necessary to demonstrate compliance with this DPA. Audits may be carried out at the customer’s cost, with reasonable advance notice, no more than once a year and subject to confidentiality. Where possible, we may meet audit requests with documentation, including our sub-processors’ certifications and reports.

12. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms of Service, except where law does not allow them. If this DPA and the Terms conflict on data protection matters, this DPA prevails.

13. Contact

KKH Ventures
Business ID 2572832-1
Suomenlinna C54 A3
00190 Helsinki, Finland
admin@chronaro.com