Data processing agreement

1. Parties and place of this agreement

1.1. This data processing agreement (the agreement) is made between the customer using the Idus service (the controller) and Kahur Media OÜ (registry code 10704434, VAT no EE100710481, Vääna tn 12, Nõmme district, Tallinn, Harju county, Estonia, e-mail idus@kahur.ee, the processor).

1.2. The agreement is an integral part of the terms of service and takes effect with them. No separate signature is needed. The controller may request a signed copy at idus@kahur.ee.

1.3. The agreement meets the requirements of article 28(3) of the General Data Protection Regulation (EU) 2016/679 (the GDPR). Terms are used with their GDPR meaning.

1.4. The agreement does not cover data for which Kahur Media OÜ is itself the controller (user accounts, billing, support, analytics). The privacy policy describes that data.

2. Subject matter and duration

2.1. The processor processes personal data to provide the Idus service in the controller's workspace: time tracking, organising work and tasks, managing sites and clients, documents, chat, reports and the other features of the service the controller uses.

2.2. The nature and purpose of the processing, the types of data and the categories of data subjects are set out in Annex 1.

2.3. The agreement applies for as long as the controller uses the service and thereafter until the data is deleted or returned under section 9.

3. Instructions

3.1. The processor processes personal data only on the controller's documented instructions. The instructions are this agreement, the terms of service and the choices the controller and its users make in the service (for example turning on location confirmation, allowing photos, using artificial intelligence, assigning roles, exporting and deleting data).

3.2. If the processor considers that an instruction infringes the GDPR or other applicable law, it informs the controller without delay and may suspend the instruction until it is clarified.

3.3. The processor does not process personal data for its own purposes. Technical processing needed for the reliability and security of the service (logs, backups, fault investigation) is part of providing the service.

3.4. Where Union or Member State law requires the processor to process personal data otherwise, it informs the controller before processing, unless the law prohibits this.

4. Confidentiality

4.1. The processor ensures that personal data is processed only by persons who have committed themselves to confidentiality or are under a statutory obligation of confidentiality, and only to the extent needed for their task.

4.2. A support operator of the processor enters the content of the controller's workspace only to resolve a fault or a support request from the controller. Each entry is logged.

5. Security

5.1. The processor implements the technical and organisational measures required by article 32 of the GDPR, described in Annex 2, and keeps them in line with the state of the art. Replacing a measure with one at least as effective is not an amendment of this agreement.

5.2. The controller is responsible for the secure use of its users' accounts, the correct assignment of roles and the security of its own devices.

6. Sub-processors

6.1. The controller gives the processor general authorisation to use sub-processors. The sub-processors used when this agreement is made are listed in Annex 3.

6.2. The processor gives the workspace owner at least 14 days' notice, in the app or by e-mail, before adding or replacing a sub-processor. The controller may object on reasonable grounds within the same period. If the parties find no solution, the controller may end the agreement and its use of the service before the change takes effect, without further obligation.

6.3. The processor binds each sub-processor by a written contract imposing in substance the same data protection obligations as this agreement, and remains liable to the controller for the sub-processor's performance.

6.4. Where the controller adds its own artificial intelligence provider key to the service or connects its own AI client or another tool, that provider is the controller's own processor and is outside this agreement.

7. Assistance with data subject rights and obligations

7.1. The processor forwards to the controller without delay, and at the latest within 5 working days, any data subject request it receives concerning the controller's workspace data, and does not respond to it itself beyond directing the requester to the controller.

7.2. The processor assists the controller in fulfilling requests under articles 12 to 22 of the GDPR through the service's own features (viewing, correcting, exporting and deleting data) and, where needed, in another reasonable way.

7.3. The processor assists the controller in meeting its obligations under articles 32 to 36 of the GDPR (security, breach notification, impact assessment, prior consultation), taking into account the nature of the processing and the information available to the processor.

7.4. Assistance that goes beyond the service's ordinary features and requires significant work may be provided for a reasonable fee agreed in advance.

8. Personal data breach

8.1. When the processor becomes aware of a personal data breach affecting the controller's data, it notifies the controller without undue delay and at the latest within 48 hours of becoming aware, at the workspace owner's e-mail address.

8.2. The notice contains the information available on the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken and proposed. Information not available at the time of the notice is provided in phases.

8.3. The processor does not notify the supervisory authority or data subjects on the controller's behalf unless the controller asks it to.

9. Deletion and return of data

9.1. While the service is in use the controller can export its data at any time with the service's export features and delete it with the service's own means.

9.2. When the agreement ends (the workspace or the use of the service is ended), the controller has 30 days to export the data. The processor then deletes the workspace's personal data from live systems. Data disappears from backups as the copies expire, within 6 months at the latest, and backups are restored only to recover the service after a failure.

9.3. The processor keeps data beyond the period in 9.2 only if and for as long as Union or Member State law requires.

9.4. When an employee of the controller deletes their account, the employee's personal data is anonymised but their time entries and other records remain in the workspace under a neutral label, because they are part of the controller's working-time and accounting records. The controller decides on their further retention.

10. Information and audit

10.1. The processor gives the controller the information needed to demonstrate compliance with this agreement and article 28 of the GDPR, in particular the current content of Annexes 2 and 3 and descriptions of the security measures.

10.2. Where documents are not sufficient, the controller or an independent auditor it appoints, bound by confidentiality, may verify compliance once per contract year, with at least 30 days' notice, during normal business hours and in a way that does not disturb the service to other customers. The controller bears the cost of the audit unless it reveals a material breach.

10.3. The processor allows an inspection required by a supervisory authority as the law provides.

11. Transfers to third countries

11.1. Personal data is stored and processed in the European Union (servers in Germany, backups in Estonia).

11.2. The only processing outside the European Union at the time of this agreement is the reading of documents with artificial intelligence at the provider Anthropic PBC (USA), where the controller has allowed the use of AI and uses the processor's key. The transfer rests on the European Commission's standard contractual clauses, which form part of Anthropic's data processing agreement, or on Anthropic's participation in the EU-U.S. Data Privacy Framework. The controller can turn AI off at any time in the workspace settings.

11.3. A new transfer to a third country counts as a change of sub-processor under section 6.

12. Liability and final provisions

12.1. The parties' liability for a breach of this agreement is set out in section 8 of the terms of service. This does not limit liability towards a data subject under article 82 of the GDPR.

12.2. The controller confirms that it has a legal basis for processing the personal data (for employees' working time usually § 28 of the Estonian Employment Contracts Act and the employer's legitimate interest) and that it has informed the data subjects of the processing.

12.3. The processor announces changes to this agreement as provided in section 10 of the terms of service. In case of conflict with the terms of service, this agreement prevails on matters of personal data processing.

12.4. The agreement is governed by the law of the Republic of Estonia. Disputes are resolved by Harju County Court (Harju Maakohus). In case of conflict between the Estonian and English texts, the Estonian text prevails.

Annex 1. Description of the processing

Nature and purpose. Storing, displaying, organising, reporting on, exporting and deleting personal data in the Idus service so that the controller can keep working-time records, organise work and sites, manage clients, partners and documents and keep its books.

Categories of data subjects. The controller's employees and managers, employees of partner companies (for example subcontractors), contact persons of the controller's clients, suppliers and business partners, persons named in documents (invoices, receipts, quotes, tender documents).

Types of personal data.

• Identification and contact data: name, e-mail, phone, role, employer.
• Working-time data: start and end of work, breaks, site, work, type of activity, corrections and their log, absences and holidays, working-time norm, shift plan, pay and billing rates where the controller enters them.
• Location data: latitude, longitude and accuracy at the moment of a working-time event where location confirmation is on, and for the Android app the site boundary crossing events.
• Photos, videos and voice messages taken on site, which may show people and carry location metadata.
• Chat content, comments, the content of tasks and checklists.
• Documents and bookkeeping entries, which may contain persons' names, addresses and bank account numbers.
• Technical data: device id and pairing key in the Android app, notification subscriptions.

Special categories of personal data. The service is not intended for processing special categories of personal data (for example health). An absence reason (for example illness) may point to such data. The controller decides whether and in what detail to enter it.

Duration. The period of use of the service and deletion under section 9.

Annex 2. Technical and organisational measures

• Encryption in transit. Every connection runs over TLS, with HSTS and a strict content security policy in force.
• Workspace isolation. Every request is bound to one workspace, database queries are scoped to the workspace and automated tests check this.
• Access control. Role-based permissions inside the workspace, two-factor authentication, session management, password hashing, encryption of API keys and mail server passwords, retirement of device pairings unused for 90 days.
• File protection. Files are never at a public address, each file is served only to a user with the right to it.
• Traceability. A working-time correction never deletes the original entry, a change log, an append-only hash-chained bookkeeping journal, a log of support operator actions.
• Reliability and backups. An encrypted backup every day, 14 daily, 8 weekly and 6 monthly copies kept at a separate location in Estonia. The restore procedure is documented.
• Infrastructure. Servers in the European Union (Hetzner, Germany), separate production and test environments, least-privilege service accounts, regular installation of security updates.
• Development process. Changes pass automated tests before reaching production, production is not changed by hand.
• Personnel. Access to workspace content is limited to support operators, only to resolve a support request or a fault, and logged.
• Analytics. Usage analytics and session replays only with the user's consent, with typed text, images and the map masked in replays.

Annex 3. Sub-processors

Sub-processor	Location	Service	Transfer basis
Hetzner Online GmbH	Germany (Nuremberg)	Server hosting, database, file storage	EU
Zone Media OÜ	Estonia	Sending e-mail (notifications, invitations), storing encrypted backups	EU
Anthropic PBC	USA	Reading receipts, invoices and documents with AI, only where the controller has allowed it and uses the processor's key	Standard contractual clauses or the EU-U.S. Data Privacy Framework
PostHog Inc	EU (Frankfurt)	Usage analytics and session replays, only with the user's consent and with content masked	EU

Not sub-processors, but receive data at the user's choice: Google and Microsoft (sign-in), browser push services (Google, Apple, Mozilla, the notification content is encrypted up to the browser), the OpenStreetMap Foundation (map images, sees the user's IP address), the controller's own AI provider or AI client.