Data processing agreement

1. Roles

This agreement forms part of the terms of service between ZEYNOR LLC (the “Processor”) and the Customer (the “Controller”). The Customer decides which personal data its users enter in the service and why; Zeynor processes it only to provide the service.

2. Subject matter, nature and duration

Processing consists of storing, organizing, displaying and transmitting scheduling data so the Customer can plan and publish shifts. It lasts for the duration of the subscription and until deletion under section 8.

• Data subjects: the Customer’s employees, managers and other users it invites.
• Categories of data: names, work contact details, roles, sites, availability, leave and absence dates, shift times, swaps, clock-in and clock-out times.
• The service is not designed for special categories of data. The Customer should not enter health details or similar information in free-text fields.

3. Instructions

Zeynor processes Customer personal data only on the Customer’s documented instructions, which are the terms of service, this agreement and the Customer’s use of the service’s settings. We will tell the Customer if we believe an instruction breaks applicable law.

4. Confidentiality and security

Everyone at Zeynor with access to Customer data is bound by confidentiality. We apply appropriate technical and organizational measures, including encrypted connections (HTTPS), password-protected accounts, role-based access within the service and limited internal access.

5. Subprocessors

The Customer authorizes Zeynor to use subprocessors for hosting and email delivery. The current list is available on request. We bind each subprocessor to data protection obligations no less protective than this agreement and give the Customer notice of any new subprocessor, with the opportunity to object.

6. Assistance

Taking into account the nature of the processing, Zeynor helps the Customer respond to requests from data subjects and meet its obligations on security, breach notification and impact assessments.

7. Personal data breaches

Zeynor notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer data, with the information then available, and keeps the Customer informed.

8. Return and deletion

During the subscription, the Customer may request an export of its data. Within thirty days after the agreement ends, Zeynor deletes Customer personal data, unless the law requires it to be kept, and confirms deletion on request.

9. Audits

Zeynor makes available the information reasonably needed to demonstrate compliance with this agreement, and answers reasonable written questions from the Customer once a year, or after a breach.

10. Law

This agreement is governed by the same law and courts as the terms of service: the laws of the Commonwealth of Kentucky and the state and federal courts located in or serving Clark County, Kentucky.