Data Processing Agreement (GDPR Art. 28) — TimeViking

Last updated: 6 October 2026

This agreement forms part of the general terms and conditions. The customer accepts it at registration (together with the terms and the privacy statement) and again at checkout.

1. Roles

• Controller: the customer (the business that uses the environment).
• Processor: Software Services BV, Meldertsestraat 8/4008, 3545 Halen, Belgium, BE 0895.317.225.

2. Subject matter, duration, nature and purpose

3. Categories of data subjects and personal data

• Data subjects: the customer's employees and staff who record or manage hours; contact persons of the customer's clients (client names on projects).
• Data: name, e-mail, login; hours (date, time, duration, description, project, task); approvals; the link with an Odoo employee (ID, name, work e-mail); work schedule and public holidays; leave data (see below); settings; audit log (who changed what).
• Leave data: the type of leave (e.g. annual leave, sickness), the period (start and end, whole or half days or hours), the status of the request (requested, approved, refused, withdrawn), who decided, a personal note of the requester or decision-maker, and the balance (allocation, taken, remaining) per type.
• Sickness is health data (GDPR Art. 9). The type "sickness" or a similar type shows that someone is ill. Our measures: we do not read or store the reason the employee enters in Odoo (name/private_name); colleagues see only "absent" in the team calendar and on the dashboard, without the type; only the employee themselves, their manager and the administrator see the type; an administrator can mark a type as "sensitive", in which case colleagues never see it; for leave, the audit log keeps only status, decision-maker, dates and type, never the note or a reason for refusal or withdrawal. The customer assesses the legal basis under Art. 9(2) (e.g. 9(2)(b), employment law) itself and records the processing in its register.
• The customer ensures that no medical details are entered in the free-text note or the description.
• Other special categories of data (GDPR Art. 9) are not intended.

4. Obligations of the processor

The processor:

1. processes only on the documented instructions of the customer; the instructions are this agreement, the terms and the settings the customer chooses in the app (e.g. the connection with Odoo);
2. ensures that those who process the data are bound by confidentiality;
3. takes appropriate technical and organisational measures (annex A);
4. engages sub-processors only in accordance with §6;
5. assists the customer with requests from data subjects (export in the app, deletion, rectification);
6. assists with security, notification of breaches and data protection impact assessments, as far as reasonable;
7. deletes or returns the data after the end (§9);
8. provides the information needed to demonstrate compliance, and allows an audit (§8).

5. Personal data breaches

The processor reports a personal data breach without undue delay, and where possible within 48 hours of discovery, to the administrators of the customer's environment, with what is known (nature, data subjects, consequences, measures). The customer notifies the supervisory authority and the data subjects.

6. Sub-processors

The customer gives general authorisation for these sub-processors:

We send invitations and notifications with our own mail server on our servers; no separate party is involved.

Not on the list, because they do not process the hours data: Mollie (only payment data of the customer itself, for which we are controller), Google reCAPTCHA (only on the registration page and the contact form). The customer's Odoo is not a sub-processor: the customer connects it itself.

We announce a new sub-processor 30 days in advance; the customer can object with reasons and, if we cannot find a solution, cancel.

7. Transfers outside the EEA

None, unless the customer itself connects an Odoo outside the EEA (in which case the customer gives that instruction).

8. Audit

On request, once a year, the processor provides a description of the measures and the results of the latest security review. An on-site audit by appointment, at the customer's expense, subject to confidentiality.

9. End

Leave data (leave, day split and balance) follows the same retention period as the hours: it stays in the environment as long as it exists, is included in the export, and is deleted with it.

After the subscription ends, the environment stays read-only for 60 days; the customer can export everything. After that the processor deletes the environment's database and the logins, and after 35 days also the backups (the backup rotation period). The customer can have it deleted earlier (in the app).

10. Language and precedence

This agreement exists in Dutch, English, French, German, Spanish and Italian. In case of a difference between the versions, the Dutch text prevails. In case of a conflict with the general terms and conditions, this agreement prevails as far as the processing of personal data is concerned.

Annex A — Measures

• A separate database and a separate database user per customer; the application cannot open another customer's database.
• Passwords hashed (scrypt/pbkdf2); Odoo keys (of a bot user or personal) and the module secret encrypted (Fernet), never in logs.
• Two-step verification available and enforceable per environment; our own administration always with two-step verification.
• Permissions per role and per company; an audit log of changes (for leave without note or reason).
• Leave: colleagues see only "absent"; the type only the employee, their manager and the administrator; we do not read the reason from Odoo.
• For leave, the bot in Odoo gets the role Time Off: Officer, with which it can already see all leave of the companies in Odoo; the customer assigns that role itself and can omit it (leave then does not work through the app).
• Encrypted connections (TLS); requests between the module and us are signed (HMAC, time and nonce).
• Limits on sign-in, registration and the API; blocking after repeated failures.
• Daily backups per database, kept for 35 days, restore tested.
• A security review before launch.