Data Processing Agreement
Last updated: [date of publishing]
This agreement forms part of the Terms of Service. It applies whenever Caderly processes personal data that the Customer puts into its workspace. The Customer is the controller: it decides what data goes in and why. Hasan Kagalwala is the processor: he processes the data only to run Caderly for the Customer.
1. Scope of processing
| Item | Detail |
|---|---|
| Purpose | Providing the Caderly service: records, leave, calendar, documents, reports, audit log, email notifications |
| People concerned | The Customer's employees, contractors, interns and invited Users |
| Types of data | Name, work and personal contact details, date of birth, gender, marital status, nationality and citizenship, address, job and employment details, manager, leave requests and balances, compensation and bonus (Admins only), uploaded documents such as IDs, sign-in and audit records |
| Sensitive data | None is required. If the Customer uploads it (for example a medical note with sick leave), the Customer is responsible for having a legal basis |
| Duration | While the workspace exists, plus the deletion periods in section 8 |
2. Instructions
We process Customer personal data only on the Customer's documented instructions. These Terms, and the way the Customer's Admins configure and use Caderly, are those instructions. If we think an instruction breaks data protection law, we'll say so. We won't use the data for any other purpose, including advertising, profiling or AI training.
3. Confidentiality and support access
Only Hasan Kagalwala has administrative access to the service, and he is bound by confidentiality. We only access a workspace's contents when the Customer asks for support, or when it's needed to keep the service secure. Every support session is recorded in the Customer's own audit log under a separate support role.
4. Security measures
- HTTPS for all traffic. Passwords hashed with BCrypt.
- Sensitive employee fields encrypted in the database. The keys are kept apart from the data.
- Each Customer's data is separated in the application and again by row-level security in the database. Automated tests check this separation.
- Account lockout after 5 failed sign-ins for 15 minutes. Sessions end immediately on password change, role change or termination.
- Audit log of every change and sign-in, visible to the Customer's Admins.
- The admin console can only be reached from allow-listed network addresses.
- Nightly database backups, kept for 30 days.
5. Sub-processors
The Customer authorises these sub-processors:
| Sub-processor | What it does | Location |
|---|---|---|
| [Hosting / data centre provider] | Hosts the server and backups | [Server location] |
| [Email provider] | Sends emails to Users | [Location] |
We'll email Admins at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds. If we can't resolve the objection, the Customer may close its workspace. Each sub-processor is bound by data protection terms at least as protective as these.
6. International transfers
Customer data is stored in [Server location]. Where that is outside the Customer's country, including transfers out of the UAE under Federal Decree-Law 45 of 2021, the parties agree that these clauses act as the contractual safeguards for the transfer. The protections in this agreement travel with the data wherever it is processed.
7. Personal data breaches
We'll notify the Customer's Admins without undue delay, and in any case within 48 hours of becoming aware of a breach affecting their data. That leaves the Customer time to meet its own regulator deadlines, such as the 72 hours commonly applied in the UAE. The notice will include what happened, what data and how many people are affected, what we've done to contain it, and a contact for questions. We'll keep the Customer updated as we learn more.
8. Deletion and return
- The Customer can export its reports to CSV at any time, and can ask us for a full export.
- When a workspace closes, access stops immediately. Customer data is permanently deleted after 30 days, and backups containing it age out within a further 30 days.
- Within the workspace, the Customer's retention settings apply. For example, terminated employees' records are kept 7 years by default.
- We'll confirm deletion in writing on request.
9. Helping the Customer
We'll help the Customer, as far as Caderly reasonably allows, to answer employees' requests to access, correct or delete their data. We'll also help with impact assessments and regulator enquiries. If a person contacts us directly about Customer data, we'll pass the request to the Customer and won't answer it ourselves unless told to.
10. Audits
On reasonable written request, once a year, we'll answer a security questionnaire and provide the information needed to show we comply with this agreement.
11. Order of precedence
If this agreement conflicts with the Terms of Service on personal data, this agreement wins.