Data Protection

1. Who does what

When a business uses TimePay to manage attendance, leave and payroll, it enters or generates information about its own staff in the platform. Under the Data Protection Act 2017 (the "DPA 2017"), the business is the controller of that information: it decides why and how the data is used. TimePay, a product of Dinagsky Ltd (BRN C26236973), trading as Upspace, is the processor: Dinagsky Ltd stores and handles the data for the business, on the business's instructions, and for no purpose of its own.

This document has two functions. It tells employees and former employees, in plain terms, what happens to their data inside TimePay (Part A). It also sets out the processing terms that apply between TimePay and each customer, and form part of the Terms of Service (Part B).

In this document, "TimePay", "we" and "us" mean Dinagsky Ltd, trading as Upspace, the company that owns and operates TimePay. Information that TimePay collects about its own website visitors, account holders and chat users is covered in our Privacy Policy, and not here.

Part A: for employees and former employees

2. What information is processed

The employer chooses what to enter, and most employers use the following categories:

• Identity and contact: name, National Identity Card or passport number, date of birth, gender, address, telephone, e-mail address and, where used, a photograph.
• Employment: date joined and left, job title, department, branch, contract type, schedule and shift, and supervisor.
• Attendance: the time and method of each clock-in and clock-out, lateness, absences and overtime, the device used, and, if the employee clocks in with their phone, the location at that moment.
• Leave: requests, balances, approvals and public holidays taken.
• Pay: basic salary, allowances, deductions, loans, PAYE, CSG, NSF, training levy and PRGF figures, bonus and payslips.
• Bank details used for salary payment, if the employer chooses to record them.
• Platform sign-in: a username or access code and, for those with accounts, a hashed password and a record of sign-ins and actions.

Fingerprints and face templates that a Hikvision terminal captures stay on that device under your employer's control. TimePay's platform is not designed to store them: it receives only the resulting clock event (who, when, and which device).

Your employer may add other fields or upload documents. Ask your employer what else they keep.

3. Why it is processed

TimePay processes this data only to give the employer the service it has asked for:

• recording working time and attendance and calculating lateness and overtime;
• managing leave and public holidays;
• calculating pay, tax and contributions and producing payslips;
• preparing the declarations and files that the Mauritius Revenue Authority and other bodies require, such as PAYE, CSG, NSF and PRGF returns;
• producing reports for the employer;
• keeping the platform secure, supporting the employer, and meeting legal duties.

Your data is not used for advertising, is not sold, and is not used to profile you. The employer's lawful basis is generally that processing is necessary to perform your employment contract and to comply with the law on pay, tax and records; where an employer relies on consent for a particular feature, such as phone location or biometrics, it is for the employer to obtain and manage it.

4. Your rights as an employee

The DPA 2017 gives you rights over your data, including to access it and obtain a copy, to correct what is wrong, to have it erased where there is no longer a reason to keep it, to restrict or object to its use in certain situations, to receive it in a portable format where the law applies, and not to be subject to a purely automated decision with significant effects. These rights are explained in the Act and on the website of the Data Protection Office.

Because your employer is the controller, please make your request to your employer first. TimePay will help your employer to answer, and will pass on to the employer any request that reaches us and that concerns data in the platform, rather than reply ourselves. If your employer has ceased to use TimePay and you cannot reach them, you can write to us and we will explain what we can do.

You can contact us at info@myupspace.com, with "Data Protection" in the subject, giving your name, your employer's name and what you ask. We reply to a valid request within one month.

If you think your rights have not been respected, you may complain to the Data Protection Office (dataprotection.govmu.org) or go to court.

5. How long the data is kept

The employer decides how long to keep employee records, within the law. Payroll and tax records must usually be retained for several years after the relevant year, so an employer often keeps your data for a period after you leave. TimePay keeps the data for as long as the employer's account is active and for 30 days after the contract ends so that the employer can export it, and then deletes or anonymises it, unless the law obliges us to keep it. Backups are overwritten in the normal cycle.

Part B: processing terms between TimePay and the customer

6. Scope and instructions

This part applies whenever TimePay processes Employee Data (as defined in the Terms of Service) on behalf of a customer. The subject matter is the provision of the TimePay service. The duration is the life of the agreement and the export period in the Terms. The nature of the processing is hosting, storing, retrieving, calculating, displaying, transmitting to the customer and, at the customer's request, preparing files for authorities, and deleting. The data subjects are the customer's employees, former employees, job candidates entered by the customer and other individuals it records. The categories of data are listed in section 2.

TimePay will process Employee Data only on the customer's documented instructions, which are given by these terms, by the customer's use of the features and settings of the service, and by its written requests to us. We will tell the customer if we think an instruction breaches the law, and may suspend that part of the processing until it is clarified.

The customer remains responsible for deciding the purposes and lawful basis of the processing, for informing and, where needed, obtaining consent from its employees, for the accuracy of the data, and for deciding who may access it within its own organisation.

7. TimePay's obligations as processor

TimePay will:

• keep Employee Data confidential and make sure that people who access it are bound by a duty of confidentiality;
• apply the security measures in section 8;
• use another processor only as set out in section 9;
• assist the customer, taking account of the nature of the processing, in answering requests from employees to exercise their rights, by providing the tools to find, correct, export or delete data, and by forwarding any request we receive;
• assist the customer in meeting its duties on security, breach notification, impact assessments and consultation with the Data Protection Office, where the customer asks and the help relates to the service;
• tell the customer about any personal data breach affecting its Employee Data without undue delay, and in any case aim to do so within forty-eight (48) hours of becoming aware, with the details we have, so that the customer can meet its own notification duties;
• at the customer's choice, return or delete the data at the end of the service, as set out in section 11;
• make available the information reasonably needed to show compliance with these terms and allow for audits as described in section 12.

8. Security measures

TimePay maintains technical and organisational measures that are appropriate to the risk, including:

• encryption of data in transit between users, devices and the platform, and encryption at rest by the database and storage providers;
• logical separation of each customer's data, enforced in the database, so that one customer's users cannot reach another customer's records;
• role-based access control within each customer account, so that an employer can limit who sees salaries, approves payroll or only reads attendance;
• one-way hashing of passwords and sign-in throttling to resist guessing;
• audit trails of sensitive actions, such as changes to pay, approvals and user permissions;
• restricted access for TimePay personnel, used only to provide support or maintain the service, and recorded;
• regular backups, and a procedure for detecting, handling and reporting incidents;
• secure development practices, including review of changes before release.

We review these measures from time to time and may improve them. We will not reduce the overall level of protection during the agreement.

9. Sub-processors and location

The customer gives TimePay a general authorisation to use sub-processors to provide the service. At the date of this document they fall into these groups: cloud application hosting; managed database hosting, with the primary database in Singapore; e-mail delivery for payslips and notices; payment processing (which does not involve Employee Data); push-notification delivery; error monitoring; and, only where the customer connects Hikvision terminals, the Hik-Connect cloud service.

We will ensure that each sub-processor is bound by obligations that give at least the level of protection of these terms, and TimePay stays responsible to the customer for their performance. We will give the customer notice of the addition or replacement of a sub-processor that handles Employee Data, by e-mail or notice in the service, at least fourteen (14) days beforehand, and the customer may object in writing on reasonable grounds relating to data protection. If the objection cannot be resolved, the customer may terminate the affected service and receive a proportionate refund of prepaid fees.

TimePay will transfer Employee Data outside Mauritius only in accordance with the DPA 2017 and with appropriate safeguards. By accepting these terms the customer agrees to the transfers to the locations in which the sub-processors listed operate.

10. Personal data breaches

If TimePay becomes aware of an event that leads to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to Employee Data, it will investigate promptly, take steps to contain it, and inform the customer as stated in section 7. The notice will describe the nature of the breach, the data and approximate number of people affected where known, the likely consequences and the measures taken or proposed.

As controller, the customer decides whether the breach has to be reported to the Data Protection Commissioner and to the employees concerned, and handles those communications. TimePay will not tell employees or authorities about a breach affecting the customer's data without the customer's agreement, unless the law requires it.

11. Return and deletion

During the agreement the customer can export its data at any time using the service. For thirty (30) days after the agreement ends the customer can sign in on a read-only basis and download payslips, reports and statutory files. After that period TimePay will delete or irreversibly anonymise the customer's Employee Data from live systems, and from backups as they expire, unless a law requires it to be kept, in which case we will protect it and use it only for that purpose. On written request we will confirm that deletion has taken place.

12. Records and audits

TimePay keeps records of its processing activities for customers. On reasonable written notice, and no more than once a year unless there has been a breach or an authority requires otherwise, a customer may ask for information to check compliance with these terms. Where a document is not enough, TimePay will cooperate with a proportionate audit carried out during business hours, under confidentiality, with minimum disruption, and at the customer's cost. Audits must not give access to other customers' data.

13. Liability and relationship to the Terms

These processing terms form part of the Terms of Service, and the limits on liability in those Terms apply, to the extent that the law allows. They do not affect the rights of employees against the controller or the processor under the DPA 2017.

If there is a conflict between this part and any other part of the agreement about the processing of Employee Data, this part prevails.

14. Contact

Data protection questions, requests from employers or employees, and notices under these terms can be sent to info@myupspace.com with "Data Protection" in the subject, or by post to 148 Pamplemousses Rd, Port Louis, Mauritius.