Data Processing Addendum
Last updated: 15 August 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service between the customer ("Controller") and the operator of TEDGE Time Tracker ("Processor"). It applies where the Controller's use of the Service involves the processing of personal data subject to the UK GDPR, the EU GDPR, or comparable data protection law.
Where this DPA conflicts with the Terms of Service, this DPA prevails in relation to data protection.
1. Parties
Processor
Mostafa Mohamed Safwat Ibrahim Shalaby, a sole proprietorship trading as tedge
Commercial Register No. 29807 (Ismailia Chamber of Commerce)
Tax Registration No. 775786969
20 Block C, Ring Road, Sheikh Zayed, Ismailia Third, Ismailia, Arab Republic of Egypt
Contact: info@tedgeltd.com
Controller
The customer organisation that holds the TEDGE Time Tracker account.
2. Definitions
"Personal data", "processing", "controller", "processor", "data subject", "supervisory authority" and "personal data breach" have the meanings given in the UK GDPR and EU GDPR.
"Customer Personal Data" means personal data contained in Customer Data that the Processor processes on behalf of the Controller under this DPA.
3. Subject matter and details of processing
Subject matter. Provision of the TEDGE Time Tracker time tracking service.
Duration. For the term of the Controller's subscription, plus the retention period in clause 11.
Nature and purpose. Hosting, storing, organising, retrieving, transmitting and deleting Customer Personal Data so that the Controller can record working time, manage projects and tasks, submit and approve timesheets, and generate reports.
Categories of data subject. The Controller's employees, contractors, freelancers and other workers who are invited to a workspace as members.
Categories of personal data.
identity data: full name
contact data: email address
employment data: role within the workspace (Owner, Admin, Manager, Member), engagement type (employee or freelancer), membership status
working time data: time entry start and end times, durations, descriptions, associated project and task, whether entered by timer or manually
timesheet data: weekly periods, submission status, approval or rejection, reviewer identity, review notes and timestamps
authentication data: hashed password, session and login timestamps
Special category data. None is required by the Service. The Controller must not enter special category personal data (such as health, religious belief or trade union membership) into free text fields such as time entry descriptions or review notes.
4. Roles
The Controller is the controller of Customer Personal Data and is responsible for the lawfulness of the collection, for having a valid legal basis, and for informing data subjects that their working time is recorded.
The Processor is the processor and processes Customer Personal Data only on the Controller's documented instructions.
5. Processor obligations
The Processor will:
(a) process Customer Personal Data only on the Controller's documented instructions, including the instructions contained in the Terms of Service and in the Controller's use of the Service, unless required to do otherwise by law — in which case the Processor will inform the Controller before processing, unless legally prohibited;
(b) ensure that persons authorised to process Customer Personal Data are bound by an appropriate duty of confidentiality;
(c) implement the technical and organisational measures set out in clause 8;
(d) respect the conditions in clause 6 for engaging sub-processors;
(e) assist the Controller, so far as reasonably possible and taking into account the nature of the processing, in responding to data subject requests under clause 7;
(f) assist the Controller with data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of processing and the information available to the Processor;
(g) notify the Controller of a personal data breach in accordance with clause 9;
(h) at the Controller's choice, delete or return Customer Personal Data at the end of the provision of services, in accordance with clause 11;
(i) make available to the Controller the information necessary to demonstrate compliance with this DPA and allow for audits in accordance with clause 10;
(j) inform the Controller if, in the Processor's opinion, an instruction infringes applicable data protection law.
6. Sub-processors
The Controller gives general written authorisation for the Processor to engage sub-processors. The Processor will impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and remains fully liable to the Controller for the performance of each sub-processor.
The current sub-processors are:
| Sub-processor | Purpose | Location of processing |
|---|---|---|
| Supabase | Database, authentication, storage | European Union (Ireland) |
| Vercel | Application hosting and content delivery | Global edge network |
| Resend | Transactional email delivery | European Union (Ireland) |
The Processor will give the Controller at least 30 days' notice before adding or replacing a sub-processor that processes Customer Personal Data. If the Controller reasonably objects on data protection grounds within that period, the parties will discuss in good faith. If no resolution is reached, the Controller may terminate the affected part of the Service without penalty, with a pro-rata refund of prepaid fees.
7. Data subject requests
Taking into account the nature of the processing, the Processor will assist the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the Controller's obligation to respond to requests to exercise data subject rights.
The Service gives the Controller direct access to Customer Personal Data through the interface, reporting and CSV export features, which will in most cases allow the Controller to respond without the Processor's involvement.
If the Processor receives a request directly from a data subject relating to Customer Personal Data, it will not respond to the substance of the request itself, but will promptly forward it to the Controller.
8. Security measures
The Processor implements appropriate technical and organisational measures, including:
Encryption. TLS for all data in transit; encryption at rest at the database layer.
Authentication. Passwords stored only as salted cryptographic hashes. Password reset via single-use, time-limited tokens.
Access control. Row level security policies in the database restrict every query to the workspaces the signed-in user belongs to. Role based permissions (Owner, Admin, Manager, Member) are enforced both in the user interface and on the server, so restricted pages and actions cannot be reached by manipulating a URL.
Tenant isolation. Each customer workspace is logically separated. Membership records determine access, and no query returns data from a workspace the user does not belong to.
Least privilege. Access to production systems is limited to personnel who require it.
Resilience. The Processor relies on managed infrastructure providers with automated backup and recovery.
Review. Measures are reviewed periodically and updated as the Service changes. The Processor may update these measures provided the level of protection is not reduced.
9. Personal data breach
The Processor will notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
The notification will describe, so far as known at the time: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed to address it, and a contact point for further information. Where full information is not immediately available, it will be provided in phases without undue further delay.
The Processor will assist the Controller in meeting its own obligations to notify supervisory authorities and data subjects.
10. Audit
The Processor will make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA.
The Controller may audit the Processor's compliance no more than once in any twelve month period, on at least 30 days' written notice, during normal business hours, and subject to confidentiality obligations — save that an additional audit may be conducted where required by a supervisory authority or following a personal data breach. Audits must not unreasonably disrupt the Processor's business. The Controller bears its own costs and the Processor's reasonable costs of assisting.
11. Deletion and return
On termination of the Service, and at the Controller's choice, the Processor will delete or return Customer Personal Data.
The Controller may export data using the reporting and CSV export features for 30 days after termination. After that period, the Processor will delete Customer Personal Data from live systems within 60 days. Backup copies are overwritten on a rolling basis and residual copies are removed within 90 days of deletion.
The Processor may retain Customer Personal Data to the extent required by law, in which case it will continue to protect it under this DPA and process it only for the purpose requiring retention.
12. International transfers
The Processor is established in Egypt and its sub-processors operate internationally. Customer Personal Data may therefore be transferred outside the UK and the European Economic Area.
Where such a transfer takes place, it is made under appropriate safeguards, including the Standard Contractual Clauses approved by the European Commission and, for UK transfers, the UK International Data Transfer Addendum. Where the Standard Contractual Clauses apply, they are incorporated into this DPA by reference, with the Controller as data exporter and the Processor as data importer, and the details in clause 3 populating the relevant annexes.
13. Liability
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service, except to the extent that applicable data protection law does not permit such limitation.
14. Term
This DPA takes effect when the Controller accepts the Terms of Service and continues until the Processor has ceased all processing of Customer Personal Data.
15. Contact
Data protection contact: info@tedgeltd.com