Data Processing Agreement

• Business (or "Controller") — the business using Akordo, represented by its Owner.
• Akordo (or "Processor") — the individual operating Akordo.
• Customer Personal Data — personal data about the Business's Owners, Managers, Employees and invitees that the Business or its team puts into Akordo.
• Sub-processor — a provider Akordo uses that may process Customer Personal Data.
• Data Protection Law — the Law on Protection of Personal Data of the Republic of Kosovo and, where it applies, the EU General Data Protection Regulation (GDPR). Other terms, such as "personal data breach", have the meaning given in that law.

For Customer Personal Data, the Business is the controller and Akordo is the processor.

This DPA does not cover data for which Akordo is itself the controller: a person's Account (login, name, email, photo, phone and language), billing and payment data, and support messages. That data is described in our Privacy Policy.

• Subject matter and purpose: providing Akordo to the Business — team management, scheduling, availability, time off, shift swaps and open shifts, tasks, announcements, notifications, and Owner-only labor cost reporting.
• Duration: for as long as the Business uses Akordo, and afterwards until the data is deleted as described in section 9.
• Nature of processing: storing, organising, displaying to authorised members of the Business by role, calculating (for example, schedule conflicts and labor cost), sending notifications by in-app message, email and push, and deleting.
• Data subjects: the Business's Owners, Managers, Employees and invited people.
• Categories of data: name, email, role, membership status, home location, department and position, employee code, hire date; shifts, breaks and shift notes; availability; time-off requests and reasons; shift swap and open-shift activity; request decisions; tasks; announcements and read receipts; notifications; hourly pay rates and labor cost (Owner-only).
• Special categories: none are intended. The Business should not enter health or other sensitive data, for example in time-off reasons or notes.

Akordo will:

• process Customer Personal Data only on the Business's documented instructions — these terms and the Business's use of the app's features are those instructions — unless the law requires otherwise, in which case Akordo will tell the Business first unless the law forbids that;
• make sure anyone authorised to process the data is bound by confidentiality;
• apply the security measures in section 11 and keep them appropriate to the risk;
• help the Business, taking into account the nature of the processing, to respond to requests from data subjects exercising their rights, and to meet its obligations on security, breach notification and impact assessments;
• not use Customer Personal Data for any other purpose, sell it, or use it for advertising.

The Business is responsible for having a lawful basis for the data it puts into Akordo, for informing its staff, for the accuracy of that data, and for giving only lawful instructions. It is responsible for who it gives Owner and Manager roles to, since those roles see more data.

If Akordo becomes aware of a personal data breach affecting Customer Personal Data, it will notify the Owner without undue delay, describing what is known about the breach, the data and people likely affected, its likely consequences, and the measures taken or proposed. Akordo will then keep the Business informed and help it meet its own notification duties.

The Business gives Akordo general authorisation to use sub-processors. The current list is in section 12. Akordo makes sure each sub-processor is bound by data protection obligations at least as protective as this DPA, and remains responsible to the Business for them.

Akordo will update the list and email Owners before adding or replacing a sub-processor. If the Business has a reasonable data protection objection, it can tell us at support@akordoapp.com; if we cannot resolve it, the Business may stop using Akordo, as described in the Terms.

Akordo's database and files are stored in the EU (Frankfurt, Germany). Some sub-processors may process data outside the EU and Kosovo, as stated in section 12. Where that happens, Akordo relies on appropriate safeguards required by Data Protection Law, such as the EU Standard Contractual Clauses offered by those providers.

If a Business stops paying, its data stays frozen in the Restricted state until the Owner pays again or asks for deletion. On the Owner's request at support@akordoapp.com, Akordo deletes the Business and its Customer Personal Data, except where the law requires it to be kept, and confirms by email when it is done.

Some data is deleted automatically while the service runs, as set out in the retention section of our Privacy Policy.

Akordo will make available, on reasonable request, the information needed to show that it meets this DPA. Requests should go to support@akordoapp.com, be reasonable in scope and frequency, and respect the confidentiality and security of other customers.

• Tenant isolation: every Business's data carries its own business identifier and is separated by row-level security rules enforced in the database itself, not only in the app.
• Role-based access: Owners, Managers (only their assigned locations) and Employees (their own home location's published schedule and their own records) each see only what their role allows; draft schedules are hidden from Employees in the database.
• Least privilege: direct database access for signed-in users is limited to what each feature needs; sensitive actions go through checked database functions. Pay rates are readable by Owners only.
• Encryption in transit: all traffic uses HTTPS. Push notification contents are encrypted end to end to the device.
• Authentication: passwords are stored only as secure hashes by the authentication provider; password reset uses single-use, expiring links.
• Data minimisation: notifications, delivery records and similar data are deleted automatically on a schedule; deactivated members lose access immediately.
• Hosting: the database runs on managed infrastructure in the EU, with the provider's own physical and operational security.

Akordo currently uses these sub-processors:

• Supabase, Inc. — database, authentication and file storage (including profile photos). Location: EU, Frankfurt (Germany) region.
• Cloudflare, Inc. — application hosting, content delivery and page cache. Location: Cloudflare's global network; requests are handled near the user.
• Resend — delivery of notification emails. Location: United States.

Push notifications, when a user turns them on, are delivered through the push service run by that user's browser maker (for example Google, Apple or Mozilla). Akordo encrypts their contents so the push service cannot read them.

Each party's liability under this DPA is subject to the limitations in the Terms of Service. This DPA is governed by the same law as the Terms. If this DPA and the Terms conflict on data protection, this DPA applies.