Data Processing Addendum
Last updated February 2026
This addendum forms part of the Terms of Service and applies where ERGON TIME processes personal data on behalf of a customer. The customer is the controller; ERGON TIME is the processor.
Scope and roles
Subject matter: provision of the ERGON TIME platform. Duration: the term of the subscription plus the deletion window. Categories of data subjects: workspace members, employees recorded in HR, customer and supplier contacts, meeting attendees. Categories of data: identification and contact details, employment and payroll figures, commercial and transactional records.
Processor obligations
We process personal data only on the customer's documented instructions, ensure personnel are bound by confidentiality, implement the technical and organisational measures below, assist with data subject requests and impact assessments, and notify the customer without undue delay after becoming aware of a personal data breach.
Technical and organisational measures
Row-level security on every workspace-owned table, enforced through membership helper functions that validate the authenticated user; least-privilege roles with per-member permission overrides; append-only audit and access-trace logging of sensitive operations; encryption in transit; secrets held server-side only; automated tenant-isolation tests and an RLS build guard that fails the release if any workspace table loses protection.
Sub-processors
Hosting, managed Postgres, authentication and storage; transactional email delivery; AI model inference for the analyst and brief features; Slack, only where the customer connects it. We remain responsible for each sub-processor's performance and will give notice of additions.
International transfers
Where personal data leaves its region of origin, transfers rely on the European Commission's standard contractual clauses or an equivalent lawful mechanism.
Deletion and audit
On termination we delete customer personal data within 30 days, except where retention is legally required. On request we make available the information necessary to demonstrate compliance with this addendum.