Data Processing Agreement (DPA)
Version 2026-10-17-v3
Parties
This Data Processing Agreement ("DPA") under Article 28 GDPR applies between the client company ("Controller") and ByteSense ("Processor"), run by a sole trader resident in Ireland, for the personal data processed in the Zelo application.
1. Subject matter, purpose and duration
• Subject matter and purpose: the Processor processes personal data only to provide the services described in the Terms of Use, namely route planning, team scheduling and GPS-validated attendance management. • Duration: processing continues for as long as the Customer's account is active, until the account is closed and the data is deleted from the production databases.
2. Instructions and compliance
The Processor processes personal data only on the Controller's documented instructions, which are the use of the system and the terms of this agreement. The Processor will immediately inform the Controller if, in its opinion, an instruction infringes the GDPR.
3. Personnel and confidentiality
Anyone processing data at ByteSense is bound by confidentiality. The application's administration screens do not display the Customer's client lists or photos. The Controller acknowledges that infrastructure keys and cloud consoles may technically allow direct database access for support, emergency recovery or diagnosing incidents.
4. Technical and organisational measures
The Processor applies appropriate technical and organisational measures, including: • Isolation of each company's data by row-level security rules enforced in the database. • Encrypted connections (HTTPS) and encryption of data at rest. • Role-based access (manager, route manager, staff) in the application. • Two-factor authentication for platform administration logins. • Automatic logging of administrative actions and of when a user opens a client's confidential access information. Direct database console queries are not captured in the application's audit logs.
5. Sub-processors
• Authorised list: the Controller authorises the use of Supabase, Inc., Vercel, Inc., Stripe, Inc., Resend, Inc., Cloudflare, Inc. and Google LLC. • Terms: the Processor engages these sub-processors under their standard data processing terms, with data protection obligations materially consistent with and no less protective than this DPA. • Changes: the Processor will give advance notice before adding or replacing a sub-processor, and the Controller may object on legitimate data protection grounds.
6. Data subject rights
The Processor helps the Controller answer requests for access, correction, deletion and portability through the tools built into the application. For data extractions beyond the CSV exports available in the app, the Processor will assist the Controller on request.
7. Breach notification
The Processor will notify the Controller without undue delay, and no later than forty-eight (48) hours after becoming aware of a confirmed personal data breach affecting the Customer's data, with the information the Controller needs to meet its reporting duties.
8. Regulatory assistance
The Processor will provide reasonable assistance to the Controller with its obligations under Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to the Processor, in particular on data security, breach notifications and technical information about the geofence validation.
9. Termination and erasure
When the account closes, the Controller can export the report data available in the app. On a formal request to terminate the account, the Processor will manually erase the company's database records and files from the production environment within thirty (30) days. • Backups: the Controller acknowledges that data in automated cloud backups (such as Supabase snapshots) cannot be erased individually. These copies stay protected and are overwritten under the provider's standard backup cycle of approximately seven (7) days.
10. Audit
The Processor makes available the information needed to show compliance with this DPA and cooperates with reasonable audits or inspections by the Controller or an independent auditor it appoints. Any audit requires at least thirty (30) business days' prior written notice, must not disrupt the infrastructure, and its costs are borne by the Controller.
Annex: details of processing (Art. 28(3) GDPR)
1. Categories of data subjects • Employees, field staff, cleaners and contractors registered by the Controller to use the platform. • Residential clients and householders whose service records are managed by the Controller. (Data about account holders, for which ByteSense is an independent controller, is outside the scope of this DPA.) 2. Categories of personal data • Staff and users: name, email, interface language, system roles, contact phone (managers only), work records (check-in/out times, GPS position and accuracy at those moments, distance to the address, geofence status), justifications of manual corrections, 90-day check-in attempt log and log of access to confidential information. • Clients and householders: name, address, phone, email, notes, house coordinates, Eircode, confidential access information (alarm or key codes) and visit photos or incident reports.