Data Processing Addendum — Shiftray
Contract document. This DPA becomes binding only when incorporated into or signed with a client project agreement. Client identity, effective date, transfer mechanism, retention schedule and any negotiated changes must be completed before live employee data is processed. Independent legal review is recommended.
Version: 30 September 2026
Processor: KP Strategic Collective, an India-based sole-proprietor business, Shop 3, Shree Lila Apartment, Pataliya Hanuman Road, Padra, Vadodara, Gujarat 391440, India; kpstrategic23@gmail.com
Controller: the client organisation identified in the signed project agreement.
1. Scope and roles
This DPA applies where KP Strategic Collective processes personal data on behalf of the client in providing Shiftray. The client is the controller and KP Strategic Collective is the processor for client workplace data. Each party remains a controller for personal data it independently determines, such as its business contacts, legal records and security investigations.
2. Processing instructions
The processor will process client personal data only on the controller’s documented instructions, including this DPA, the project agreement, authorised configuration and written support requests, unless applicable law requires otherwise. The processor will inform the controller before legally required processing unless prohibited by law. If an instruction appears to infringe applicable data-protection law, the processor will inform the controller and may suspend the affected processing while the parties resolve it.
3. Processing details
| Subject matter | Provision, hosting, maintenance, security and support of Shiftray. |
|---|---|
| Duration | The project/service term plus the agreed export and deletion period. |
| Nature and purpose | Authentication, storage, organisation, display, transmission, support, backup and deletion of workplace rota, announcement and attendance information. |
| Data subjects | Client administrators, employers, employees, workers and authorised users. |
| Personal data | Name, work email, account identifiers, workplace membership, staff category, rota and shift information, instructions, announcements, clock-in/out records, correction/audit information, uploaded paper rota, IP/device data and security logs. |
| Special-category data | Not intended. The controller must not submit special-category or criminal-offence information unless separately documented with a lawful basis and safeguards. |
4. Confidentiality
The processor will ensure that persons authorised to process client personal data are bound by confidentiality and receive access only where needed for their duties.
5. Security
Taking account of risk, the processor will maintain appropriate technical and organisational measures, including HTTPS, managed authentication, unique accounts, role-based workplace access, database access controls, restricted administrative access, provider security controls, secret management, backup/recovery arrangements, correction audit information and incident procedures. The controller is responsible for secure employer accounts, accurate permissions, removal of leavers and appropriate device practices.
6. Sub-processors
The controller gives general written authorisation for the providers in the current Sub-processor List. The processor will impose materially equivalent data-protection obligations on sub-processors, remain responsible for their processing under this DPA, and provide reasonable advance notice of intended changes where practicable. The controller may object on reasonable data-protection grounds. If the parties cannot resolve an objection, either may terminate the affected service under the project agreement.
7. International transfers
The controller acknowledges that the processor is based in India and that international cloud services may be used. Neither party will make a restricted transfer without a valid transfer mechanism. For UK transfers, the parties will complete the UK International Data Transfer Agreement or UK Addendum, transfer details and any required transfer risk assessment before the transfer begins. The processor will not initiate an additional transfer except on documented instructions or under the agreed safeguards.
8. Individual rights
Taking account of the nature of processing, the processor will provide reasonable technical and organisational assistance for access, correction, deletion, restriction, objection, portability and other valid rights requests. If the processor receives a request concerning client-controlled data, it will refer the requester to the controller and notify the controller unless prohibited by law.
9. Breaches and compliance assistance
The processor will notify the controller without undue delay after becoming aware of a personal-data breach affecting client data and provide available information reasonably required for assessment, notification and mitigation. The processor will reasonably assist with security obligations, DPIAs, regulator consultation and worker-monitoring assessments, considering the nature of processing and information available.
10. Audit and information
The processor will make available information reasonably necessary to demonstrate compliance with this DPA. Audits must be proportionate, protect other clients and security, normally use existing independent/provider documentation first, and be arranged with reasonable notice. Additional bespoke audit costs may be charged where permitted by the project agreement.
11. Retention, return and deletion
The controller will document its operational retention periods. At termination, the processor will, at the controller’s choice, return or delete client personal data unless law requires retention. Subject to the agreed export period, live data will be targeted for deletion within 30 days and residual provider-managed backups within 90 days through the normal backup cycle. The processor may retain minimal records needed to demonstrate deletion, comply with law or resolve disputes.
12. Controller obligations
The controller will process data lawfully and fairly; provide worker privacy information; determine lawful bases; assess attendance monitoring and conduct a DPIA where appropriate; issue lawful instructions; minimise free-text information; maintain accurate user access; establish retention periods; and review attendance exceptions before payroll or significant employment decisions.
13. Order of precedence
If this DPA conflicts with the project agreement on data protection, this DPA prevails. The commercial agreement governs fees, general liability and governing law. Mandatory data-protection law prevails over both.
14. Completion before signature
The signed version must identify the controller, effective date, client contacts, approved retention schedule, processing locations, sub-processors, transfer mechanism, security schedule and governing-law provisions.