EnglishENPolskiPLDeutschDEEspañolESBahasa IndonesiaID
Start free

Data Processing Agreement

Last updated: October 14, 2026

This Data Processing Agreement (“DPA”) forms part of the SquadBear Terms of Service (the “Terms”) between the Customer (“you”, the controller) and Digital Cloud Piotr Giedziun, ul. Belwederczyków 4/6 lok. 6, 51-688 Wrocław, Poland, NIP 8982181101, REGON 361333472, which provides the service under the name SquadBear (“SquadBear”, “we”, the processor). It applies whenever we process personal data on your behalf to provide the Service. It takes effect when you accept the Terms and needs no separate signature. If your procurement process needs a signed copy, write to legal@squadbear.com.

1. Definitions

“Personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meanings given in Regulation (EU) 2016/679 (“GDPR”). “Customer Personal Data” means personal data that you or your users submit to the Service and that we process on your behalf. “Subprocessor” means a third party we engage to process Customer Personal Data.

2. Roles and scope

You are the controller of Customer Personal Data and we are your processor. Where you are yourself a processor for another controller, we act as your subprocessor, and you are responsible for passing on the instructions and information this DPA requires. This DPA does not cover data for which SquadBear is the controller (sign-in credentials, billing contacts, website and support data). The Privacy Policy covers that data.

3. Details of the processing

Annex 1 sets out the subject matter and duration of the processing, its nature and purpose, the types of personal data and the categories of data subjects.

4. Your instructions

We process Customer Personal Data only on your documented instructions, including with regard to transfers to a third country, unless EU or Member State law requires otherwise. In that case we tell you before processing, unless that law prohibits it on important grounds of public interest. Your complete instructions are the Terms, this DPA, your configuration of the Service and the actions your authorized users take in it, whether in the web app, the REST API, the MCP server or a connected integration. We tell you promptly if, in our opinion, an instruction infringes the GDPR or other data protection law.

5. Your responsibilities

You are responsible for having a lawful basis for the personal data you put into the Service, for the information you give data subjects, for the data region you choose at sign-up, and for the settings, integrations and AI features you enable. If you connect your own AI assistant over MCP, or an integration such as Slack, Microsoft Teams, Jira, GitHub or Linear, the data it receives is sent on your instruction and processed by that provider under your own agreement with it. Those providers are not our subprocessors.

6. Confidentiality

We ensure that every person authorized to process Customer Personal Data is bound by confidentiality, and we limit access to what is needed to run and support the Service.

7. Security

We implement the technical and organizational measures in Annex 2, which are appropriate to the risk as Article 32 GDPR requires. We may update them, provided the overall level of protection does not fall.

8. Subprocessors

You give us general written authorization to engage subprocessors. Annex 3 lists the subprocessors we use, including those that apply only when an optional feature is enabled. The live list for the deployment is published at /api/subprocessors. We impose on each subprocessor, by contract, data protection obligations that give the same level of protection as this DPA, as Article 28(4) GDPR requires, and we remain liable to you for its performance.

We inform you of any intended addition or replacement of a subprocessor at least 30 days before it takes effect, by updating the list and emailing the owners of your workspace. You may object on reasonable data protection grounds within that period. If we cannot reasonably accommodate the objection, you may terminate the affected Service before the change takes effect.

9. International transfers

Your workspace database and files are stored in the data region you chose at sign-up, the European Union or the United States. Requests may be processed on Cloudflare's global network, and some optional subprocessors process data in the United States. Where Customer Personal Data is transferred to a country outside the European Economic Area that has no adequacy decision, the transfer relies on the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 or another transfer mechanism under Chapter V GDPR, as set out in the relevant subprocessor's data processing agreement.

10. Data subject requests

Taking into account the nature of the processing, we help you respond to requests from data subjects exercising their rights under Chapter III GDPR, mainly through features of the Service: every user can export their own data, and an admin can export a person's data and erase a person who has been offboarded. If a data subject contacts us directly about Customer Personal Data, we refer them to you and do not answer the request ourselves.

11. Security, impact assessments and consultation

We help you meet your obligations under Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to us, including by providing the information in this DPA and on our Security page.

12. Personal data breaches

We notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. We send the notice to the email addresses of your workspace owners and include, as far as it is then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We send further information as it becomes available. A notice is not an admission of fault.

13. Return and deletion

While your workspace is active, your admins can export its data with the Service's export features. When the Service ends we delete Customer Personal Data on your written request, and in any case within 90 days, unless EU or Member State law requires us to keep it. Database recovery points held by our hosting provider expire within 30 days after deletion.

14. Information and audits

We make available to you the information necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits, including inspections, by you or an auditor you mandate who is bound by confidentiality. We first answer written questions and provide documentation. An inspection takes place on at least 30 days' notice, no more than once a year unless a personal data breach or a supervisory authority requires otherwise, during business hours and at your cost.

15. Liability, term and precedence

Each party's liability under this DPA is subject to the limitations in the Terms, except where the GDPR does not allow them. This DPA lasts for as long as we process Customer Personal Data on your behalf. If it conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data. It is governed by the same law as the Terms.

Annex 1. Details of the processing

  • Subject matter. Providing the SquadBear service: leave management, time tracking, attendance, team health, core HR, processes and policies, through the web app, the REST API, the MCP server and the integrations you enable.
  • Duration. The term of the Terms, plus the deletion period in section 13.
  • Nature. Hosting, storage, organization, retrieval, calculation (leave balances, coverage, timesheets, attendance), transmission to integrations you enable, export and erasure.
  • Purpose. Providing the Service to you under the Terms.
  • Categories of data subjects. Your employees, contractors and other workers, including joiners and former workers; your managers and administrators; people whose details your users enter, such as emergency contacts, children declared for leave entitlements, and visitors registered at an office kiosk.
  • Identity and contact data. Name, work email, job title, team, manager, country, language, photo and phone number.
  • Employment data. Start date, form of engagement, employment end date, and, where your leave policies use them, career service start date and date of birth; custom fields you define.
  • Leave data. Requests, dates, usage and ledger entries, free-text reasons, cover assignments and attachments such as sick notes.
  • Time data. Time entries and notes, and linked work items from issue trackers such as Jira, GitHub and Linear.
  • Attendance data. Clock-in, break and clock-out records, shifts, correction requests, and kiosk enrolment identifiers.
  • Team health and retrospective data. Ratings, comments, cards and votes. Closing an anonymous run removes the link between a person and their answers.
  • Processes, policies and documents. Tasks, uploaded files, and policy acknowledgments with timestamp, IP address and user agent.
  • Account and security data. Sign-in identifiers, sessions with IP address and user agent, linked Slack, Microsoft, Google or issue-tracker identities, and audit log entries.
  • Special categories. Free-text leave reasons, attachments and some leave types can reveal health data (Article 9 GDPR). You decide whether to collect them, and we treat them as special-category data.

Annex 2. Technical and organizational measures

  • Encryption. HTTPS (TLS) in transit. Database and file storage encrypted at rest by the hosting provider.
  • Workspace isolation. Every query is scoped to the signed-in workspace. A workspace id taken from a request is rejected, and the database refuses a row that points at another workspace.
  • Access control. Four roles (employee, manager, admin, owner) enforced in one domain layer for the web app, the REST API and the MCP server. Managers see only the people their role allows. API keys are hashed at rest and bound to one workspace and an explicit set of scopes. MCP access uses OAuth with approved scopes. When an assistant asks over MCP to change leave policies or entitlements, workspace settings or a person's role or status, to invite or add an admin, to erase a person or to start a process, the change waits until that user approves it, signed in to the app.
  • Authentication. Salted password hashing, optional multi-factor authentication and passkeys, optional Google or Microsoft single sign-on, and rate limiting and bot protection on sign-in and sign-up.
  • Logging. An audit log of administrative and sensitive actions. No personal data is written to operational logs.
  • Data minimization. Date of birth and career service start date are visible only to the person and to admins. Channel digests and default calendar titles show names and dates, never the type of leave. Requests for AI summaries carry no author labels.
  • Data residency. EU or US region chosen at sign-up, with the database and files stored in that region.
  • Retention. Scheduled deletion of notifications, export files and raw team-health and retrospective responses (24 months after close), and optional retention windows for attendance and time records that you set.
  • Resilience. Hosting on Cloudflare's network, with point-in-time recovery of the database.
  • Secrets. Credentials held in a managed secret store, never in source code.
  • People. Access limited to the persons who run the Service, bound by confidentiality.

Annex 3. Subprocessors

  • Cloudflare, Inc. (always). Application hosting, database, file storage, transactional email and optional AI summaries (Workers AI). Database and files in the data region you chose; processing on Cloudflare's global network.
  • Stripe, Inc. (when a paid plan is enabled). Subscription billing: billing contact name and email, and the workspace identifier. United States.
  • Google LLC (when Google sign-in, the shared absence calendar or Google Workspace out-of-office sync is enabled). Authentication and calendar synchronization. United States.
  • Microsoft Corporation (when Microsoft sign-in is enabled). Authentication: account email address. United States.
  • Functional Software, Inc. (Sentry) (when error reporting is enabled for the deployment). In-browser error reports with the workspace identifier and the user's role, and no name, email or user id. European Union (Frankfurt).