This page in other languages: Deutsch · Français · Español · Português (Brasil) · Polski · Italiano
Data processing agreement
Last updated: October 11, 2026. When you keep other people's working hours in Clockhund, for example your employees', you are the controller of that data and we process it for you. This agreement sets out how, as Article 28 of the GDPR requires. It is part of our terms and applies automatically, with no signature needed; it is concluded in electronic form (Art. 28(9) GDPR).
1. The parties
Controller: you, the holder of the Clockhund account ("you"). Processor: Dibsido.com s.r.o., Hlinky 995/70, Staré Brno, 603 00 Brno, Czech Republic, company ID 04779568 ("we").
2. What we process
| Topic | Details |
|---|---|
| Subject and purpose | Storing working hours and calculating totals, breaks, overtime, balances and pay, and creating timesheets and payroll files, as the Clockhund service does |
| Nature of processing | Storage, retrieval, calculation, display, export and deletion |
| Data subjects | The people whose hours you keep, usually your employees, workers or contractors |
| Personal data | Names you enter, working days (start, end, breaks or hours), notes, hourly rates, contract hours and the resulting totals. If you choose "Read with AI", the text or photo you send for reading |
| Special categories | None are required. Please don't enter health data or other special categories of data (Art. 9 GDPR) in names or notes |
| Duration | As long as your account exists, then as described in section 8 |
3. Your instructions
We process the data only to provide Clockhund to you and on your documented instructions, which are the terms, this agreement and what you do in the app. You can give further instructions by email. If an instruction appears to us to break data protection law, we tell you. We process the data otherwise only where EU or Czech law requires it, and then tell you first unless that law forbids it.
4. Confidentiality and security
- Everyone at Dibsido.com s.r.o. with access to the data is bound by confidentiality.
- We take appropriate technical and organisational measures (Art. 32 GDPR), including: encryption in transit (HTTPS) and at rest at our database provider; separation of each account's data in the application; login links and sessions stored only as one-way hashes; access to production systems limited to the people who need it, with personal accounts; backups at our database provider; and an information security management system certified to ISO/IEC 27001. We may update the measures as long as the level of protection does not fall.
5. Sub-processors
You give general authorisation for us to use these sub-processors:
| Sub-processor | What for | Location |
|---|---|---|
| Vercel Inc. | Hosting the website and the app | EU (Frankfurt, Germany); US company |
| Neon Inc. | Database hosting for accounts and saved hours | EU (Frankfurt, Germany); US company |
| Resend | Sending login links and service emails (your email address only, not the hours) | EU (Dublin, Ireland); US company |
| Anthropic PBC | Reading imported text and photos, only when you choose "Read with AI"; not used for training, deleted within 30 days | USA |
We bind each sub-processor by a written agreement to data protection obligations that offer at least the same protection as this agreement. We announce a new or replaced sub-processor on this page and by email to account holders at least 30 days in advance; you can object, and if we can't resolve the objection you can end the subscription and get a refund of the unused period. We remain responsible to you for our sub-processors.
6. Transfers outside the EEA
The hours and accounts are stored and processed in the EU. Vercel, Neon and Resend are US companies, so access from the USA (for example by their support) can't be ruled out; Anthropic processes AI readings in the USA. Where data is processed or accessed outside the European Economic Area, the transfer relies on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.
7. Helping you
- Requests from the people: you can view, correct, export (PDF, CSV) and delete their hours in the app. If one of them contacts us directly, we forward the request to you and don't answer it ourselves.
- Breaches: we tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data, with the information we have, so you can meet your own duties under Art. 33 and 34 GDPR.
- Assessments: we give you reasonable help with data protection impact assessments and prior consultations with authorities, as far as they concern Clockhund.
8. At the end
You can download the data at any time as PDF and CSV, and on request as a JSON file. When you delete your account, or ask us to, we delete the people and hours in it at once, and copies in backups expire within 30 days, unless EU or Czech law requires us to keep them. We confirm the deletion on request.
9. Audits
We make available the information needed to show that we meet these obligations, starting with our ISO/IEC 27001 certificate. If that is not enough, you or an auditor you appoint who is bound by confidentiality may audit us, with reasonable notice, during working hours and at most once a year unless a breach or an authority requires more. Each side bears its own costs.
10. Other terms
The liability provisions of our terms apply. If this agreement and the terms conflict on data protection, this agreement prevails. It is governed by Czech law. Questions: hello@clockhund.com.