TeamAgenda
Data Processing Agreement
The terms under which TeamAgenda processes personal data for the businesses that use it, as required by Article 28 of the UK GDPR.
Last updated 21 October 2026
1. Parties and scope
This agreement is between the business using TeamAgenda (“the Customer”, the controller) and TeamAgenda (“TeamAgenda”, the processor). It forms part of the Terms of Service and applies whenever TeamAgenda processes personal data for the Customer. Words such as “controller”, “processor”, “personal data” and “personal data breach” have the meanings given in the UK GDPR.
2. Details of the processing
| Subject matter | Providing the TeamAgenda service: scheduling, punch clock, absence, documents, messaging and payroll preparation. |
|---|---|
| Duration | For as long as the Customer uses TeamAgenda, and until the data is deleted under section 10. |
| Nature and purpose | Storing, organising, displaying, calculating with, sending and deleting personal data so the Customer can manage its workforce. |
| Data subjects | The Customer's employees, workers, managers, former staff and any other users the Customer invites. |
| Personal data | Identity and contact details; profile photos; employment details; pay rates, salary and (if added) National Insurance number, tax code and bank details; schedules, punch times and the location checked at punch-in; absence records and balances; documents, contracts and payslips; messages; login and activity records. |
| Special category data | Sickness absence (health), and any other special category data the Customer chooses to upload, for example in documents. |
3. TeamAgenda's obligations
TeamAgenda will:
- process personal data only on the Customer's documented instructions (which are these terms and the Customer's use of the Service), unless the law requires otherwise, in which case TeamAgenda will tell the Customer first unless the law forbids it;
- tell the Customer if it believes an instruction breaks data protection law;
- make sure everyone authorised to process the data is bound by confidentiality;
- take appropriate technical and organisational security measures (section 5);
- only use sub-processors as set out in section 6;
- help the Customer respond to requests from people exercising their rights, taking into account the nature of the processing;
- help the Customer meet its security, breach notification, impact assessment and consultation obligations;
- delete or return the data at the end of the service (section 10);
- make available the information needed to show it meets these obligations, and allow and contribute to reasonable audits (section 9).
4. The Customer's obligations
The Customer is responsible for the lawfulness of the data it puts into TeamAgenda, including having a lawful basis (and a condition for any special category data), giving its staff appropriate privacy information, and setting up users and permissions appropriately.
5. Security
TeamAgenda's measures include:
- encryption in transit (HTTPS) and at rest;
- data hosted in the United Kingdom (London);
- strict separation of each customer's data, and role-based access within each customer;
- two-factor login available, and enforceable for retailers and admins;
- private file storage, with files only served to signed-in users who have permission;
- an audit log of changes made in the Service;
- regular backups, and access to production data limited to staff who need it.
6. Sub-processors
The Customer gives general authorisation for TeamAgenda to use sub-processors. TeamAgenda will put contracts in place that protect the data to the same standard as this agreement, and remains responsible for its sub-processors. TeamAgenda will give at least 30 days' notice of a new sub-processor, by email or in the app; the Customer may object on reasonable data protection grounds, and if the parties can't resolve it, the Customer may end the affected service. Current sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Hosting the website and app servers | United Kingdom (London region); company in the USA |
| Supabase Inc. | Database, file storage and logins | United Kingdom (London region); company in the USA |
| Resend, Inc. | Sending emails (invites, password resets, notifications) | European Union (Ireland); company in the USA |
| Expo (650 Industries, Inc.) | Delivering phone notifications, with Apple and Google | USA |
| Apple Inc. and Google LLC | Push notification delivery to phones | USA |
7. International transfers
TeamAgenda stores the Customer's data in the UK. Where a sub-processor processes it outside the UK, TeamAgenda will make sure the transfer is covered by UK adequacy regulations or by the UK International Data Transfer Agreement or Addendum, with any additional measures needed.
8. Personal data breaches
TeamAgenda will tell the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Customer's data. It will provide the information the Customer needs to assess the breach and meet its own reporting obligations, and take reasonable steps to contain it.
9. Information and audits
On request, TeamAgenda will provide information reasonably needed to show compliance with this agreement. If that isn't enough, the Customer may carry out an audit, on reasonable notice, no more than once a year (unless required by a regulator or after a breach), at its own cost and subject to confidentiality.
10. Deletion at the end
When the Customer's account ends, the Customer can export its data for 30 days. TeamAgenda then deletes all of the Customer's personal data, including users' logins and files, unless the law requires it to keep some. Data disappears from rolling backups within a further 30 days. The Customer can also ask for deletion at any time by emailing privacy@teamagenda.co.uk.
11. Liability
Liability under this agreement is subject to the limits in the Terms of Service, except where the law doesn't allow liability to be limited.
12. Contact
Data protection contact: privacy@teamagenda.co.uk.