Data Processing Agreement

1. Roles

Where you use imRoster to process personal data of your team members, you act as the controller and we act as the processor under the GDPR and similar laws.

2. Scope of processing

We process personal data only on your documented instructions to provide the service, and for the duration of your use of imRoster.

3. Security

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and monitoring.

4. Sub-processors

We use the following sub-processors to deliver the service. We remain responsible for their compliance:

• Hosting & infrastructure provider — application hosting and storage.
• Paddle — payment processing, subscription billing, and tax compliance (Merchant of Record).
• Google Analytics — website analytics (consent-based).
• Microsoft Clarity — product insights and heatmaps (consent-based).

5. International transfers

Where personal data is transferred internationally, we use appropriate safeguards such as Standard Contractual Clauses.

6. Sub-processor changes & data subject requests

We will give notice of new sub-processors. We assist you in responding to data subject requests and in meeting your obligations under applicable law.

7. Contact

For DPA matters, email [email protected].