Version 1.1 · 1 November 2026
1. Roles
The customer is the controller of its users' personal data. The operator is the processor, acting only on the customer's documented instructions, which are to provide the Calcutab service as described in the Terms.
2. What is processed
| Category | Data | Source |
|---|---|---|
| Identity | name, email address, profile picture URL | the user's Google or Atlassian sign-in; for a person without a login, the name only, typed by a manager |
| Working time | days, hours and minutes logged, per calendar day, per product, marked as new development or maintenance and by lifecycle phase | entered by the user, or by a manager on their behalf |
| Organisation | job role, skill band, team, department, day rates attached to those | entered by the customer's managers |
| Jira activity | issue keys and summaries the user touched, and the day; never comment bodies | pulled from the customer's Jira when the customer connects it |
| Slack | the user's Slack user id, looked up by email once | when the customer connects Slack |
| Audit | who changed what and when | generated by the service |
Data subjects are the customer's employees and contractors whom the customer records in Calcutab: those given a seat, who sign in, and those a manager records by name without a login, who never sign in and hold no seat. For a person without a login we hold their name, the time logged for them, the organisation details above and the audit trail; never an email address, a photo, Jira activity or a Slack id.
3. Duration
For the term of the agreement, then deletion as set out in the retention statement.
4. Processor obligations (Art. 28(3))
- Instructions. We process only as instructed; we will tell you if an instruction appears to infringe data protection law.
- Confidentiality. Everyone with access to the data is bound by confidentiality.
- Security (Art. 32). Set out in section 6.
- Sub-processors. Only those in section 7; we will give 30 days' notice of any change, and you may object.
- Data subject rights. We will help you respond: a user's data can be exported and deleted on your instruction.
- People without a login. They cannot sign in, so they cannot download or erase their own data. A request from one reaches you; a manager exports or erases their data from their profile, and we will help as for any data subject.
- Breach notification. We will notify you without undue delay after becoming aware of a personal data breach, with what we know at the time and updates as we learn more. Our internal procedure is written down and rehearsed (
docs/incident-response.md). Your 72-hour clock to the supervisory authority runs from when we tell you, and we know that. - Deletion and return. On termination, you export; we delete per the retention statement, and confirm in writing on request.
- Audit. We will make available the information needed to demonstrate compliance and allow audits by you or an auditor you mandate, on reasonable notice.
5. Where data is
The EU. The application runs on Google Cloud Run in europe-west1 (Belgium) and the database on Neon in AWS eu-central-1 (Frankfurt). Backups stay in the EU. No transfer outside the EU/EEA is made by the service itself; see the sub-processor list for what each sub-processor commits to.
For a customer in Canada this is a transfer out of Canada. PIPEDA permits a transfer for processing where the customer remains accountable for the data and secures comparable protection by contractual means; this agreement is that means. Quebec's Law 25 additionally requires the customer to carry out a privacy impact assessment before communicating personal information outside Quebec, and to have a written agreement in place; this agreement, with sections 6 and 7, is written so that the assessment can be completed from the document.
6. Security measures (Art. 32)
- Every customer's data is isolated by tenant identifier on every query, and the database itself enforces it: cross-tenant references are rejected by composite foreign keys.
- Credentials the customer entrusts to us (Jira API tokens, Slack tokens) are encrypted at rest with AES-256-GCM; the key is held outside the database, in Google Secret Manager, and never in the repository.
- All traffic is TLS. Session cookies are Secure, HttpOnly, SameSite. A per-request Content-Security-Policy is sent on every page.
- Access levels are enforced server-side; money figures are never sent to a browser whose user may not see them.
- An append-only audit trail records rate, membership, settings and on-behalf changes.
- Backups are taken with the restore procedure rehearsed, not assumed.
- Alerting notifies the operator if the service or its database becomes unreachable.
- Passwords, where a workspace uses them rather than Google or Atlassian, are stored as salted scrypt hashes and never in a readable form. Invitation and password-reset tokens are stored only as their SHA-256, so a leaked database completes neither.
- Fifteen automated checks run against a deployment before release, covering tenant isolation, access levels, session forgery and information disclosure.
What is not in place, stated so it is not discovered: no independent penetration test, no on-call rota, no SOC 2 or ISO 27001 certification. See /security for the same list in full.
7. Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Google Cloud (Cloud Run, Secret Manager, Cloud Monitoring, Cloud Scheduler) | running the application, holding secrets, alerting, the two scheduled jobs | europe-west1 (Belgium); Google's own DPA applies |
| Neon | the PostgreSQL database | AWS eu-central-1 (Frankfurt) |
| Resend | invitations, password resets, reminders and the weekly digest | EU region; their DPA applies |
| Google (sign-in) | authentication only; we receive name, email address and picture | per their terms |
| Atlassian (sign-in) | authentication only, if used: name, email address and account id | per their terms |
| Atlassian Jira | only if you connect it, and only reading what section 2 lists | your own instance |
| Slack | only if you connect it, to deliver reminders | your own workspace |
No other sub-processor is used. This list is the complete one; a change to it is a change to this document, and section 4 says how you are told.
8. Law
This agreement is governed by the law of the Federal Republic of Germany and forms part of the Terms of Service. Where the GDPR and that law differ, the GDPR prevails.
This agreement is intended to satisfy, and not to limit, the rights a data subject holds under Canada's PIPEDA or Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25.
9. Contact
Data protection enquiries, data subject requests and breach notifications: support@calcutab.com.
We acknowledge a data subject request within 72 hours and answer it within the month the GDPR allows. A personal data breach affecting your data is notified to you without undue delay and in any event within 72 hours of us becoming aware of it.