This Data Processing Addendum ("DPA") forms part of the Terms of Service between Timothy Short trading as Ordo Operis (Australia) ("Reparo", "processor") and the organisation using Reparo ("you", "controller"). It applies where Reparo processes personal data on your behalf — mainly information about your staff and guests — and is intended to meet Article 28 of the EU and UK GDPR and similar laws. If there's a conflict between this DPA and the Terms about personal data, this DPA wins.
1. Details of the processing
| Subject matter and duration | Providing the Service for as long as your organisation uses it, and until the data is deleted or anonymised under section 9. |
|---|---|
| Nature and purpose | Hosting, storing, organising and displaying your data; sending notifications and emails you trigger; rostering and labour-rule checks; time off, sick calls, leave balances and time & attendance (clock in/out, timesheets and, if you turn it on, a check that staff are at the building when they clock in); roster suggestions you review; workplace safety registers, duress alerts, lone-worker check-ins, building compliance and key registers; support and security. |
| Categories of data subjects | Your staff and other users you invite; guests who submit reports or are mentioned in incident reports; contacts of vendors you add. |
| Types of personal data | Names, work email addresses, roles and building assignments; shifts, breaks, confirmations, swaps, shift offers and labour-rule records; time-off and sick-call requests, availability, leave balances and shift preferences; clock-in/out and break times, timesheet corrections and approvals; if you enable the location check, a one-off location at clock-in (only the distance from the building is stored); optionally date of birth, employment type and pay rate; team chat messages, handover notes, noticeboard acknowledgements, building-compliance check logs, workplace safety reports (incidents, near misses, hazards), duress alerts, lone-worker check-in logs, fire-warden assignments, key-register entries, photos and attachments; guest report content and optional email; signed-in device descriptions and last-used times; device push tokens; activity logs. |
| Special categories | A sick-call or sick-leave record shows that a person was unwell, and a workplace safety incident report may record that a person was injured or unwell and whether first aid was given, which some laws treat as health data. Reparo asks for no medical details on sick calls. You're responsible for the lawful basis for recording sickness absence and workplace safety incidents (for example your employment-law and workplace health and safety obligations). Don't enter other health or special-category data unless you have a lawful basis to. |
2. Your instructions
We process personal data only on your documented instructions — these Terms, this DPA, and your use and configuration of the Service (including roster and labour-rule settings) — unless the law requires otherwise, in which case we'll tell you first unless the law prohibits it. We'll tell you if we think an instruction breaks data-protection law.
3. Confidentiality
Everyone we authorise to process your personal data is bound by confidentiality obligations.
4. Security
We maintain appropriate technical and organisational measures, including: encryption in transit (TLS); hashed passwords; short-lived access tokens with rotating refresh tokens; per-organisation access controls; role-based permissions (for example pay rates visible only to owners and admins); private storage for photos with expiring links; audit logging; and restricted, logged access by our staff (including "view as customer" access that is recorded).
5. Sub-processors
You authorise us to use the sub-processors listed in our Privacy Policy (section 3). Some sub-processors only receive personal data if your owner turns on an optional feature that needs them (currently Anthropic, for the roster assistant); turning the feature on authorises that sub-processor for as long as it stays on. We'll give your organisation's owner at least 30 days' notice by email before adding or replacing any other sub-processor, and you may object on reasonable data-protection grounds; if we can't address the objection, you may terminate the affected Service and receive a refund of prepaid fees for the remaining period. We impose data-protection obligations on each sub-processor that are no less protective than this DPA and remain responsible for their performance.
6. International transfers
We and our sub-processors may process personal data in Australia, the United States and other countries where they operate. Where the EU or UK GDPR requires a transfer mechanism, the EU Standard Contractual Clauses (Module 2, controller to processor, and Module 3 where applicable) and the UK International Data Transfer Addendum are incorporated into this DPA by reference, or we rely on another lawful mechanism (such as the EU–US Data Privacy Framework where a sub-processor is certified).
7. Helping you
Taking into account the nature of the processing, we'll help you respond to requests from individuals exercising their rights (for example by providing data exports and correction tools), and give reasonable help with data protection impact assessments and consultations with regulators.
8. Personal data breaches
We'll notify you without undue delay — and where feasible within 48 hours — after becoming aware of a personal data breach affecting your data, with the information you reasonably need to meet your own notification obligations, and we'll take reasonable steps to contain and remedy it.
9. Deletion or return
When your organisation stops using the Service you can export your data (the owner can download it in the app at any time, or ask us for it). On your request, or when we process your organisation's deletion, we'll delete or anonymise the personal data we process for you, unless the law requires us to keep it. Anonymised operational records may remain.
10. Audits
We'll make available the information reasonably needed to show we comply with this DPA. If that isn't sufficient, you (or an independent auditor bound by confidentiality) may audit us once a year with at least 30 days' notice, at your cost, in a way that doesn't disrupt the Service or compromise other customers' data.
11. Your responsibilities
You're responsible for the lawfulness of the personal data you put into Reparo, for having a lawful basis and giving any required notices to your staff and guests, and for the roster, labour-rule and override settings you choose. If you turn on the clock-in location check, you're responsible for telling your staff beforehand and meeting any workplace-surveillance rules that apply to you (some places require written notice before tracking, for example 14 days in New South Wales and the ACT).
12. Limitation of liability
Each party's total aggregate liability to the other arising out of or relating to this DPA forms part of, and is subject to, the disclaimers and mutual limitation of liability in section 11 of the Terms of Service, to the fullest extent permitted by applicable law.
13. Contact
Questions about this DPA: support@reparoapp.net.