Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between High Mesa Ltd, trading as Yumee, Company No. 13626375, 123 Kings Mill Way, Denham, Uxbridge UB9 4BT ("Processor", "we") and the organisation that holds the Yumee Workforce account ("Controller", "you"). It applies to all personal data we process on your behalf under the UK GDPR and the Data Protection Act 2018 (and, where applicable, the EU GDPR). It is accepted electronically when you create an account; a signed copy is available on request.

1. Subject matter, duration, nature and purpose

We process personal data of your employees and panel users solely to provide the Yumee Workforce time-and-attendance service (clock-in/out via kiosk tablets, optional facial recognition and photo capture, rota, absence and payroll reporting, and the management panel). Processing continues for the duration of the subscription and the 30-day post-termination export window, after which data is deleted (Section 8).

2. Categories of data subjects and personal data

Data subjects: your employees, workers and contractors; your panel users (managers, HR, administrators). Personal data: identification data (name, employee number, job title, site/department), contact details, employment and pay data (rates, contract type, holiday entitlement), HMRC and bank details entered by you (National Insurance number, tax code, sort code and account number), attendance data (clock times, breaks, lateness, overtime, device and site used), absence records, documents you upload, and technical data (IP address, device identifiers). Special category data: where you enable facial recognition, biometric templates derived from a face photograph and the reference photograph itself; where you enable photo capture, photographs taken at clock-in/out.

3. Your obligations as Controller

You warrant that you have a lawful basis for the processing, including — for biometric data — explicit consent from each employee (which the Service records with a timestamp) or another valid Article 9 condition, and that you have provided the information required by Articles 13 and 14 to your staff. You are responsible for the accuracy of data you enter, for configuring retention periods appropriately, and for managing user access and roles in the panel.

4. Our obligations as Processor (Article 28(3))

We will: (a) process personal data only on your documented instructions, which are the Terms, this DPA and your use of the panel's features; (b) ensure that persons authorised to process the data are bound by confidentiality; (c) implement the technical and organisational measures in Section 6; (d) engage sub-processors only under Section 5; (e) assist you, taking into account the nature of the processing, in responding to data subject requests through the panel's export, correction and deletion tools; (f) assist you with security, breach notification and data protection impact assessments; (g) delete or return all personal data at the end of the service (Section 8); (h) make available the information necessary to demonstrate compliance and allow for audits under Section 9; and (i) inform you immediately if we believe an instruction infringes data protection law.

5. Sub-processors

You give general authorisation to the following sub-processors. We will notify account administrators by email at least 30 days before adding or replacing a sub-processor; you may object on reasonable grounds, in which case either party may terminate the affected service.

Sub-processors are limited to UK/EU-based hosting, transactional email, payment collection and abuse protection providers. The current list (name, purpose, location) is provided to account administrators in the panel and to any customer or their Data Protection Officer on request at support@yumeeservices.com.

6. Security measures (Article 32)

Data is encrypted in transit (TLS 1.2+) and at rest. Access to production systems is limited to named High Mesa Ltd staff using multi-factor authentication and is logged. Tenant isolation is enforced by server-side authorisation rules on every read and write; each kiosk tablet is bound to a single organisation and site and can be blocked remotely. PINs are stored as salted hashes; biometric templates are stored only with the facial-recognition sub-processor and are not images. Every change made in the panel is written to an immutable audit log with the acting user. Backups are retained within the same region. Our support staff access your organisation only through time-limited, audited support sessions that are visible to you in the audit log.

7. Personal data breaches

We will notify you without undue delay, and in any event within 48 hours of becoming aware, of a personal data breach affecting your data, providing the information reasonably required for you to meet your Article 33 obligations, and will cooperate in the investigation and remediation.

8. Return and deletion

You may export all organisation data (JSON) and each employee's data at any time from the panel. On termination, data remains exportable for 30 days, after which biometric templates, photographs, records and account data are permanently deleted from our systems and those of our sub-processors, except invoices and accounting records we must retain by law (6 years). Employee biometric data is deleted immediately when you remove an employee's face, record a withdrawal of consent, or mark the employee as a leaver with deletion.

9. Audit

On request no more than once per year (or following a breach), we will provide reasonable information, including summaries of our security practices and sub-processor arrangements, and will allow an audit by you or an independent auditor bound by confidentiality, at your cost, with at least 30 days' notice and during business hours.

10. International transfers

Personal data is stored and processed in the United Kingdom. Where a sub-processor provides support from outside the UK, transfers are covered by the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum.

11. Liability and term

Liability under this DPA is subject to the limitations in the Terms of Service. This DPA takes effect on account creation and continues until all personal data has been deleted or returned. Contact for data protection matters: support@yumeeservices.com.