Data Processing Agreement

1. Definitions

"Data Protection Laws" means the laws that apply to the processing of personal data under this DPA, including, where they apply, the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended ("CCPA") and similar US state laws.

"Personal Data", "Processing", "Controller", "Processor", "Data Subject" and "Supervisory Authority" have the meanings given in the GDPR. "Customer Personal Data" means the Personal Data TaskQo processes on the Customer's behalf. "Sub-processor" means a third party TaskQo engages to process Customer Personal Data. "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

2. Roles

The Customer is the Controller (or, where the Customer acts for another business, a Processor) of Customer Personal Data. TaskQo is the Processor (or Sub-processor). For the CCPA and similar laws, TaskQo is a "service provider" / "processor".

TaskQo never decides what is captured, from whom, or for how long. Those are the Customer's choices, made in the service, and they are the instructions this DPA refers to.

3. Instructions

TaskQo processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA, the settings the Customer chooses in the service (what is captured, for whom, for how long) and requests made through support are those instructions. TaskQo will tell the Customer if, in its opinion, an instruction breaks Data Protection Laws, unless the law forbids it.

TaskQo does not sell or share Customer Personal Data, does not use it for its own purposes outside providing and securing the service for the Customer, and does not combine it with personal data from other sources except as needed to provide the service. Customer Personal Data, including audio and transcripts, is never used to train or improve TaskQo’s or any vendor’s models.

TaskQo may create statistics about how the service itself performs — volumes, error rates, cost — provided they do not identify the Customer, any of its people, or anyone appearing in its data, and cannot be used to do so.

4. Details of the processing

• Subject matter and purpose: providing the TaskQo workforce service — time and activity tracking, productivity and quality analysis, AI assistance, schedules, timesheets and pay, training, notifications and reports.
• Duration: for as long as the Customer uses the service, then until deletion under section 12.
• Data Subjects: the Customer's team members (employees and contractors), the Customer's users and administrators, and people who appear in recorded calls or on captured screens.
• Categories of data: names, work email addresses and phone numbers; device and computer information; and, from what the Customer has switched on, hours worked, and which application and website is in front (names, not contents), screenshots of the work screen, at the interval the Customer sets, short screen recordings of a shift, counts of key presses and mouse clicks per minute — counts, not what was typed, typed-text activity, with anything that looks like a password masked on the computer before it is sent, location readings from the operating system while a shift is running, call audio, transcripts, summaries and a review of how the call was handled, devices plugged in, restarts and computer health and training progress, assessment answers and results; schedules, time and pay records; performance, training and quality results.
• Special categories: not required by the service. The Customer must not configure the service to collect them; where they appear incidentally (for example on a screen or in a call), they are processed only as part of the same data.
• Frequency: continuous while a shift is running, and not at any other time.

TaskQo keeps a record of the categories of processing it carries out for the Customer and makes the Customer's entry available on request.

5. The Customer's responsibilities

The Customer is responsible for having a lawful basis for the processing, for giving its team members the notices and obtaining the consents the law requires (the service provides a consent and recording-notice step for this), for the settings it chooses, and for the accuracy of the data it provides.

The Customer is responsible for deciding that monitoring of this kind is lawful where its people are, and for switching off anything it cannot justify. TaskQo provides the switches and the evidence; it does not advise on whether a particular use is lawful.

6. Confidentiality

TaskQo ensures that people it authorises to process Customer Personal Data are bound by confidentiality. TaskQo staff do not see an agency's people data in the normal course of operating the service; the platform console shows settings and totals only.

TaskQo staff cannot open a Customer's people data: the platform console shows settings and totals only, and the support sessions that once let staff work inside a workspace are switched off. Where a support request needs a look at the data, the Customer's own owner or admin does it and shares what is needed.

7. Security

TaskQo maintains the technical and organisational measures described in Annex 2 and may improve them over time, provided the overall level of protection is not reduced.

8. Sub-processors

The Customer authorises TaskQo to use the Sub-processors listed at https://app.taskqo.com/subprocessors and in Annex 3. TaskQo imposes on each one data protection terms that protect Customer Personal Data to the standard of this DPA, and remains responsible for their performance.

TaskQo announces a new Sub-processor at least 30 days before it starts processing Customer Personal Data, by updating that page and emailing the Customer's owners. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may end the affected part of the service and receive a refund of prepaid fees for it.

A Sub-processor that stops being used is removed from the list. Where the Customer's own choices decide which vendors are involved — the AI tier it picks, the apps it connects — only the vendors its choices engage receive its data.

9. Where the processing happens

TaskQo's application servers and database are in Malaysia. Screenshots, recordings and call audio are stored with Cloudflare R2 and encrypted with a key held for the Customer alone; an owner may choose a United States data region for those files where the platform offers one. AI processing happens at the vendors listed in Annex 3, in the countries named there.

10. Data Subject requests and assistance

The service lets the Customer access, export, correct and erase a person's data itself. If TaskQo receives a request directly from a Data Subject about Customer Personal Data, it passes it to the Customer and does not answer it except on the Customer's instruction. TaskQo gives reasonable help with data protection impact assessments and consultations with Supervisory Authorities that concern the service.

11. Security Incidents

TaskQo notifies the Customer without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice goes to the Customer's owners by email and includes what is known about the nature of the incident, the data and people affected, the likely consequences and the measures taken; further details follow as they become known. Questions: admin@taskqo.com.

TaskQo does not notify Data Subjects or Supervisory Authorities on the Customer's behalf unless the Customer asks it to, because the Customer is the Controller and the decision is its own.

12. Deletion and return

The Customer can export its data while its workspace is open, in CSV for records and in the original format for files. When the Customer closes the workspace, it remains restorable for 30 days and is then deleted, including stored files; TaskQo emails a deletion certificate. Copies in backups expire within 30 days. Billing records that the law requires TaskQo to keep are retained without names or email addresses.

Within the service, the Customer's retention settings decide how long each kind of data is kept; the defaults are published in the service and in the Privacy Policy.

13. Audits and information

TaskQo makes available the information reasonably needed to show compliance with this DPA. Where that is not enough, the Customer may, at most once a year and with 30 days' written notice, have an independent auditor bound by confidentiality review TaskQo's compliance, at the Customer's cost, in a way that does not disrupt the service or expose other customers' data. A Supervisory Authority exercising its own powers is not limited by this section.

14. Government and law enforcement requests

If TaskQo receives a demand for Customer Personal Data from a public authority, it will redirect the requester to the Customer where it can, will not produce data unless legally required, will produce only what the demand covers, will challenge it where there are grounds, and will tell the Customer in time to seek protection unless the law forbids it.

15. Suspension, unpaid bills, and the end of the service

Suspension is not deletion. If the Customer's account is suspended, or its tokens run out, the service stops producing anything new — no screenshots, screen recordings, call audio, AI analysis or assistant — but Customer Personal Data stays exactly where it is and the Customer can still read it, export it and delete it. Nothing is deleted because of money owed, and no connected application is disconnected.

While an account is out of tokens the desktop app does not start, so no time is recorded either. The Customer remains the employer and remains responsible for recording the hours its people work; TaskQo is not a system of record while it is stopped. A shift that was already running can still be closed, so hours already worked are not lost.

Deletion continues to work throughout, because a Processor that blocked it would stop the Customer answering its own people under section 10. A person whose tracker will not start is told to contact their agency, and is not told anything about the Customer’s account.

If the Customer does not return, its workspace follows the closure path in section 12: it remains restorable for 30 days, then everything is deleted and a deletion certificate is emailed. The Customer may also close the workspace itself at any time and need not give a reason.

If TaskQo decides to stop providing the service, or any part of it, it gives the Customer at least 90 days' notice, keeps export working throughout, and does not delete anything until that period has run. TaskQo does not treat Customer Personal Data as an asset: it is never sold, transferred to another company as part of a deal, or used to start another service.

16. Where the Customer is itself a Processor

Many Customers are outsourced service providers — a call centre, a back-office team, an agency working for other businesses. In that case the Customer is a Processor for its own clients and TaskQo is a Sub-processor. This section applies to it.

• The Customer confirms it has its clients' authorisation to engage TaskQo as a Sub-processor, and that its contracts with them allow this processing.
• Where the Standard Contractual Clauses apply, the parties use Module Three (processor to sub-processor).
• A request, instruction or objection that reaches TaskQo from the Customer's client is passed to the Customer; TaskQo acts only on the Customer's instructions, never on its client's directly.
• The Customer remains responsible to its clients for everything TaskQo does under this DPA, and for making sure the settings it chooses match what its clients have agreed to.
• TaskQo has no relationship with the Customer's clients and does not contact them.

17. People joining, leaving, and moving country

Removing someone from the service revokes their access and stops all capture for them immediately. It does not delete their history, because time, pay and training records have to survive the person leaving — an employer that cannot show what it paid for cannot defend a wage claim. A former worker's data is kept under the Customer's retention settings like anyone else's, and is erased on request under section 10 unless the law requires the Customer to keep it.

Where a person works is recorded when they accept the monitoring notice, and it is what this DPA uses to decide which country's protections apply to them. If someone moves, their record changes when they next accept the notice, and the agreement shown to the Customer from then on includes the sections that move brings with it. The Customer should check its agreement in Settings after people join from, or move to, a new country.

A person who works in more than one country, or who travels, is covered by the rules of each country they work from. The Customer should switch capture off for anyone working somewhere it cannot satisfy.

18. Consent: given, refused, and withdrawn

Nothing is captured for a person until they have accepted the monitoring notice in the desktop app. The server refuses every kind of capture for someone without consent on file — this is enforced in code, not a setting an administrator can switch off.

• Consent is per capture kind. A kind the Customer switches on later is not covered by an earlier consent: the person is asked again before it starts.
• Each acceptance is written to an append-only chain, where every record carries a hash of the one before it, so an acceptance cannot be altered or inserted after the fact. The chain can be produced as evidence.
• A person can withdraw consent. Capture stops; what was already captured is kept under the Customer's retention settings, and the person may ask for it to be erased.
• A recording that arrives from a connected phone system or a notetaker is only kept when that person's consent covers audio; the call record itself still lands, so the Customer's own call statistics stay correct.
• Where consent is not a valid legal basis — most employment in the EEA — the notice is still given and recorded, but the Customer must rely on a different basis and should say so in its own notice.

19. Disputes, holds and evidence

Where the Customer needs to keep something beyond its retention period — a disciplinary case, a wage claim, a legal hold, a regulator's request — it can put that screenshot, recording or call on hold. A hold stops every automatic deletion for that item, including the retention sweep, and lasts until the Customer removes it. This is how a litigation hold is implemented in the service.

Where a person disputes what the AI said about their work, the Customer's manager can correct it. The correction and the AI's original words are both kept and both shown to the person, so neither side of the disagreement disappears. Decisions about a person are made by people at the Customer; the service never takes one automatically.

If the Customer needs its data for a court or a regulator, it can export it itself. TaskQo will give a written description of how the data was produced, and of the controls around it, where the Customer needs one.

20. Apps the Customer connects, and the AI it chooses

The Customer can connect other applications to the service and can choose which AI does each job. Both are instructions under section 3, and both decide which Sub-processors receive its data. TaskQo shows, before the choice is made, which vendors each option engages and in which countries they are.

• Data sent to an application the Customer connects goes there on the Customer's instruction and under the Customer's own agreement with that application. TaskQo is not a party to it.
• Changing the AI tier changes which vendors are engaged, with immediate effect and no change to this DPA.
• Names, email addresses and phone numbers are removed from text before it is sent to the vendors where that is required, and what each vendor is configured to do with the data is recorded and re-checked.
• If TaskQo stops using a vendor, data already sent to it is deleted under that vendor's terms; nothing further is sent.

21. Change of control, succession and insolvency

Either party may assign this DPA, together with the Terms, to a successor in a merger, acquisition or sale of substantially all of its business, on written notice. The successor takes on every obligation in this DPA unchanged.

If TaskQo becomes insolvent or enters administration, Customer Personal Data is not an asset of the business. It remains the Customer's, export remains available for as long as the service runs, and any successor or administrator is bound by this DPA. Encrypted backups are kept separately from the running service, so the data can still be recovered and returned if the service itself stops.

22. Devices and people the Customer does not employ

The service captures a computer's screen while a shift is running. Things that are not the Customer's business can appear there: a personal message, a family member walking past a webcam view, a third party's confidential document, another company's customer on a call.

• Where a person works on their own device, the Customer must have their informed agreement, and should confine capture to working hours and work applications. The desktop app captures only while a shift is open and stops the moment it is paused or ended.
• The Customer is responsible for telling people that pausing the app is how private time is kept private, and for allowing it.
• Where a third party appears in a recording or on a screen, the Customer is the controller of that data too and must handle a request from that person. TaskQo passes any such request to the Customer.
• The service does not run face recognition, fingerprinting or voiceprint identification, and the desktop app does not take webcam photographs, so nobody who merely appears on screen is identified by it.
• The Customer must not use the service to monitor anyone who is not working for it, and must not use it on a person under 18 without the consent their local law requires.

23. Backups, restores, and what a restore can bring back

Backups exist so that data can be recovered after a failure, which means a backup taken before a deletion still contains what was deleted. Backup copies expire within 30 days, and TaskQo restores from them only to recover from an incident. If it ever does, it tells the Customer which point in time the service was restored to, so that the Customer can repeat any deletion it made after that point; deletions of a whole person or a whole agency are recorded and are repeated by TaskQo itself.

A deletion the Customer asks for is carried out in the live service straight away; the Customer should expect it to persist in backups for up to 30 days, which is what Data Protection Laws contemplate for backup media.

24. Security testing and reporting a problem

The Customer may not run penetration tests, vulnerability scans or load tests against the service without TaskQo's written agreement, because they are indistinguishable from an attack and affect other customers. TaskQo will agree to a reasonable test on reasonable notice, and will share the results of its own testing instead where that answers the question.

Anyone who believes they have found a security problem should write to admin@taskqo.com. TaskQo does not take legal action against someone who reports a problem in good faith, does not access more data than their finding needs, and gives TaskQo a reasonable time to fix it.

25. Notices

Notices to the Customer under this DPA are given by email to its owners and by a message in the service, and are effective when sent. Notices to TaskQo are given to admin@taskqo.com and are effective when acknowledged. The Customer is responsible for keeping at least one owner's email address current; a notice sent to the address on file is validly given even if nobody reads it.

ROW-1. Local law

Where the Customer or its people are in a country with its own data protection or employee monitoring law, that law applies to the Customer as the employer and controller, and the Customer is responsible for meeting it. TaskQo will give the information and assistance reasonably needed to do so, and will enter into any further terms the law requires.

Customer Personal Data is processed on servers in Malaysia and by the Sub-processors listed in the service, which are mostly in the United States. Where the Customer's law restricts transfers abroad, the Customer must satisfy itself that it may use the service before switching capture on.

27. Liability, precedence and law

Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws do not allow that. Where more than one set of terms applies to the processing of personal data, the order of precedence is: the Standard Contractual Clauses (and any Addendum to them), then the additional sections for the Customer's jurisdiction, then the rest of this DPA, then the Terms.

This DPA is governed by the laws of the State of New York, without regard to its conflict of laws rules, and the state and federal courts located in New York County, New York, have exclusive jurisdiction, except where Data Protection Laws require otherwise.

TaskQo may update this DPA; a new version is announced to owners and admins in the service, who are asked to accept it. Where the Customer's country or the countries of its people change, the sections that apply change with them, and the Customer is asked to accept the new text. Privacy questions: admin@taskqo.com. Our Privacy Policy: https://app.taskqo.com/privacy.