Data-processing statement

This statement forms part of our terms of service. It sets out how Ovrilo Systems ("we", the processor) handles personal information that a customer ("you", the controller) puts into its Ovrilo workspace, in line with the Data Protection Act, 2020 (Jamaica).

1. Roles

You decide what personal information about your employees and users goes into Ovrilo and why. You are the data controller. We process it only on your documented instructions: these terms, your configuration of the workspace, and requests you make to us (for example on a support call).

You confirm you have a lawful basis for the information you put in and that you have told your employees about it (for example in your own privacy notice to staff).

2. What we process

• People: employees, contractors and users of your workspace.
• Information: names, employee numbers, job titles, departments and teams; contact details and emergency contacts; dates of birth and hire dates; pay groups, pay rates and pay items; clock events (times, Clock Station or device, and for web clock-in, location and IP address where your policy asks for it); timecards, rosters, time off requests and balances; medical certificates or other files attached to time off requests; custom fields you add.
• No biometric data: when a time clock identifies someone by fingerprint, face or palm, the template stays on the clock. Ovrilo receives only the badge number and which method was used, and drops any other data a clock connector sends.
• Sensitive information: attachments such as medical certificates may contain health information. Only people who can see that person's time off can open them. Collect them only where you need to.
• Purpose: providing Ovrilo to you: recording time, calculating hours and balances, preparing pay runs and exports, notifications, support, backups and security.

3. Our commitments

We will:

1. process the information only for you and only as instructed, and tell you if we think an instruction breaks the Act;
2. make sure our staff who can access it are bound by confidentiality, and limit access to those who need it for support;
3. keep it secure (section 4);
4. use sub-processors only as set out in section 5;
5. help you respond to requests from your employees to see, correct or object to processing of their information. Most of this you can do yourself in Ovrilo; for the rest, WhatsApp us;
6. tell you without undue delay, and within 72 hours of becoming aware of a personal data breach affecting your workspace, with what we know, so you can meet your own obligations to the Information Commissioner and affected people;
7. help you with data protection impact assessments where reasonably needed;
8. at the end of the service, return or delete your information (section 8);
9. tell you if we find we've broken one of the Act's data protection standards in handling your information, so you can report it;
10. make available the information you reasonably need to show these commitments are met.

4. Security measures

• Separation: each workspace has its own database and its own encryption keys.
• Encryption: in transit (TLS) everywhere; contact details, identifiers, dates of birth and pay rates encrypted with the workspace's own key; off-site backups kept with Cloudflare R2, which encrypts everything it stores.
• Files: attachments such as sick notes are kept on a private disk, never public, and only served through Ovrilo to people allowed to see that person's time off.
• Access control: role-based access inside each workspace, scoped to teams. Our staff use a separate Control Room with mandatory two-factor authentication or passkeys, and every action there is logged in an append-only audit log.
• Support step-ins: our staff enter a workspace only with your permission, for a limited time, and the workspace owner is told; every step-in is recorded.
• Integrity: clock events can't be silently changed. Every edit keeps the original and records who made it and why.
• Resilience: nightly backups of each workspace, kept for 14 days and then weekly for 8 weeks, with the ability to restore a single workspace.

Report a suspected security problem to security@ovrilosystems.com.

5. Automated decisions

Ovrilo works out hours, overtime and balances from punches and your rules, and raises flags for things to check. It never decides anyone's pay on its own: a person reviews timecards and signs off each Pay Run, and "Why these hours?" shows how every figure was reached. Keep a person in that loop; the Act lets employees object to decisions about their work made solely by automated means.

6. Sub-processors

You authorise us to use these sub-processors. We'll give workspace owners at least 30 days' notice of a new one, so you can object.

Sub-processor	What for	Where
[VPS hosting provider]	Servers and databases	[data centre country]
Cloudflare, Inc. (R2)	Encrypted off-site backups	Global
[email delivery provider]	Sending notification emails	[country]

7. Transfers outside Jamaica

Where information is stored or accessed outside Jamaica, we make sure the destination gives adequate protection or that suitable contractual safeguards are in place, as the Act requires.

8. Return and deletion

You can export your data from Ovrilo at any time. When your agreement ends, we keep the workspace for 90 days so you can export or change your mind, then delete its database, files, backups and encryption keys. We keep invoices and payment records as the law requires.

9. Contact

Data protection questions: dpo@ovrilosystems.com. Our data protection officer: [name of the data protection officer], dpo@ovrilosystems.com.