Data Processing Addendum
Effective May 1, 2026 · Forms part of the Terms of Service.
1. Roles
For the work records your employees generate, you are the business or controller and GoPuncher is the service provider or processor. We process those records only on your documented instructions, which, in ordinary use, are the settings you choose in the product, and for no other purpose. We do not sell them, share them for cross-context behavioral advertising, or use them to build our own products.
2. What is processed
Categories, sources and purposes are listed in the Privacy Policy §2: work time, activity counts, application and website names, screenshots, webcam photos where enabled, device details and account information, collected only while an employee's timer runs.
3. Confidentiality and security
Staff with access are bound to confidentiality. Security measures are described in the Privacy Policy §4 and on our Security page: encryption in transit and at rest, private media storage reachable only through short-lived signed links, isolation between companies at the database level, role-based access inside your company, and an audit log of settings changes. We do not claim certifications we have not completed.
4. Sub-processors
The current list is published at Subprocessors and is part of this addendum. We will update that page before a new sub-processor begins processing, and you may object by writing to info@gopuncher.com; if we cannot resolve the objection you may terminate.
5. Your people's requests
If an employee contacts us about their own records, we refer them to you and tell you they asked. We will help you answer a request you receive, using the tools in the product.
6. Security incidents
If we become aware of a breach of security affecting your records, we will notify you without undue delay and tell you what we know, what we are doing, and what you may need to do.
7. Transfers
All processing takes place in the United States. We do not transfer your records outside the United States.
8. Deletion
Media expires on its own once the retention period set for your company runs out. When your account ends we delete or return your records on request, subject to the retention periods in the Privacy Policy and to what the law requires us to keep. Deleted data leaves our encrypted backups within approximately 14 days.
9. Audits
On reasonable request and no more than once a year, we will answer a written security questionnaire and provide the documentation we hold.