This addendum is part of the Terms of Service between MrGreen LLC, doing business as PinkLinq ("PinkLinq") and the company using the Service ("Company"). It applies whenever PinkLinq handles personal data for the Company. You don't need to sign anything. If your own process needs a signed copy, ask us through support@pinklinq.com.
1. Words used here
"Personal Data" means information about an identifiable person that the Company or its people put into the Service. "Data Protection Law" means the privacy laws that apply to that data, which can include US state laws such as the California Consumer Privacy Act (CCPA), and the GDPR and UK GDPR. "Controller", "processor", "data subject", "business", "service provider", "sell" and "share" mean what those laws say.
2. Who does what
The Company is the controller or business, and decides why and how Personal Data is used. PinkLinq is its processor or service provider.
The Company is responsible for having a lawful basis, for its notices and consents to its people, including about location and monitoring, for the accuracy of what it enters, and for its instructions being lawful. PinkLinq is the controller of the limited data described in its Privacy Policy as ours, such as Owners' billing details.
3. Instructions
PinkLinq handles Personal Data only on the Company's documented instructions, unless the law requires otherwise, in which case we tell the Company first if allowed. These terms, the Company's settings and what the Company's admins do in the Service are its complete instructions. We'll say so if we believe an instruction breaks Data Protection Law, and we may decline to follow it.
4. Details of the processing
| Subject | Providing the workforce Service |
|---|---|
| Duration | While the Company uses the Service, plus the deletion periods in section 10 |
| Purpose | Scheduling, time tracking, communication, HR, training and hiring tools, as the Company turns them on |
| People | The Company's workers, managers, job applicants, and others it adds |
| Data | Contact and profile details, job details, hours and shifts, pay rates, location at clock events, messages, files, documents, training and performance records, device and sign-in data |
| Sensitive data | Not intended. The Terms of Service forbid putting in government ID numbers, health or biometric data. Precise location at clock events is handled as sensitive where the law says so. |
5. Our people
Everyone at PinkLinq who can reach Personal Data is bound by confidentiality duties and has access only as far as their job needs. Staff use a separate console with an e-mail code and an authenticator app. They can't sign in as a company's people, and every action they take is logged and kept for 3 years.
6. Security
We keep the technical and organizational measures in Annex 1 in place, and we may improve them. We won't materially weaken them. The Company is responsible for its own settings, its people's sign-ins, and removing access when someone leaves.
7. Sub-processors
The Company gives general permission for PinkLinq to use sub-processors. The current ones are on our sub-processors page. PinkLinq holds each to data protection duties no less protective than these in substance, and remains responsible for what they do.
We'll tell Owners at least 30 days before adding or replacing a sub-processor that handles Personal Data, by e-mail or in the app. The Company may object on reasonable data protection grounds within that time. We'll then try in good faith to find a way forward, and if we can't, the Company may end the affected part of the Service and get a refund of prepaid fees for the time left. In an emergency, such as replacing a failed provider, we may give notice as soon as we can instead.
8. Helping with requests
The Service lets the Company find, correct, export and delete Personal Data on its own, and that's the first way to meet a request from a person. If someone asks us directly, we'll send them to the Company and won't answer ourselves, unless the law requires it. We'll give reasonable further help with requests, data protection impact assessments and talks with regulators. If that help goes beyond the normal Service, we may charge for our reasonable costs.
9. Breaches
If we become aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Personal Data, we'll tell the Company's Owners without undue delay, and within 72 hours of becoming aware of it. We'll say what we know then, and add more as we learn it: what happened, the data and people affected, and what we're doing about it. We'll take reasonable steps to contain and fix it. Telling the Company isn't an admission of fault. Attempts that don't succeed, such as blocked sign-in attempts, aren't breaches.
10. Return and deletion
During the contract, the Owner can export all of the Company's data in Settings → Company. When a company is closed, its access ends at once. We erase its database and files 30 days later, and its backups with them. Otherwise, backups age out within 30 days. We may keep what the law requires us to keep, protected in the same way, for as long as required.
11. Audits
Our security page describes our measures. Once a year, on request, we'll answer a reasonable written security questionnaire. If that isn't enough because a regulator requires more, or after a breach, the Company may audit our compliance with this addendum, with 30 days' notice, in business hours, under confidentiality, without access to other customers' data, and at its own cost. We don't currently hold third-party audit certifications, and we'll say so if that changes.
12. US state privacy laws
PinkLinq is a service provider or processor. It will not:
- sell or share Personal Data
- keep, use or disclose it for any purpose other than the business purposes in this addendum, including any commercial purpose of its own, unless the CCPA or a similar law allows it
- keep, use or disclose it outside the direct relationship with the Company
- combine it with personal data from other sources, unless the law allows it
We'll comply with the laws that apply to us and give the same level of privacy protection they require. We'll tell the Company if we decide we can't. The Company may take reasonable steps to stop and fix unauthorized use, and to check that we use Personal Data in line with its obligations, as section 11 provides. PinkLinq certifies that it understands these restrictions.
13. Moving data between countries
PinkLinq is based in the United States, and its providers may handle data elsewhere. If the GDPR, UK GDPR or Swiss law applies to Personal Data sent to a country without an adequacy decision, the standard contractual clauses adopted by the European Commission (Decision 2021/914) apply and are made part of this addendum: Module Two for a controller Company, Module Three for a processor Company. For those clauses, the optional docking clause applies; option 2 applies in clause 9, with the notice period in section 7 above; the optional wording in clause 11 doesn't apply; the governing law and courts are Ireland's; the details in section 4 and Annex 1 complete the annexes. For the UK, the UK Addendum to those clauses applies, and for Switzerland they apply with references read as Swiss law and the FDPIC. If those clauses conflict with this addendum, they prevail.
14. The rest
Liability under this addendum falls under the limits in the Terms of Service, to the extent the law allows. This addendum lasts as long as PinkLinq handles Personal Data for the Company. If the law changes, we may update it as the Terms of Service describe.
Annex 1: Security measures
- Separation. Each company has its own database and its own signing keys. A session, device or kiosk cookie made for one company is worthless at another.
- Encryption. TLS 1.2 or newer in transit, with HTTP Strict Transport Security. Encrypted at rest by our infrastructure provider. Authenticator keys and connection tokens are additionally sealed by us.
- Sign-in. PINs and recovery codes are stored only as keyed hashes. Wrong tries lock an account. Limits per network and per company. E-mail codes, optional two-step sign-in, which can be required for admins. New-device alerts. Sessions can be ended from the server, including live connections.
- Access inside a company. Roles and permissions, checked on the server for every request. A log of admin activity.
- Access by our staff. Named people only, an e-mail code and an authenticator app, a logged action for each change, and roles that limit what each can do.
- Files. Each read is checked against the person's permissions. Uploads are served in a way that stops them running as web pages.
- Resilience. Nightly backups kept 30 days. Point-in-time restore of a company's database for the last 30 days. New versions go out to a small share of traffic first and roll back on their own if errors rise.
- Watching for trouble. Errors, scheduled jobs and availability per module are monitored, and problems alert our staff.
- Testing. Automated tests run on every change, including tests that one company can't reach another's data and that permissions hold.