Data Processing Agreement

1. Parties and agreement

• Provider: RRYME LTD, 128 City Road, London, EC1V 2NX, United Kingdom, company number 17017522, registered in England and Wales. Contact for this DPA: privacy@absenca.com.
• Customer: the organization that accepts the Terms of Service, as recorded in its Absenca account. Its admins are its contacts for this DPA.
• Agreement: Absenca's Terms of Service, as accepted by Customer.

2. Description of the processing

• Subject matter and nature: hosting and operating Absenca, a leave and absence management service. That means storing records, calculating balances and accruals, routing requests for approval, sending notifications, syncing with calendars and messaging tools Customer connects, producing reports, and providing support.
• Purpose: providing the service under the Agreement, as Customer instructs through its use and configuration of Absenca.
• Duration: the term of the Agreement, plus the retrieval period after it ends (at least 30 days) and the time it takes database backups to expire (up to 30 days).
• Frequency: continuous.
• Data subjects: Customer's employees, managers and administrators, and other people Customer invites or imports.
• Personal data: identity and contact details (name, email address, employee id); work details (office, department, role, manager, start date, country, working schedule); leave data (requests, dates, leave types, balances, accruals, adjustments, approvals, free-text reasons and review notes); attachments to leave requests; identifiers from connected tools (Slack, Microsoft Teams, Google and Microsoft 365 user ids and calendar events); and audit-log records.
• Special category data: health data, where Customer records sick leave, where someone writes about health in a reason or note, or where a sick note is attached. Section 3 lists the extra safeguards.

3. Extra safeguards for health data

• Private leave types: Customer can mark a leave type private. Colleagues then see "Away" instead of the leave type in the app's calendar and team views. Channel digests, calendar feeds, shared team calendars, scheduled reports and out-of-office replies still show the leave type for now.
• Sick notes: attachments can be opened only by the person and the people who review the request, through in-app links that expire after 15 minutes. Data exports an admin requests contain links to them that are valid for 7 days.
• No diagnoses: the Terms of Service forbid entering medical diagnoses or detailed medical information, and the app asks people not to.
• Defaults: leave types created from Absenca's templates do not count towards the Bradford factor, and the sick leave template does not require an attachment, unless Customer changes that.
• Customer remains responsible for having a lawful basis and condition for processing health data, such as Article 9(2)(b) GDPR together with national employment law.

4. Customer's instructions

The Agreement, this DPA, and Customer's use and configuration of Absenca are Customer's complete instructions. Provider will tell Customer if it believes an instruction breaks data protection law.

5. Security measures

Provider maintains these technical and organisational measures. Our security page describes them in more detail.

• Encryption in transit (TLS, with HSTS), and at rest by the hosting provider. Tokens of connected tools are also encrypted by the application.
• Role-based access with four roles (admin, location-admin, manager, employee), scoped to offices and departments.
• Sign-in with verified email addresses; passwords stored only as salted one-way hashes, with new and changed passwords using PBKDF2-SHA256.
• Provider's staff use a separate admin system. Their changes, and their access to customer leave data, are logged.
• Attachments are served only through signed links: in-app links expire after 15 minutes, and data exports an admin requests contain links valid for 7 days.
• Input validation, signature checks on incoming webhooks, security headers and rate limiting.
• An application log kept for 30 days, and an audit log of admin actions for Customer.
• Point-in-time recovery of the database for up to 30 days.
• Separate development and production environments; development uses fictional data; changes to production data go through reviewed, automated deployments.
• A written breach response process.
• Staff working from outside the UK access personal data only through cloud systems, never storing it on their own devices.

6. Sub-processors

Customer gives Provider general written authorisation to use sub-processors. The approved sub-processors at the date of this version are listed in Annex 1 and on our sub-processor page.

Provider will give at least 10 business days' notice before adding or replacing a sub-processor, by email to Customer's admins and on that page. Customer may object on reasonable data protection grounds within that period, as the Standard Terms describe.

7. Security incidents

Provider will notify Customer of a Personal Data Breach without undue delay, and in any case within 72 hours of becoming aware of it, by email to Customer's admins, with the information Customer needs to meet its own obligations.

8. International transfers

• Provider is established in the United Kingdom. Transfers from the EEA and Switzerland to Provider rely on the adequacy of the UK: the European Commission's decision, as renewed in December 2025, and Switzerland's recognition of the UK.
• Fallback: if the EU adequacy decision for the UK lapses, is withdrawn or is held invalid, the EU Standard Contractual Clauses (Module Two, or Module Three where Customer is itself a processor), as incorporated by the Standard Terms, apply automatically from that moment to transfers from Customer to Provider, with Ireland as the Governing Member State. The same applies, with the Swiss adaptations in the Standard Terms, to transfers from Switzerland.
• Onward transfers to sub-processors outside the UK and the EEA are covered by: UK: DPF UK Extension and/or UK Addendum · EU: SCCs and/or DPF. Where the UK Addendum applies, its tables are completed with the information in this Cover Page.
• Provider's staff may access personal data from outside the UK, including from Kosovo, as Provider's own personnel, through cloud systems only.
• Hosting: Absenca is hosted on Cloudflare's global network; specific regions are not guaranteed.

9. Return and deletion

Customer can export its data at any time, as the exit terms of the Terms of Service describe. After the Agreement ends, Provider keeps Customer's data for at least 30 days so that Customer can retrieve it, unless Customer erases it earlier, and then deletes it from the live service. Backups expire within 30 days after that, unless the law requires Provider to keep some of the data.

10. Audits and assistance

Provider makes available the information needed to show compliance with this DPA, including its technical and organisational measures, and answers reasonable security questionnaires. Audits follow the Standard Terms. Provider assists Customer with data subject requests and with data protection impact assessments, as far as the service allows.

11. Governing law and courts

This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, except where the Standard Contractual Clauses or the UK Addendum require otherwise when they apply.

12. Language and licence

This Cover Page is published in English and German. If they differ, the English version prevails.

The Common Paper DPA Standard Terms Version 1.1 are published by Common Paper and licensed under CC BY 4.0. This Cover Page was written by RRYME LTD.

Annex 1: Approved sub-processors

At the date of this version: