Data processing agreement

Controller ("the Controller"): the company that subscribes to SmartHub, with the company name, tax ID and address it gives in the billing step when signing up.

Processor ("the Processor"): SmartHubCRM, S.L., tax ID (CIF) B05593355, registered at Avenida de los Apóstoles 3, 1.º B, 28011 Madrid, España, contact email direccion@smarthubcrm.com.

This agreement is part of what the Controller accepts when it subscribes to SmartHub, together with the terms of service and the privacy policy. It is accepted with the same checkbox, before payment, and the date and version accepted are recorded.

If anything in the terms of service contradicts this agreement as regards personal data, this agreement prevails.

The Processor processes personal data on behalf of the Controller for one purpose only: providing the SmartHub service in the modules it has subscribed to (employee record and portal, workforce, documents and signature, contracts, onboarding and offboarding, chat and announcements, time tracking, absences, shifts, tasks, calendar, equipment, payroll, expenses, training, performance, engagement, recruitment, reports, whistleblowing channel, sales, marketing and any others in its subscription).

The processing operations are those needed for that purpose, by automated means: collection, recording, organisation, storage, consultation, alteration, retrieval, alignment, disclosure to the recipients the Controller chooses inside the application, restriction, erasure and destruction.

The Processor does not use the data for its own purposes. It does not use it to train artificial intelligence models, does not sell it, does not disclose it to third parties and does not reserve any use of aggregated or anonymised data. It only uses technical metrics about how the service runs that do not relate to people.

This agreement lasts as long as the SmartHub subscription. The return and deletion obligations in clause 13, and confidentiality, continue afterwards.

Data subjects:

• the Controller’s workers, including those who have already left the company;
• job candidates, if the Controller uses the recruitment module;
• reporting persons, persons concerned and witnesses in the whistleblowing channel;
• family members and emergency contacts named by the worker (for example, for the Spanish income-tax form 145);
• application users appointed by the Controller;
• the Controller’s business contacts (customers and prospects), if it uses the sales or marketing modules.

Types of data:

• identification: first and last names, national ID or foreigner ID number, social security number, date of birth, nationality and, if uploaded, a photograph;
• contact: work and personal email and phone, home address and emergency contact;
• employment: position, workplace, department, contract, working hours, shifts, training, performance reviews, employment documents and their signatures, equipment issued;
• financial and payroll: salary and pay items, IBAN, income-tax withholding, form 145 data (family situation), expenses and allowances;
• working-time record: clock-in, clock-out and break times and, only if the Controller turns it on, the location at the moment of clocking in;
• absences: holidays, leave and sick leave, including temporary incapacity for work and its supporting documents;
• whistleblowing channel: the identity of the reporting person (unless anonymous), of the persons concerned and the facts reported;
• communications: internal chat messages and announcements;
• business contacts: name, company, contact details and the history of the business relationship.

Special categories. Sick leave and its supporting documents are health data (Art. 9 GDPR), and data of any category, including data relating to offences, may appear in the whistleblowing channel. The Processor protects them with the same reinforced measures as everything else (encryption, role-based access and logging), and the Controller undertakes not to upload more than necessary: for example, a sick note does not need a diagnosis.

The Controller decides why and how the data is processed, and warrants that it has a legal basis for each processing and has informed the people concerned. It configures the application: which modules it uses, who has access and with which role, whether location is recorded when clocking in, and how long each item is kept.

Where applicable, it is also responsible for data protection impact assessments and prior consultation with the authority, for notifying breaches to the authority and to the people affected, and for answering people who exercise their rights. The Processor helps it with all of this under the terms of this agreement.

The Processor processes the data only on the Controller’s documented instructions, which are: this agreement, the configuration the Controller sets in the application, and any it gives in writing.

Written instructions are sent by email to direccion@smarthubcrm.com from a Controller address, by a person with an administrator role in its account. The Processor keeps the instructions received for as long as the agreement lasts.

If the Processor considers that an instruction infringes data protection law, it informs the Controller immediately and may refrain from applying it until the Controller confirms or corrects it.

If a law requires the Processor to process the data differently (for example, a court order), it tells the Controller before doing so, unless that same law forbids it.

The Processor’s staff who can access the data are bound to secrecy, by contract or by express undertaking, and that duty continues after their relationship with the Processor ends. They receive the necessary data protection training.

They access data only when needed to provide the service, handle a support request from the Controller or resolve an incident. When support enters the application "viewing as" another user: the whole panel says so while it lasts; every access is logged (who, which user, when and from which company) and, if that log cannot be written, the access does not happen; and whatever is done in that mode is recorded under the real person’s name, so nobody can clock in, sign or write on someone else’s behalf. The Controller may ask at any time for the log of accesses to its account.

The Controller gives a general authorisation for the Processor to use the sub-processors in Annex III, which has its own revision date.

Before adding or replacing a sub-processor, the Processor notifies the Controller by email at least 30 calendar days in advance and updates the annex. Within that period the Controller may object on reasonable data protection grounds. If no agreement is reached, the Controller may terminate the affected service without penalty.

Each sub-processor is bound in writing by the same data protection obligations that this agreement imposes on the Processor, and the Processor is liable to the Controller for what they do.

International transfers. Service data is hosted in the European Union. Where a sub-processor processes or accesses it from outside the European Economic Area, the transfer is based on a European Commission adequacy decision (including the EU-US Data Privacy Framework where the provider is certified) or, failing that, on the Commission’s standard contractual clauses. Annex III states which applies to each one.

The Controller’s integrations. If the Controller connects SmartHub to services it subscribes to itself (its payroll software, telephony, email or calendar, messaging, ERP or sign-in provider), those providers are not sub-processors of the Processor: their processing is governed by the Controller’s relationship with them.

The Processor applies the technical and organisational measures in Annex II, appropriate to the risk under Art. 32 GDPR. It may update them over time, provided the level of protection does not decrease.

The Controller handles requests for access, rectification, erasure, objection, restriction and portability. The application lets it view and correct each person’s record itself; if it needs a copy of someone’s data to answer, the Processor prepares it.

If a person exercises their rights with the Processor, the Processor forwards the request to the Controller without delay and within two working days at most, with the information needed to answer it, and does not reply on its own unless the Controller asks it to.

The Processor notifies the Controller of any security breach affecting its data without undue delay, and within 48 hours at most of becoming aware of it, by email to the addresses the Controller has in its account.

The notice includes, as far as is known: what happened, the categories and approximate number of people and records affected, the likely consequences, what has been done or is proposed to remedy it, and a contact person. Whatever is not known at that point is provided in phases as it becomes known.

Notifying the supervisory authority and, where applicable, the people affected is the Controller’s responsibility (Arts. 33 and 34 GDPR). The Processor gives it all the information it needs to do so.

Working-time records with location and the processing of sick leave make it likely that some Controllers will need an impact assessment. The Processor helps with the technical information about the service: what data is processed, where, with which measures and with which sub-processors. The same applies if the Controller has to consult the authority beforehand (Arts. 35 and 36 GDPR).

The Processor keeps a written record of the processing activities it carries out on behalf of the Controller (Art. 30(2) GDPR).

While the subscription lasts, the Controller can download the working-time record and its integrity check from the application, and ask the Processor at any time for a full copy of its data in a commonly used format.

When it ends, the Controller has 30 calendar days to download it or ask for that copy. After that period, the Processor deletes the service data within the following 30 days and, if the Controller asks, provides a certificate of deletion.

Backups are not edited one by one: the data disappears from them as they rotate, within 30 days of deletion at most. Until then they remain encrypted and are not used for anything except a restore.

Keeping the working-time record for four years (Art. 34.9 of the Spanish Workers’ Statute) and other employment records is the Controller’s obligation as employer. That is why the copy includes the working-time record with its proof of integrity. If the Controller prefers the Processor to keep it, it can subscribe to that service, and this agreement continues to apply during that time.

The Processor only keeps, blocked, what a law requires it to keep itself (for example, the subscription invoices), and for the period that law sets.

The Processor makes available to the Controller the information needed to show that it complies with this agreement: the description of the measures in Annex II, the list of sub-processors, the log of support accesses to its account and answers to reasonable questionnaires.

If that is not enough, the Controller, or an independent auditor it appoints who is bound by confidentiality, may carry out an audit or inspection, on site or remotely, at most once a year, with 30 days’ notice, during working hours and without putting at risk the security or the data of other customers. The audit is paid for by whoever requests it.

Those limits do not apply if there has been a breach affecting the Controller or if a supervisory authority requires it.

If the Processor breaches this agreement, the Controller may ask it to suspend the processing until it is remedied; and if it is not remedied within one month, or the breach is serious, the Controller may terminate the agreement.

Each party is liable for the damage it causes by breaching this agreement or the GDPR, under Art. 82 GDPR. If the Processor determines the purposes or means of processing on its own, it is considered a controller for that processing.

If this agreement changes, the new version carries its own date and the Controller is notified. Changes to the list of sub-processors follow clause 8 and do not require accepting the agreement again.

This agreement is governed by Spanish law. For any dispute, the parties submit to the courts of Madrid, without prejudice to the powers of the Spanish Data Protection Agency (AEPD).

If the Controller uploads its RED authorised-user certificate or its company certificate to SmartHub, the use of that certificate forms part of this agreement. The Processor uses it on behalf of the Controller only to file with the General Treasury of Social Security (RED System) or with the SEPE the procedures for its staff that are prepared in SmartHub, and for no other purpose.

The Processor keeps the certificate and its password encrypted, with a key that is not in the database; it does not let anyone download them, not even the Controller; and it records every use. To do so it relies on the sub-processors Vercel (running the application) and Supabase (database, in the European Union) listed in annex III, and on the Processor's own server that files the procedures.

If the certificate is deleted, replaced or the service ends, it is removed at once. Database backups keep it, encrypted, for at most 14 days, until they expire, and the key that opens it is not in them.

The parties are in clause 1; the subject matter, nature and purpose in clause 2; the duration in clause 3; and the data subjects and types of data, including special categories, in clause 4. If SmartHub adds a module that processes a new category of data, this annex is updated and the Controller is notified.

• Hosted in the EU. The database and files are in Frankfurt (Germany), and the application runs in that same region.
• Encryption in transit. All traffic goes over HTTPS (TLS); the site forces browsers never to use an unencrypted connection (HSTS).
• Encryption of the most sensitive data. On top of the database provider’s encryption at rest, the application encrypts field by field with AES-256-GCM the national ID, social security number, IBAN, date of birth, nationality, home address, personal email and phone and emergency contact. Keys are derived separately for each use, so compromising one does not open the others.
• Encrypted documents. Payslips, contracts and other employment documents are encrypted with AES-256-GCM before being stored, in private storage. The whistleblowing channel uses its own key, separate from the rest of the application.
• Row-level security. Every database table has the engine’s own row-level security (RLS) turned on, on top of the application’s access control.
• Access by role and by company. Each user only sees the companies they have access to and, within them, what their role allows: a person sees their own data, a manager sees their team and HR sees the workforce assigned to them.
• Audit logging. Administrative actions are logged with who, when and from which address. Every support access "viewing as" another user is logged, and if it cannot be logged it does not happen. Every access to a whistleblowing case is logged too.
• Tamper-evident working-time record. Clock-ins are stored in an append-only ledger: each entry is chained to the previous one with a SHA-256 fingerprint, and each day is closed with a qualified timestamp from the FNMT. A correction does not erase the original: it sits beside it, with who made it and why.
• Backups. The database is backed up every hour, checking that each copy can be read before accepting it; a daily copy is kept for 14 days, and a further copy encrypted with AES-256 is kept outside the main system. Files are copied daily, keeping modified or deleted versions for 30 days.
• Abuse protection and error monitoring. Requests are rate-limited to stop brute-force attacks. Errors are logged in an EU-hosted service so they can be fixed quickly.

List revised on 28 September 2026

Providers that process personal data from the service on the Processor’s behalf. Any addition or replacement is notified 30 days in advance (clause 8).

• Supabase, Inc.

  Purpose

  Database, sign-in and file storage

  Data

  All service data

  Location

  European Union: Frankfurt (Germany)

  Safeguard

  Data hosted in the EU. Any support access from the US is covered by the EU-US Data Privacy Framework where the provider is certified or, otherwise, by the European Commission standard contractual clauses

• Vercel Inc.

  Purpose

  Hosting and running the application

  Data

  The data in each request while it is served, and technical logs (IP address)

  Location

  The application runs in Frankfurt (Germany); global delivery network

  Safeguard

  Transfer to the US covered by the EU-US Data Privacy Framework where the provider is certified or, otherwise, by the European Commission standard contractual clauses

• Resend, Inc.

  Purpose

  Email sent by the system: invitations, notices and documents to sign

  Data

  The recipient's email address and the content of the notice

  Location

  United States

  Safeguard

  Transfer to the US covered by the EU-US Data Privacy Framework where the provider is certified or, otherwise, by the European Commission standard contractual clauses

• Google (Google Workspace)

  Purpose

  The Processor's support mailbox

  Data

  Whatever the Controller or its users write to support

  Location

  EU and United States

  Safeguard

  Transfer to the US covered by the EU-US Data Privacy Framework where the provider is certified or, otherwise, by the European Commission standard contractual clauses

• 650 Industries, Inc. (Expo)

  Purpose

  Sending notifications to the mobile app

  Data

  Device identifier and the text of the notification

  Location

  United States

  Safeguard

  Transfer to the US covered by the EU-US Data Privacy Framework where the provider is certified or, otherwise, by the European Commission standard contractual clauses

• Apple (servicio de notificaciones, APNs)

  Purpose

  Delivering those notifications to iPhones

  Data

  Device identifier and the text of the notification

  Location

  EU and United States

  Safeguard

  Transfer to the US covered by the EU-US Data Privacy Framework where the provider is certified or, otherwise, by the European Commission standard contractual clauses

• OpenAI

  Purpose

  AI features: the AI Generator in the marketing module and assisted drafting of support replies

  Data

  Only the text sent for that feature. It receives no employee records, payslips, clock-ins or absences, and the data is not used to train models

  Location

  United States

  Safeguard

  Transfer to the US covered by the EU-US Data Privacy Framework where the provider is certified or, otherwise, by the European Commission standard contractual clauses

• Upstash, Inc.

  Purpose

  Rate limiting against abuse and temporary cache

  Data

  IP address and technical identifiers, which expire on their own shortly

  Location

  Amazon Web Services infrastructure; US company

  Safeguard

  Transfer to the US covered by the EU-US Data Privacy Framework where the provider is certified or, otherwise, by the European Commission standard contractual clauses

• Functional Software, Inc. (Sentry)

  Purpose

  Application error tracking

  Data

  Technical data about the error; it may incidentally contain an identifier

  Location

  European Union: Germany (EU data region)

  Safeguard

  Data hosted in the EU. As a US company, any access from there is covered by the EU-US Data Privacy Framework where it is certified or, otherwise, by the European Commission standard contractual clauses

• Inngest, Inc.

  Purpose

  Background jobs: scheduled sends, daily closes, synchronisations

  Data

  Identifiers and the minimum data each job needs

  Location

  United States

  Safeguard

  Transfer to the US covered by the EU-US Data Privacy Framework where the provider is certified or, otherwise, by the European Commission standard contractual clauses

• Stripe Payments Europe, Ltd.

  Purpose

  Charging the subscription

  Data

  The Controller's billing and payment data; it receives no employee data

  Location

  Ireland (EU), with transfers to the US

  Safeguard

  Transfer to the US covered by the EU-US Data Privacy Framework where the provider is certified or, otherwise, by the European Commission standard contractual clauses

Providers that receive no data subject data

The service also uses these providers, but the way the calls are made means no data about the Controller’s people reaches them. They are listed anyway so that everything in use is visible.

• FNMT-RCM (Fábrica Nacional de Moneda y Timbre)

  Purpose

  Qualified timestamp for the daily close of the working-time record

  Data

  Only a cryptographic fingerprint (hash). No data can be rebuilt from it

  Location

  Spain

  Safeguard

  No transfer

• OpenStreetMap Foundation (Nominatim)

  Purpose

  Turning the address of a workplace or a company into coordinates

  Data

  The postal address being looked up; never an employee's

  Location

  United Kingdom

  Safeguard

  European Commission adequacy decision for the United Kingdom

• Giphy y Tenor

  Purpose

  GIF search in the chat

  Data

  Only the search text. Our server runs the search, so they receive neither the IP nor the identity of whoever searches

  Location

  United States

  Safeguard

  They receive no personal data

• Telegram

  Purpose

  Internal technical alerts to the Processor's operations team

  Data

  Process status and errors. No employee records, payslips, clock-ins or absences are sent

  Location

  Outside the EEA

  Safeguard

  No data subject data is sent to it