Data Processing Agreement
Last updated: 10 August 2026
This Data Processing Agreement (“DPA”) is between BoltSuite, a Wyoming company (“BoltSuite,” “we,” “us,” or the “Processor”), and the customer identified in the applicable order or account (“Customer,” “you,” or the “Controller”). This DPA governs how BoltSuite handles the personal data about Customer's employees that Customer submits through the PunchCardScan service (the “Service”), and forms part of, and is governed by, the Terms of Service between the parties.
1. Roles and Scope
1.1 Controller. Customer is the Controller of the personal data of its employees and any individuals identified in the timesheet images it uploads to the Service (“Customer Personal Data”). Customer determines the purposes and means of processing that data.
1.2 Processor. BoltSuite is the Processor. BoltSuite processes Customer Personal Data only to provide the Service and only on Customer's documented instructions, including as set out in the Terms of Service and this DPA.
2. Categories of Data and Processing
2.1 Data Subjects. Customer's employees, and any other individuals whose hours, names, or related information appear on a timesheet image uploaded to the Service.
2.2 Data Categories. Names, work dates, clock-in and clock-out times, hours worked, overtime, notes, pay rates (if entered by Customer), and the underlying timesheet card images.
2.3 Purpose. To scan, digitize, calculate, store, and export timesheet data on Customer's behalf using AI-assisted image processing, and to provide related account, support, and billing functions.
2.4 Duration. For the term of Customer's subscription, plus the retention period described in Section 4.
3. Processor Obligations
3.1 Instructions and Confidentiality. BoltSuite will process Customer Personal Data only on Customer's instructions and for the purposes above, will keep it confidential, and will require personnel and subprocessors to do the same.
3.2 Security Measures. BoltSuite maintains appropriate technical and organizational security measures, including encryption in transit, a separate database per customer, role-based access controls, and change logging.
3.3 Assistance with Data Subject Rights. BoltSuite will provide reasonable assistance to help Customer respond to data subject requests for access, correction, deletion, or export, and to meet Customer's security and data protection obligations.
3.4 Breach Notification. BoltSuite will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will reasonably cooperate with Customer's investigation and notification obligations.
3.5 No Sale of Data. BoltSuite does not sell Customer Personal Data.
3.6 Deletion or Return. Upon termination of the Terms of Service and expiration of the retention period in Section 4, BoltSuite will delete or return Customer Personal Data, except where retention is required by applicable law.
4. Retention
4.1 Retention Period. Uploaded timesheet images and derived data are retained until Customer deletes them or closes its workspace. Following cancellation, BoltSuite retains Customer Personal Data for twelve (12) months to allow Customer to resume the Service or export its data, after which BoltSuite may delete it. Customer may permanently delete its workspace data at any time.
5. Subprocessors
5.1 Authorized Subprocessors. Customer authorizes BoltSuite to engage the subprocessors identified in the table below to provide the Service. BoltSuite will give notice before adding a new subprocessor so Customer may object on reasonable data protection grounds.
| Subprocessor | Purpose | Data It Receives | Location |
|---|---|---|---|
| Anthropic | AI-assisted reading of timesheet card images | Card images and the data derived from them (names, dates, hours) | United States |
| Stripe | Subscription billing and payment processing | Tokenized payment details and billing contact information (BoltSuite does not receive full card numbers) | United States |
| Hetzner | Hosting of the application, the per-customer databases, and free-trial card images | Account data, and all Customer Personal Data held in the database | Hillsboro, Oregon, United States |
| Backblaze (B2) | Object storage for timesheet card images uploaded inside an account | Card images | US West, United States |
| Postmark | Transactional email (invitations, invoices, support replies) | Recipient name and email address, and the message contents | United States |
| Cloudflare (Turnstile) | Bot and abuse prevention on the free-trial upload and sign-in forms | IP address and a challenge token — never timesheet data | United States |
| BoltSuite billing and support platform (our own system, not a third party) | Managing your subscription, issuing invoices, monitoring whether the Service is healthy, and answering support requests | Account and administrator email addresses, company name, technical error reports, and the contents of support messages | Hillsboro, Oregon, United States |
| Google Analytics | Website analytics, loaded only where the visitor has accepted cookies | Pages viewed, device and browser data, approximate location from IP | United States |
| Not enabled today, listed so a change is visible: Google AdSense (public free-trial page only); Google / Microsoft / Apple sign-in | Advertising; authentication | Advertising identifiers, approximate location and device data; basic profile data for sign-in | United States |
6. International Data Transfers
6.1 Transfer Mechanism. Where Customer Personal Data originating in the European Economic Area, the United Kingdom, or Switzerland is transferred to the United States or another country, BoltSuite relies on the Standard Contractual Clauses, including the UK International Data Transfer Addendum, or another lawful transfer mechanism, and implements supplementary measures as reasonably necessary.
6.2 GDPR, UK GDPR and Swiss FADP/DSG. For Customer Personal Data originating in the European Union and other EEA member states, processing under this DPA complies with the GDPR; for data originating in the United Kingdom, processing complies with the UK GDPR and the Data Protection Act 2018; and for data originating in Switzerland, processing complies with the Swiss Federal Act on Data Protection (FADP/DSG).
7. Audits
7.1 Audit Rights. On reasonable written request, no more than once per year (or following a security incident affecting Customer Personal Data), BoltSuite will provide the information reasonably necessary to demonstrate compliance with this DPA, including its security documentation and any certifications it holds, and will make relevant records available for review, subject to the confidentiality of BoltSuite's other customers' information.
8. Liability and Term
8.1 Liability. Liability arising under this DPA is subject to the limitations of liability set out in the Terms of Service.
8.2 Term and Survival. This DPA remains in effect for as long as BoltSuite processes Customer Personal Data on Customer's behalf. Its confidentiality, deletion and return, and liability provisions survive termination.
9. Governing Law
9.1 Governing Law. This DPA is governed by the laws of the State of Oregon, consistent with the Terms of Service, without prejudice to any mandatory data protection law requirements applicable to the transfer mechanisms described in Section 6.
10. Contact Information
10.1 Contact Us. Questions about this Data Processing Agreement may be directed to privacy@punchcardscan.com
or addressed to:
[mailing address — to be completed]