Skip to content
JN Tempo

Data Processing Agreement

Version 2026-10 · Published November 2026

Version 2026-10, in force from 2026-11-13.

This Data Processing Agreement ("DPA") forms part of the JN Tempo Terms and Conditions ("Terms") between JN Horizon Ltd ("we", "us") and the Customer ("you"). It applies when we process personal data on your behalf in providing JN Tempo. Words defined in the Terms have the same meaning here.

1. Definitions

  • Data Protection Law: the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications (EC Directive) Regulations 2003, each as amended (including by the Data (Use and Access) Act 2025), and any other law that applies to the processing.
  • Customer Personal Data: personal data in Customer Data that we process on your behalf.
  • Subprocessor: a third party we engage to process Customer Personal Data.
  • Personal Data Breach, controller, processor, data subject and processing have the meanings given in Data Protection Law.

2. Roles

You are the controller of Customer Personal Data and we are your processor. Schedule 1 describes the processing.

We are a controller, not your processor, for the limited personal data we use to run our own business: account registration, billing, security, misuse prevention, support and our own communications. Our Privacy Notice covers that processing.

3. Your instructions

We will process Customer Personal Data only on your documented instructions, unless the law requires otherwise. If it does, we will tell you before processing unless the law prevents us.

Your instructions are: the Terms, this DPA, and the choices your Admins and Users make in JN Tempo (for example adding records, setting roles and visibility, sending invitations, scheduling reminders, and running exports). Any additional instructions must be agreed in writing.

We will tell you promptly if we believe an instruction breaks Data Protection Law. We are not required to carry out an instruction we reasonably believe is unlawful.

4. Your responsibilities

You are responsible for:

  • having a lawful basis for the Customer Personal Data you and your Users put into JN Tempo, and, where relevant, a condition for special category or criminal offence data;
  • giving data subjects the information Data Protection Law requires about your processing;
  • the accuracy of Customer Personal Data and the configuration of your account, including Users' roles and visibility settings;
  • deciding how long to keep Customer Personal Data while you use JN Tempo, and deleting what you no longer need using the tools available;
  • your own obligations as a controller, including responding to data subjects and notifying personal data breaches to the ICO and data subjects where required.

5. Our personnel

We will make sure that everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality and processes it only as needed to provide, support or secure JN Tempo.

6. Security

We will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data, taking into account the nature of the data and the risks. Schedule 2 describes the measures in place. We may change them, but not in a way that materially reduces the overall level of protection.

7. Subprocessors

You give us general authorisation to engage Subprocessors. The current Subprocessors are listed on the subprocessors page.

  • Before engaging a new Subprocessor or changing an existing one in a way that affects Customer Personal Data, we will update the subprocessors page and email your Admins at least 30 days in advance.
  • You may object on reasonable data protection grounds within that period. We will consider each reasonable objection in good faith and tell you how we propose to address it. If we cannot reasonably address it, you may end the Terms by notice before the change takes effect, and we will refund any Fees you have paid for the period after termination.
  • We will put a written contract in place with each Subprocessor that gives Customer Personal Data protection at least equivalent to this DPA.
  • We remain responsible to you for each Subprocessor's performance of its data protection obligations.

8. International transfers

We will transfer Customer Personal Data outside the UK only where Data Protection Law permits it: on the basis of UK adequacy regulations, or with appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. The subprocessors page shows the locations involved and the safeguard for each provider.

9. Helping you with data subject requests

JN Tempo lets Admins view, correct, export and delete much of the Customer Personal Data in an account. Where you cannot respond to a data subject request using these tools, we will give you reasonable help, taking into account the nature of the processing.

If we receive a request directly from a data subject about Customer Personal Data, we will not respond to it ourselves, except to tell them to contact you. We will pass it to you without undue delay where we can identify you.

10. Personal Data Breaches

If we become aware of a Personal Data Breach affecting Customer Personal Data, we will notify your Admins without undue delay, and in any event no later than 48 hours after becoming aware of it. We will then send further updates as our investigation progresses. As information becomes available, we will tell you:

  • what happened and when, as far as we know;
  • the categories and approximate numbers of data subjects and records concerned;
  • the likely consequences;
  • what we have done or propose to do to deal with the breach and limit its effects;
  • who you can contact for more information.

We will take reasonable steps to contain and investigate the breach and to prevent it happening again, and will cooperate with you so that you can meet your own obligations. Notifying you is not an admission of fault.

11. Impact assessments and regulators

Taking into account the nature of the processing and the information available to us, we will give you reasonable help with data protection impact assessments and prior consultations with the ICO that relate to your use of JN Tempo.

12. Deletion and return at the end

  • While you have access, Admins can export Customer Data using the export tools.
  • When your organisation's access ends and is not restored, we keep Customer Personal Data for 90 days and then delete it from the live service within a further 30 days, as set out in clause 15.5 of the Terms. Deletion includes stored files and Users' sign-in accounts.
  • Database exports we make as backups (Schedule 2) are kept while they may be needed to recover the service or to check a database change, so copies of Customer Personal Data can remain in them after it has been deleted from the live service. We have not yet set a fixed period after which exports are deleted; when we do, we will publish it in an updated version of this DPA. Until an export is deleted, it remains protected by this DPA and is not used for any other purpose.
  • We may keep Customer Personal Data after that only where the law requires us to, or while it is needed for a legal claim, a dispute or a regulator's request, and only for that purpose. This DPA continues to apply to it.

13. Information and audits

We will make available the information reasonably needed to show that we meet our obligations under Article 28 of the UK GDPR, and will answer reasonable written questions about our processing.

If that information is not enough, you (or an independent auditor bound by confidentiality) may audit our compliance with this DPA:

  • on at least 30 days' written notice;
  • no more than once in any 12-month period, unless a Personal Data Breach or a regulator requires it;
  • during business hours, in a way that does not disrupt our business or compromise the security or confidentiality of other customers' data;
  • at your cost.

We do not hold any certification of our security or data protection practices. Audit rights over our Subprocessors are exercised through the reports and terms they make available.

14. Liability and precedence

Each party's liability under or in connection with this DPA is subject to the limits and exclusions in the Terms (clause 17).

If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA takes priority.

This DPA continues for as long as we process Customer Personal Data on your behalf.

Schedule 1: Details of the processing

Subject matter. Providing JN Tempo, a contractor management service, to the Customer.

Duration. For the term of the Terms, and afterwards until the Customer Personal Data is deleted under section 12.

Nature and purpose. Hosting, storing, organising, displaying, transmitting, exporting and deleting Customer Personal Data so that the Customer can:

  • record and approve timesheets, expenses and clock-in and clock-out times, and handle correction requests;
  • manage Users, invitations, onboarding, contractor profiles, placements, clients and notes;
  • manage purchase orders and their documents;
  • prepare contractor billing (billing schedules, billing runs, reminders and recorded payment statuses) and export records, including in Xero's published bill import format;
  • send the emails the Customer's workflows trigger, such as invitations, approval notifications and billing reminders;
  • view dashboards and reports, and keep an audit log of key actions;
  • receive support from us.

Data subjects.

  • the Customer's Users: Admins, managers and contractors with JN Tempo accounts;
  • people invited to become Users;
  • contractors and staff whose records the Customer keeps;
  • contacts at the Customer's clients named in records or documents.

Categories of personal data.

  • identity and contact details: names, preferred names, email addresses, usernames, phone numbers, town, region and country;
  • role, organisation, account status and work arrangement;
  • profile and onboarding photos, onboarding answers and supporting files;
  • placement details, clients, pay and charge rates, working hours and dates;
  • timesheets, expenses and receipt files, with approvals, rejections and comments;
  • clock-in and clock-out times and correction requests (no location data);
  • engagement type, payment arrangement and IR35 status, as entered by the Customer;
  • notes written by the Customer's staff;
  • purchase orders and their documents, which may name people;
  • billing schedules, billing run lines, recorded payment statuses and reminder recipients;
  • invitation and email delivery records, audit records, saved views and report templates;
  • technical data needed to provide the service, such as sign-in sessions.

Contractor bank details are not currently processed: the feature is switched off. AI features are switched off, so no Customer Personal Data is sent to an AI provider.

Special category and criminal offence data. JN Tempo is not designed to process these. Free-text fields, notes and uploaded files could contain them if the Customer enters them. The Customer is responsible for having a lawful basis and a condition for any it chooses to enter.

Frequency. Continuous, while the Customer uses JN Tempo.

Schedule 2: Security measures

These are the measures currently in place. They are not a certification, and no system can be guaranteed to be completely secure.

Hosting and encryption

  • Customer Data is stored by Supabase in London, United Kingdom. Supabase's infrastructure encrypts stored data at rest.
  • Connections to JN Tempo use HTTPS (TLS) through Cloudflare and Railway, and browsers are told to use HTTPS only (HTTP Strict Transport Security).

Separating customers and controlling access

  • Each organisation's records are separated in the database by row-level security policies, so a signed-in User can only reach their own organisation's data.
  • What a User can see and do depends on their role (Admin, manager or contractor) and their assignments. Some fields, such as phone numbers and classification details, are limited to Admins.
  • Roles and organisations are decided on the server, never taken from the browser.
  • Sensitive operations run on the server, which checks the User's session, role and organisation before acting.
  • Files (receipts, onboarding files, profile photos and purchase order documents) are kept in private storage and opened through short-lived signed links after a permission check.

Accounts and sign-in

  • Passwords are handled by Supabase Auth and stored as one-way hashes. JN Tempo requires at least 10 characters.
  • Repeated sign-in, registration and invitation attempts are rate limited.
  • Email addresses are verified before an organisation is created.
  • Deactivated Users cannot use the service.

Records and integrity

  • Key actions (submissions, approvals, rejections, and changes to contractors and placements) are written to an audit log that Admins can export.
  • Clock records, correction requests, timesheet amendments, classification history, payment records and acceptance records are append-only: they cannot be edited or deleted through the application.
  • Uploaded files are checked for type and size. They are not scanned for malware.

Operations

  • Production credentials are stored in the hosting provider's protected environment settings, not in the code.
  • Only people authorised by JN Horizon Ltd may access production systems.
  • Changes go through automated tests, including tests of organisation separation and access rules.
  • Database changes are additive and tested before they are applied.

Backups

  • Our database plan does not include automatic backups or point-in-time recovery.
  • We make occasional manual exports of the database, for example before a database change. This is not a scheduled backup service. An export contains database records and sign-in account records, but not the contents of uploaded files.
  • We have checked that an export can be loaded into a test database. Restoring the live service from an export has not been tested, so we cannot promise that all data can be recovered after an incident.
  • Exports are stored outside shared cloud file storage, in a location that only authorised people can access. Section 12 describes how long they are kept.

Schedule 3: Subprocessors

The current Subprocessors, their purposes and locations are listed on the subprocessors page, which forms part of this DPA.