Skip to content
JN Tempo

Data Processing Agreement

This is the version published in April 2026 (version 2026-04), when the service was called JN Times. It is shown here unchanged.

DATA PROCESSING AGREEMENT (DPA)

Last updated: April 2026

This Data Processing Agreement forms part of the Terms and Conditions between JN Labs (the "Processor") and the subscribing organisation (the "Controller").

1. DEFINITIONS

  • Controller: the organisation (company/business) subscribing to JN Times who determines the purposes of processing personal data
  • Processor: JN Labs, who processes personal data on behalf of the Controller
  • Data Subjects: contractors, managers and other individuals whose data is processed via JN Times

2. SCOPE OF PROCESSING

JN Labs processes the following categories of personal data on behalf of the Controller:

  • Names and email addresses of contractors and managers
  • Timesheet and working hours data
  • Expense data and receipt images
  • Employment type and placement information

Purpose: to provide the JN Times contractor management platform.

3. PROCESSOR OBLIGATIONS

JN Labs agrees to:

  • Process personal data only on documented instructions from the Controller
  • Ensure persons authorised to process data are under confidentiality obligations
  • Implement appropriate technical and organisational security measures
  • Not engage sub-processors without prior consent (current sub-processors: Supabase, Stripe, Resend)
  • Assist the Controller in responding to data subject rights requests
  • Delete or return all personal data upon termination of the agreement
  • Provide all information necessary to demonstrate compliance with GDPR obligations

4. CONTROLLER OBLIGATIONS

The Controller agrees to:

  • Ensure there is a lawful basis for processing contractors' personal data
  • Inform contractors that their data is processed via JN Times
  • Only upload data necessary for the operation of the platform

5. SECURITY

JN Labs implements the following security measures:

  • Encryption in transit (HTTPS/TLS)
  • Row-level security on all database tables
  • Authentication via Supabase Auth with secure session management
  • Access controls ensuring organisations can only access their own data

6. SUB-PROCESSORS

Current approved sub-processors:

  • Supabase Inc — database and authentication (US, with EU data residency options)
  • Stripe Inc — payment processing (US, EU-US Data Privacy Framework)
  • Resend Inc — transactional email (US)
  • JN Labs (Aegis API) — AI insights and chat (UK); processes contractor summaries and workforce data only when AI features are used

7. DATA TRANSFERS

Where data is transferred outside the UK/EEA, JN Labs ensures appropriate safeguards are in place including Standard Contractual Clauses where required.

8. TERM

This DPA remains in effect for the duration of the subscription and terminates automatically upon account closure, subject to the retention periods in the Privacy Policy.

9. CONTACT

Data protection queries: [email protected]