Data Processing Agreement
Data Processing Agreement
Last updated : August 4, 2026
When you use Puuunch for your team, we process personal information about your employees on your behalf. Quebec’s Law 25 requires a written agreement in that situation — this is it. It applies automatically once you accept the terms of use; there is nothing to sign.
Roles of the parties
Your organization is the controller of its employees’ personal information: you decide to collect it, for what purposes, and you obtain any required consents.
Puuunch (Dominic Martineau, an independent contractor based in Quebec) acts as your service provider: we process that information only on your instructions and to provide the service to you.
Purpose and duration
We process the information solely to run Puuunch for your organization: accounts and authentication, time and expense entry, approvals, reports, billing, and support.
Processing lasts as long as your account is active. When you delete your organization we retain the data for 30 days (so an accidental deletion can be undone), then delete it permanently, receipts included.
Categories of data and people
People: members of your organization (owners, admins, employees).
Information: name, email address, role, hours worked and associated notes, expenses and receipts, employment settings (weekly hours, hourly cost, vacation and sick balances), and the technical logs needed for security.
We process no sensitive categories: no health information, no biometrics, no geolocation, and no employee monitoring.
Our commitments
- Process the information only to provide the service to you, never for our own purposes, and never sell it.
- Limit access to what is strictly necessary. In practice, exactly one person holds administrative access to production.
- Apply reasonable security measures: encryption in transit and at rest, hashed passwords, per-organization data isolation, and two-factor authentication on our operational accounts.
- Notify you without delay of any confidentiality incident affecting your data, with the information you need to meet your own obligations.
- Help you respond to your employees’ access, correction, or deletion requests. Each person can also download their own information directly from the app.
- Delete or return the information at the end of the service, as described above.
Subprocessors
We rely on a small number of providers to run the service. The complete list — their role and what they receive — is on our security page. We require protection commitments from each of them comparable to our own.
If we add a subprocessor that handles personal information, we update that list; for any material change we notify you by reasonable means.
Hosting and transfers outside Quebec
Data is hosted on AWS infrastructure located in Canada.
Some subprocessors may process information outside Quebec — notably Stripe for billing, and Google if your employees use Google sign-in. We have assessed that the information receives adequate protection there, considering its sensitivity, those providers’ contractual commitments, and the applicable legal framework.
Verification
On reasonable request we will answer your security and compliance questions in writing and provide the information you need for your own assessments. We hold no SOC 2 or ISO 27001 certification, and we do not pretend otherwise.
Contact
For any question about this agreement, write to prp@puuun.ch. If your organization requires a signed agreement on its own template, get in touch and we will discuss it.