Data Processing Agreement
The short version
- You (the customer) control your people's data; we process it only on your instructions.
- Breach notice to you within 48 hours; CERT-In within 6 hours.
- 30 days' notice before we add a sub-processor, with a right to object.
- Data hosted in Finland (EU); EU Standard Contractual Clauses for transfers where the GDPR applies.
- The full sub-processor list is below.
This Data Processing Agreement ("DPA") forms part of the TeamLens Terms of Service between the customer ("Customer") and Stirring Minds Services Private Limited (CIN U93090DL2017PTC318023), 2nd Floor, 2-A/3, Kundan Mansion, Asaf Ali Road, New Delhi - 110002, India ("TeamLens"). It applies whenever TeamLens processes personal data on the Customer's behalf. It takes effect when the Customer accepts the Terms; a countersigned copy is available on request from info@teamlens.ai.
1. Roles
The Customer is the controller (GDPR) and data fiduciary (DPDP Act) of the personal data it puts into or records through TeamLens ("Customer Personal Data"). TeamLens is the processor. Each party will comply with the data protection laws that apply to it, including India's Digital Personal Data Protection Act, 2023 and its Rules, and, where applicable, the EU GDPR and UK GDPR.
2. Details of processing
| Subject matter and duration | Providing the TeamLens Service for the term of the Customer's subscription and the deletion period after it. |
|---|---|
| Nature and purpose | Hosting, storing, analysing and displaying work-activity data so the Customer can run attendance, time tracking, timesheets, leave, payroll exports, reports and AI summaries; support; security. |
| Data subjects | The Customer's employees, contractors and other people it monitors; its admins, managers and other authorised users. |
| Categories of data | Identity and contact details (name, work email, role, team); work sessions and attendance; app and website usage; keystroke and mouse activity counts (not keystroke content); screenshots; and, if the Customer enables them, screen recordings, live view, screen text, mobile location for attendance, and AI-generated descriptions of screenshots; device and agent details; account and audit logs. |
| Sensitive data | Not intended. Screenshots and recordings can incidentally show anything that is on screen, so the Customer should use exclusions, blurring and retention settings to limit this. |
3. TeamLens's obligations
- Instructions. Process Customer Personal Data only on the Customer's documented instructions (the Terms, this DPA and the Customer's settings in the product), unless the law requires otherwise, in which case we tell the Customer first unless the law forbids it.
- Confidentiality. Make sure people authorised to process the data are bound by confidentiality.
- Security. Apply the technical and organisational measures described on our Security page, and keep them appropriate to the risk.
- Sub-processors. Use only the sub-processors listed below, under written terms that protect the data at least as well as this DPA. We will give at least 30 days' notice of a new sub-processor by updating this page and emailing account owners; the Customer may object on reasonable data-protection grounds, and if we can't resolve it, may terminate the affected Service and receive a pro-rata refund of prepaid fees. We remain responsible for our sub-processors.
- Data subject requests. Help the Customer answer requests from people exercising their rights, mainly through the product's export, correction and deletion tools; forward any request we receive directly to the Customer.
- Personal data breaches. Notify the Customer without undue delay, and in any case within 48 hours of becoming aware of a breach affecting Customer Personal Data, with the information we have, and keep updating it. We also report cyber incidents to CERT-In within 6 hours of noticing them, as Indian law requires. The Customer remains responsible for notifying its regulators and people where the law places that duty on it as controller / data fiduciary; we will help.
- Assistance. Give reasonable help with the Customer's impact assessments and consultations with regulators, taking into account the information available to us.
- Deletion and return. At the end of the subscription, the Customer can export its data for 30 days. After that we delete Customer Personal Data from live systems within a further 30 days, and from backups as they roll over, unless the law requires us to keep it.
- Audits. Make available the information reasonably needed to show compliance with this DPA, including answers to security questionnaires and, once available, third-party audit reports. On-site audits are by agreement, with reasonable notice, at the Customer's cost, and at most once a year unless a regulator requires it or there has been a breach.
4. Customer obligations
The Customer is responsible for having a lawful basis for the monitoring it carries out, for giving notice to the people it monitors, for configuring TeamLens appropriately (capture, blurring, exclusions, AI analysis, retention), and for the lawfulness of its instructions.
5. International transfers
Customer Personal Data is primarily hosted in Finland (EU). Some sub-processors process data in other countries, including India and the United States. Where the GDPR or UK GDPR applies to such a transfer, the parties agree that the EU Standard Contractual Clauses (Module 2 or 3, as applicable) and, for the UK, the UK Addendum are incorporated by reference. Transfers under the DPDP Act are made only to countries not restricted by the Government of India.
6. Liability and precedence
Each party's liability under this DPA is subject to the limits in the Terms. If this DPA conflicts with the Terms on data protection, this DPA wins.
7. Sub-processors
Current as of 26 October 2026.
| Sub-processor | What it does for TeamLens | Location | Data involved |
|---|---|---|---|
| Hetzner Online GmbH | Dedicated server hosting the TeamLens app, API, databases, screenshot and recording storage, live-view relay and backups | Finland (Helsinki data centre), EU | All TeamLens data |
| Cloudflare, Inc. | DNS, network proxy and TLS for teamlens.ai, app.teamlens.ai and api.teamlens.ai; hosting of the marketing website and status page; AI inference (Workers AI) that runs the model used for screenshot summaries | Global network; US company | Traffic passing through; screenshots and extracted text sent for AI summaries when enabled |
| Resend | Transactional email (sign-up, invitations, password resets, notices) | United States | Name, email address, email content |
| Dodo Payments | Payments and subscriptions as merchant of record; invoices and tax | See provider | Billing contact, country, tax details, payment details (collected directly by Dodo) |
| Google LLC | Google sign-in (if you choose it), place/address look-ups for office locations, and our company email (Google Workspace) | United States / global | Name, email, profile picture; office addresses; emails you send us |
| Hostinger International Ltd. | Server hosting our self-hosted support chat (Chatwoot) | India (Mumbai) | Name, email and messages you send in the support chat |
TeamLens's own team in India accesses Customer Personal Data only to provide support you ask for, to keep the Service running and secure, or when the law requires it.