Data Processing Terms
Last updated: 2026-11-05
These terms are part of the User Agreement and apply when the operator of the Banshao service (“we”) processes personal data for a company. A company that needs this document can save this page; accepting the User Agreement accepts these terms, with no separate signature. They are not legal advice and do not state that either party complies with any law.
1. Roles and scope
The company decides the purposes and means of processing, so it is the controller. We process company data on its behalf, so we are the processor. These words are read under the data protection law that applies to the company; if that law uses other names, they mean the corresponding roles. Annex A describes the processing.
These terms do not apply when we handle account and billing data for our own purposes; the privacy policy applies to that.
2. The company's responsibilities
The company is responsible for: having a lawful basis for the processing; giving employees the notice the law requires and obtaining consent where needed; deciding whether the retention period and screenshot interval are reasonable; handling employees' requests; and making sure its instructions are lawful. It can use the notice template (/monitoring-notice) as a starting point but should adapt it to local law.
3. Processing on instructions
We process company data only on the company's written instructions. These are the User Agreement, these terms, and the company's settings and actions in the service (such as the screenshot interval, retention days, deleting employees and closing the company). The exception is where the law requires us to process; then, where allowed, we will tell the company first. If we think an instruction is unlawful we will tell the company and may pause it.
4. Confidentiality
Only people who need it can reach company data, and they must keep it confidential. Platform administrators can view a company's dashboard in read-only mode for support and maintenance, and each opening is logged.
5. Security
We apply the technical and organisational measures in Annex B and may change them as long as overall protection is not reduced. The company is responsible for the security of its accounts, passwords and computers, and for deciding who are managers and team leads.
6. Sub-processors
The company gives general authorisation for the sub-processors listed in section 6 of the privacy policy. We put them under data protection duties suited to the service they provide (as far as practical, including by accepting their standard terms), and answer for their performance of those duties as set out in the User Agreement.
When we add or replace a sub-processor we will update the privacy policy and give reasonable notice beforehand (by the owner's email or a notice in the dashboard). A company with reasonable grounds to object should tell us; if it cannot be resolved, the company's remedy is to stop using the service and close the company.
7. International transfers
Company data may be processed outside the country of the company or its employees; see section 7 of the privacy policy. The company decides whether it needs a transfer mechanism under its law. If it needs specific transfer clauses or documents, please contact us before using the service; these terms do not themselves include any such mechanism.
8. Assistance and data subject requests
The company can itself view, export, correct and delete most data in the service: viewing employees' hours, screenshots and IP records, changing employee details, adjusting retention days, exporting hours as CSV, deleting employees, and closing the company to export all data.
If we receive a request directly from an employee, we will pass it to the company or ask them to contact it, and will not answer it ourselves unless the law requires. We will reasonably help the company respond to requests, carry out impact assessments and deal with authorities; help beyond the service's own features may carry a reasonable charge.
9. Security incidents
If we become aware of a personal data breach affecting company data, we will tell the company promptly and without undue delay (by the owner's email), saying what is known and what has been done, and will follow up as we learn more. This notice is not an admission of fault. The company decides whether it must notify authorities or employees.
10. Deletion and return
The owner can close the company and download a ZIP export. 24 hours after the download, or when the owner confirms it is saved, or 7 days after packing if it is never downloaded, we delete company data from the servers, and copies in backups disappear within 3 days. See section 5 of the privacy policy for what remains after deletion. Data the law requires us to keep is an exception.
A full export is only available through the closing process. That process stops employees' recording at once, but it can be cancelled until deletion starts.
11. Information and audits
The company can ask us in writing how we follow these terms and we will answer within reason. If applicable law requires the company to audit, the parties will agree a reasonable scope, time and confidentiality, normally starting with written questions, at the company's cost. We hold no security certification and cannot provide certification reports.
12. Liability and precedence
Liability under these terms is subject to the limits in the User Agreement, except where the law does not allow a limit. If these terms and the User Agreement differ on the processing of personal data, these terms prevail.
Annex A: Description of processing
The table describes the processing we carry out for the company.
| Item | Description |
|---|---|
| Purpose | Providing the company with hours records, scheduled screenshots, reports and dashboard views. |
| Data subjects | The company's employees and contractors, and other people who may happen to appear in screenshots. |
| Categories of data | The categories marked as processor in section 2 of the privacy policy. |
| Sensitive data | The service does not ask for sensitive data, but screenshots contain whatever is on the screen and may show it. The company should reduce this risk through training and settings. |
| Operations | Receiving, storing, displaying, exporting and deleting. |
| Frequency and duration | Continuous during shifts, at the screenshot interval the company sets, for as long as the company uses the service. See section 5 of the privacy policy for retention. |
Annex B: Security measures
The measures we currently apply:
- Transmission: the website and the app use HTTPS, and traffic passes through Cloudflare.
- Access control: data separated by company, four roles, permissions checked on every request, and read-only, logged access for platform administrators.
- Authentication: passwords stored as salted PBKDF2-HMAC-SHA256 hashes, limited sign-in attempts, and only hashes of device tokens stored.
- Storage and backup: the database and screenshots are on the main server, protected by server access controls and not separately encrypted. Backups run daily, are encrypted before leaving the server, are held on another server and kept for 3 days.
- Servers: administration accepts key-based sign-in only, a firewall limits ports, and there is monitoring and alerting.
- Not currently in place: two-step sign-in, separate encryption of stored data, security certification.
Contact: Telegram @yuankui666 · [email protected]