Data Processing Agreement (DPA)

1. Instructions and scope

The processor acts only on documented instructions for hosting, organizing, securing, backing up, supporting, exporting and deleting customer data.

2. Confidentiality and security

Authorized personnel are bound by confidentiality. Measures include tenant isolation, least privilege, encryption, 2FA, logging, monitoring, incident response and tested backups.

3. Subprocessors and transfers

• Subjects: employees, applicants, customers, suppliers, partners, representatives and users.
• Data: identification and contact data, labor and schedule data, contractual, financial, warehouse, communication and technical records.
• Special categories are processed only if the customer has a valid reason and has activated appropriate restrictions.

4. Assistance and incidents

The processor reasonably assists with data-subject rights, impact assessments and regulator requests, and reports confirmed personal-data breaches without undue delay.

5. Return, deletion and audits

• Logical tenant isolation, role control and principle of minimum rights.
• Encryption in transit, protection of secrets and encryption of sensitive values.
• 2FA, password policy, rate limiting, audit and access logging.
• Monitoring, health checks, vulnerability management and incident response.
• Periodic backups, controlled recovery and retention of archives.

6. Subcontractors

Customer grants general permission to subcontractors necessary for the Service. The supplier shall impose equivalent obligations and notify of material changes through the agreed channel, providing a reasonable period for objection.

7. International transfers

Where necessary, the parties shall enter into applicable standard contractual clauses. Modules, roles and applicable law vary by location and country.

8. Assistance and Incidents

The Processor reasonably assists with subject rights, impact assessments, consultations and regulatory inquiries. For a confirmed breach of personal data, the client is notified without undue delay with the available information.

9. Deletion, Return and Audit

Upon termination, the data is returned or deleted at the customer's option, except where retention is required by law. Provider provides compliance information and permits reasonable auditing with confidentiality, prior notice and without risk to other customers.

10. Priority and Signature

In the event of a conflict, this DPA prevails in matters of personal data processing. It becomes effective through a signed contract, order or electronic acceptance by an authorized representative.