Data Processing Agreement

1.1 Workplacer acts as a Data Processor on behalf of the Client, who acts as the Data Controller for all personal data processed under the Client Agreement.

1.2 Workplacer will process personal data solely for the purpose of providing, maintaining, and improving the Workplacer software and related services in accordance with the Client's documented instructions.

2.1 Workplacer shall process Personal Data in compliance with all data protection and privacy laws that are applicable to the Services and the Parties' roles under this Agreement (“Applicable Data Protection Laws”).

2.2 For clarity, Applicable Data Protection Laws include, where relevant:

• the EU General Data Protection Regulation (GDPR), the UK GDPR, and the Swiss FADP;
• major privacy frameworks in North America, including the California Consumer Privacy Act (CCPA/CPRA) and other applicable U.S. state laws;
• significant international laws such as the Brazil LGPD, the Singapore PDPA, the Hong Kong PDPO, the Japan APPI, and the India DPDP Act; and
• any other laws that, by their terms, apply to Workplacer's processing of Client Data.

2.3 The Client is responsible for informing Workplacer of any specific legal or regulatory requirements that apply to its industry or jurisdiction which may materially affect Workplacer's processing of Personal Data.

2.4 If multiple regimes apply, Workplacer shall comply with the standard that provides the highest level of protection to data subjects for the relevant processing.

3.1 Workplacer processes personal data solely for the purpose of delivering the services described in the Client Agreement.

3.2 This includes workplace analysis, reporting, AI-supported features, and related advisory support services.

4.1 Workplacer shall process personal data only:

• in accordance with the Client's documented instructions,
• to provide the agreed services, and
• in compliance with applicable law.

5.1 Workplacer shall implement appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage.

5.2 Persons authorized to process data shall be subject to confidentiality obligations.

6.1 This DPA shall apply for the duration of the Client Agreement and remain in effect until Workplacer has returned or securely deleted all personal data in accordance with Section 13.

7.1 Workplacer shall:

• process data only on Client instructions;
• maintain appropriate security measures;
• ensure confidentiality of personnel;
• assist the Client in fulfilling obligations regarding data subject rights, breach notifications, and data protection impact assessments;
• notify the Client without undue delay of personal data breaches;
• make available information necessary to demonstrate compliance and allow for audits upon reasonable notice;
• upon termination, return or securely delete Client Data as set out in Section 13.

8.1 The Client shall:

• ensure it has a lawful basis and necessary consents to provide personal data to Workplacer;
• ensure its use of the services complies with applicable laws and this Agreement.

9.1 Workplacer may engage sub-processors (e.g., hosting, authentication, AI services) to deliver services.

9.2 Workplacer shall ensure sub-processors are bound by written agreements with safeguards equivalent to this DPA.

9.3 A current list of sub-processors is available in Schedule A (Subprocessor List) and may be updated by Workplacer.

9.4 Certain Services rely on AI subprocessors. The specific terms governing Workplacer's use of AI services, including data sanitization, transparency, opt-out rights, and liability for AI-generated outputs, are set out in Schedule B (Use of AI Services), which forms an integral part of this DPA.

9.5 Workplacer shall notify the Client of material changes, and the Client may object on reasonable grounds, provided such objection does not unreasonably prevent Workplacer from delivering the Services.

10.1 Workplacer stores and processes Client Data primarily within the EU/EEA.

10.2 If international transfers are required, Workplacer shall implement appropriate safeguards, including the EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum or Agreement (IDTA), the Swiss FDPIC addendum, or other legally recognized transfer mechanisms under Applicable Data Protection Laws.

11.1 Workplacer shall, to the extent reasonably possible, assist the Client in responding to data subject requests (e.g., access, rectification, erasure, portability) under Applicable Data Protection Laws.

12.1 Upon reasonable notice, Workplacer shall make available to the Client all information necessary to demonstrate compliance with this DPA and Applicable Data Protection Laws. Where legally required, Workplacer shall allow for on-site inspections or third-party audits, provided such audits are reasonable in scope and frequency, coordinated in advance, and the Client bears associated costs.

13.1 Upon termination or expiry of the Client Agreement, Workplacer shall, at the Client's choice, either return all personal data in a commonly used machine-readable format or securely delete it, unless retention is required by law.

13.2 The Client may request extraction of its data during the Client Agreement and for thirty (30) days after termination. After that, Workplacer may delete or anonymize the data in accordance with its Privacy Policy.

14.1 Each Party's liability under this DPA is subject to the liability provisions of the Client Agreement.

14.2 Workplacer shall not be responsible for the Client's failure to comply with its obligations as Data Controller, including obtaining lawful bases or consents for processing.

14.3 In case of conflict between this DPA and the Client Agreement with respect to personal data, this DPA shall prevail. For the avoidance of doubt, the limitations of liability set out in the Client Agreement shall apply equally to this DPA.

This DPA, including its schedules, is publicly available at www.workplacer.ai/dpa and applies automatically to all Clients who have entered into a valid Client Agreement with Workplacer.