Data Processing Addendum

1. Scope

This Data Processing Addendum (DPA) forms part of the agreement between the customer (controller) and WORKSOpro (processor) for the processing of personal data on the customer's behalf. This is a DRAFT baseline pending legal review.

2. Roles

The customer is the data controller and determines the purposes and means of processing. WORKSOpro acts as processor and processes personal data only on documented instructions from the customer.

3. Processing details

Subject matter: provision of the WORKSOpro workspace platform. Duration: for the term of the agreement.

Categories of data subjects and personal data include organization members and the workspace content they create.

4. Security measures

We implement appropriate technical and organizational measures, including strict tenant isolation, role-based access control, encryption in transit and audit logging.

5. Sub-processors

The customer authorizes the use of sub-processors for hosting, email, payments and monitoring. A finalized sub-processor list will be provided following legal review, along with notice of changes.

6. International transfers

Where personal data is transferred across borders, we rely on appropriate safeguards as required by applicable data protection law.

7. Assistance and sub-processing

We assist the customer with data subject requests and security obligations, and impose data protection obligations on sub-processors consistent with this DPA.

8. Deletion and return

On termination, we delete or return personal data as instructed by the customer, subject to legal retention requirements.