Data Processing Agreement

1. Definitions

Terms not defined here have the meaning given in the Agreement. Controller, processor, data subject, personal data, personal data breach, processing and supervisory authority have the meanings given in Data Protection Laws.

• Customer Personal Data means personal data within Customer Data that we process on your behalf in providing the Service.
• Data Protection Laws means the UK GDPR, the Data Protection Act 2018, the EU GDPR (Regulation (EU) 2016/679) where it applies, US state privacy laws where they apply, and any other data protection law applicable to the processing, each as amended or replaced.
• EU SCCs means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
• UK Addendum means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
• Restricted Transfer means a transfer of Customer Personal Data to a country that does not benefit from an adequacy decision or regulations under the applicable Data Protection Laws.
• Subprocessor means any third party we engage to process Customer Personal Data.

2. Roles and scope

You are the controller and we are the processor of Customer Personal Data. Where you act as a processor for another controller, we are your subprocessor and you confirm that your instructions are authorised by that controller. The subject matter, duration, nature and purpose of the processing, and the types of personal data and categories of data subjects, are set out in Annex 1.

This DPA does not apply to personal data we process as a controller, such as account, billing and support data, which is covered by our Privacy Policy.

3. Your obligations

• You will comply with Data Protection Laws in your use of the Service and in the instructions you give us.
• You are responsible for having a lawful basis for the processing, for providing privacy information to your staff and other data subjects, and for the accuracy and lawfulness of Customer Personal Data.
• You will configure the Service, including roles, permissions, leave types and calendar feeds, so that access to personal data is appropriate, and you will not enter special category data beyond what is necessary for leave records (see Annex 1).

4. Processing on your instructions

We will process Customer Personal Data only on your documented instructions, unless required to do otherwise by UK law or other law to which we are subject, in which case we will tell you of that requirement before processing unless the law prohibits it. The Agreement, this DPA and your use and configuration of the Service are your complete documented instructions. Additional instructions require our written agreement.

We will tell you promptly if, in our opinion, an instruction infringes Data Protection Laws. We may then suspend that processing until the instruction is confirmed or changed.

We will not sell or share Customer Personal Data, use it for advertising, use it to train general artificial intelligence models, or combine it with personal data from other sources except as needed to provide the Service.

5. Confidentiality of personnel

We will ensure that anyone authorised to process Customer Personal Data is bound by a duty of confidentiality, has access only to what is necessary for their role, and is trained appropriately. We will access the contents of a Workspace only where needed to provide support you request, to maintain or secure the Service, or to comply with law.

6. Security

We will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing. Our current measures are described in Annex 2. We may update them, provided the overall level of protection is not reduced.

7. Subprocessors

• 7.1 General authorisation. You give us general written authorisation to engage Subprocessors. Our current Subprocessors are listed in Annex 3 and on our Subprocessors page.
• 7.2 Subprocessor contracts. We will impose data protection obligations on each Subprocessor by written contract that are no less protective than those in this DPA, to the extent applicable to the service it provides. We remain liable to you for each Subprocessor’s performance of those obligations.
• 7.3 Notice of changes. We will give at least 30 days’ notice before a new Subprocessor processes Customer Personal Data, by updating the Subprocessors page and emailing those who have asked for updates. In an emergency affecting the security or availability of the Service, we may give shorter notice and will explain why.
• 7.4 Objections. You may object to a new Subprocessor on reasonable data protection grounds by emailing support@workframe.online within the notice period. We will discuss your concerns in good faith and try to offer a reasonable alternative. If we cannot resolve the objection within 30 days, you may terminate the affected Subscription by written notice and we will refund any prepaid fees for the period after termination.

8. International transfers

We may process Customer Personal Data, and allow Subprocessors to process it, outside the UK and the European Economic Area, including in the United States, provided that each Restricted Transfer is protected by a valid transfer mechanism under Data Protection Laws. These include adequacy regulations or decisions (including the UK Extension to the EU–US Data Privacy Framework for certified recipients), the UK International Data Transfer Agreement, the UK Addendum and the EU SCCs.

To the extent that you transfer Customer Personal Data from the European Economic Area or Switzerland to us in the United Kingdom, the European Commission’s adequacy decision for the United Kingdom applies. If that decision ceases to apply, the EU SCCs (as set out in Annex 4) will apply automatically to the transfer. For onward Restricted Transfers to Subprocessors, we will put in place appropriate safeguards with the Subprocessor and carry out a transfer risk assessment.

9. Personal data breaches

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We will send notice to the Workspace owners’ email addresses.

Our notice will describe, as far as we know at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it and mitigate its effects. Where information is not yet available, we will provide it in phases as it becomes available.

We will take reasonable steps to contain, investigate and remedy the breach, and will cooperate with you so that you can meet your obligations to notify supervisory authorities and data subjects. Our notification is not an acknowledgement of fault or liability.

10. Assistance

• Data subject requests. The Service lets you access, correct, export and delete Customer Personal Data. If we receive a request from a data subject relating to Customer Personal Data, we will forward it to you within three business days and will not respond directly except to confirm that it has been passed on, unless you instruct us otherwise. We will provide reasonable assistance, taking into account the nature of the processing, to help you respond.
• Impact assessments and consultation. We will provide reasonable information and assistance to help you carry out data protection impact assessments and any prior consultation with a supervisory authority relating to the Service.
• Records. We will maintain records of processing activities carried out on your behalf, as required by Article 30(2) of the UK GDPR.
• Authority requests. If we receive a legally binding request from a public authority for Customer Personal Data, we will notify you unless the law prohibits it, challenge requests we consider unlawful, and disclose only the minimum required.

We may charge a reasonable fee for assistance that goes beyond what the Service provides or that results from your own non-compliance, and will agree it with you in advance.

11. Return and deletion

You can export Customer Personal Data at any time from Settings, including during the read-only period after a Subscription or trial ends. On termination of the Agreement, we will delete Customer Personal Data from the live Service within 90 days, or immediately if a Workspace owner deletes the Workspace. Copies in encrypted backups are overwritten within 30 days after that. We may retain Customer Personal Data where UK law requires it, in which case this DPA continues to protect it and we will process it only for that purpose. We will confirm deletion in writing on request.

12. Information and audits

We will make available all information reasonably necessary to demonstrate our compliance with this DPA and Article 28 of the UK GDPR. You agree to exercise your audit rights first by reviewing the information we provide, including this DPA, our security documentation and our answers to a reasonable security questionnaire, which you may send no more than once a year.

If that information is not sufficient, or a supervisory authority requires it, or following a personal data breach, you or an independent auditor bound by confidentiality may audit our compliance on at least 30 days’ written notice, during business hours, no more than once in any 12-month period, and in a way that does not disrupt our business or compromise the security of other customers. You bear the costs of any audit. Audits of Subprocessors are carried out through the reports and certifications they make available.

13. United States privacy laws

Where US state privacy laws apply, we act as your service provider or processor. We will not sell or share Customer Personal Data, retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing the Service, or combine it with other personal information except as those laws permit. We will notify you if we can no longer meet these obligations, and you may take reasonable steps to stop and remediate unauthorised use.

14. Liability

Each party’s liability arising out of or in connection with this DPA, including under the EU SCCs and UK Addendum to the extent permitted by law, is subject to the exclusions and limitations of liability in the Agreement. Nothing in this DPA limits either party’s liability to data subjects under Data Protection Laws or the EU SCCs.

15. Term, precedence and governing law

This DPA lasts for as long as we process Customer Personal Data. If this DPA conflicts with the Agreement, this DPA prevails on data protection matters. If the EU SCCs or UK Addendum conflict with this DPA, the EU SCCs or UK Addendum prevail. We may update this DPA where required by changes in law or our services, giving notice under the Agreement, provided the update does not reduce the protection of Customer Personal Data.

This DPA is governed by the law of England and Wales and the courts of England and Wales have exclusive jurisdiction, except where the EU SCCs or UK Addendum require otherwise.

Annex 1: Description of the processing

Annex 2: Technical and organisational security measures

Data separation and access control

• Each organisation’s data is separated by database row-level security. The application connects with a restricted database role that cannot bypass row-level security, and every query is scoped to the signed-in user.
• Server-side checks of authentication, verified email, organisation membership, role, input and resource ownership for every action.
• Role-based permissions within each Workspace (owner, administrator, manager, staff). Nobody can approve their own leave, which is enforced in the database.
• Privileged database credentials and API keys are held only on the server as encrypted secrets and are never sent to the browser.
• Administrative access by our staff is limited to named individuals, uses the minimum privileges needed, and is logged.

Authentication

• Passwords of at least 12 characters, stored only as salted hashes by our authentication provider.
• Email verification before access to a Workspace; optional sign-in with Google.
• Secure, HTTP-only session cookies and server-side session validation.
• Calendar feed URLs generated with 256 bits of randomness, stored only as hashes and revocable at any time.

Encryption

• All traffic between browsers, our application, our database and our providers is encrypted in transit using TLS, with HTTPS enforced.
• Data at rest, including backups, is encrypted by our database and infrastructure providers using AES-256.

Availability and resilience

• Managed database with continuous backups and point-in-time recovery.
• Global edge network with DDoS protection.
• Billing webhooks verified by signature and processed idempotently.

Monitoring, logging and change management

• Audit events for reviewer changes, approvals and security-sensitive administration.
• Error and request logging with limited retention.
• Source code in version control; changes are tested before deployment; dependencies are reviewed and updated regularly.

Organisational measures

• Confidentiality obligations and data protection training for anyone with access to Customer Personal Data.
• Due diligence and written data protection terms with every Subprocessor.
• A documented incident response process, including the breach notification commitments in section 9.
• Privacy by design: we collect the minimum data needed, and calendar feeds exclude leave notes and work log content.
• Regular review of these measures.

Annex 3: Authorised Subprocessors

The current list is maintained on our Subprocessors page.

Annex 4: Transfer mechanisms

EU Standard Contractual Clauses

Where the EU SCCs apply under section 8, they are incorporated by reference as follows: Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor. Clause 7 (docking clause) applies. Under Clause 9, Option 2 (general written authorisation) applies with the notice period in section 7.3. The optional wording in Clause 11 does not apply. Under Clause 13, the competent supervisory authority is that of the EU Member State identified under that clause. Under Clauses 17 and 18, the governing law is the law of Ireland and disputes are resolved by the courts of Ireland. Annexes I and II of the EU SCCs are completed by Annexes 1 and 2 of this DPA, and Annex III by Annex 3.

UK Addendum

Where a Restricted Transfer of Customer Personal Data is subject to UK Data Protection Laws and is not covered by adequacy regulations, the UK Addendum is incorporated by reference. Table 1 is completed with the parties’ details in Annex 1; Table 2 refers to the EU SCCs as set out above; Table 3 is completed by Annexes 1 to 3 of this DPA; and for Table 4, neither party may end the UK Addendum under its Section 19.