Data Processing Agreement

This Data Processing Agreement (“DPA”) is between Vantage Enterprises, LLC (“Vantage,” the processor) and the customer that accepts our Terms of Service (the “Customer,” the controller). It forms part of the Terms and applies whenever Vantage processes Customer Personal Data, meaning personal data in Customer Data, on the Customer’s behalf.

It is written to meet Article 28 of the EU General Data Protection Regulation and the UK GDPR (together, the “GDPR”), the Swiss Federal Act on Data Protection, and the service provider requirements of the California Consumer Privacy Act as amended by the CPRA and similar US state laws (“US State Privacy Laws”).

Vantage is a controller, not a processor, for the information our Privacy Policy describes as ours: account sign-in details, billing contacts, messages to us, and records we keep to secure the Service.

• Subject matter and duration: providing the Service under the Terms, for as long as the Customer uses it, and until the data is deleted under Section 9.
• Nature and purpose: hosting, storing, organizing, transmitting, displaying, and otherwise processing Customer Personal Data to run the tools the Customer turns on, including scheduling, time tracking, messaging, forms, tasks, documents, HR records, training, recognition, rewards, email and social marketing, and AI features.
• Data subjects: the Customer’s employees, contractors, and other members; job applicants (through Recruiting); the Customer’s own customers and contacts (through the Email tool); and people named in content members add.
• Categories of data: identifiers and contact details; job, team, and site details; work schedules, availability, and time records; location at clock-in and clock-out; pay rates, bank details, and tax forms where collected; time off records and attached documents; messages, files, photos, and signatures; training and recognition records; marketing contact lists and consent records; and content of AI requests.
• Special categories: the Service is not designed for special category data. Where a member includes some, such as a health note in a time off request, the Customer is responsible for having a lawful basis and keeping it to what is needed.

• Instructions. Process Customer Personal Data only on the Customer’s documented instructions, which are the Terms, this DPA, and the Customer’s use and settings of the Service, unless the law requires otherwise, in which case we will tell the Customer first unless the law forbids it. We will tell the Customer if we think an instruction breaks data protection law.
• Confidentiality. Make sure the people who process the data are bound to keep it confidential and access it only as needed to provide and support the Service.
• Security. Keep appropriate technical and organizational measures in place, as our Security Overview describes, and review them as risks change.
• Help with requests. Help the Customer answer data subject requests, mainly through features of the Service, and pass on any request we receive directly without answering it ourselves unless the Customer asks.
• Help with compliance. Give reasonable help with data protection impact assessments and consultations with authorities that relate to the Service.
• No other use. Not use Customer Personal Data for our own purposes, not sell it, and not use it to train AI models.

The Customer authorizes Vantage to use the subprocessors on our Subprocessors page. We bind each one by written contract to data protection terms at least as protective as this DPA, and we remain responsible for their work. We give at least fourteen (14) days’ notice of a new subprocessor. The Customer may object on reasonable data protection grounds within that time by writing to [email protected]; if we cannot resolve it, the Customer’s exclusive remedy is to end the affected service without penalty and receive a refund of prepaid fees for the unused period.

Payroll is not available yet. When the Customer turns it on, payroll is provided by Check Technologies, Inc. (“Check”), which is listed on our Subprocessors page and also provides its payroll services to the Customer under its own agreement with the Customer. Optional payroll add-ons are provided by licensed third-party partners under their own terms, and receive information only when the Customer turns one on.

Customer Personal Data is stored and processed in the United States. To the extent the GDPR applies to a transfer to Vantage, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module 2 (controller to processor), are incorporated into this DPA, with the Customer as data exporter and Vantage as data importer; the optional clause 7 does not apply; clause 9 option 2 (general authorization) applies with the notice period in Section 4; clause 11’s optional language does not apply; and clauses 17 and 18 choose the law and courts of Ireland. For the UK, the International Data Transfer Addendum issued by the Information Commissioner applies, and for Switzerland the clauses apply with the FADP as the governing law of the transfer and the Swiss regulator as the competent authority. The annexes are completed by Section 2 of this DPA, our Security Overview, and our Subprocessors page.

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data, we will tell the Customer without undue delay and in any event within seventy-two (72) hours, by email to the workspace owner. We will say what we know, what we are doing about it, and keep the Customer updated as we learn more. Telling the Customer is not an admission of fault.

On written request, no more than once a year unless an authority requires it or after a breach, we will answer a reasonable security questionnaire and make available the information needed to show we meet this DPA. Where that is not enough, the Customer may audit, at its cost, with thirty (30) days’ notice, during business hours, under confidentiality terms, and in a way that does not expose other customers’ data.

For data covered by US State Privacy Laws, Vantage is a service provider or processor. We will not sell or share Customer Personal Data; not keep, use, or disclose it outside our direct business relationship with the Customer or for any purpose other than the business purposes in the Terms; not combine it with personal data from other sources except as the law allows; and comply with those laws and provide the same level of privacy protection they require. The Customer may take reasonable steps to stop and fix unauthorized use. We will tell the Customer if we can no longer meet these obligations.

During the term, the Customer can export data through the Service’s export features. When the Customer closes its workspace, we delete Customer Personal Data within ninety (90) days, unless the law requires us to keep it, in which case we keep protecting it and use it for nothing else. Security logs expire on their own schedule.

Each party’s liability under this DPA is subject to the limits in the Terms, as far as the law allows. If this DPA conflicts with the Terms about the processing of personal data, this DPA wins; if the Standard Contractual Clauses conflict with this DPA, the clauses win.

The Customer accepts this DPA by accepting the Terms. For a signed copy, write to [email protected].