Data Processing Addendum (DPA)

This Data Processing Addendum (“DPA”) forms part of the agreement between the Customer and TechnoFex Ltd, the provider of Worksii (“Processor”), and governs the processing of personal data on behalf of the Customer in accordance with applicable data protection laws.

1. Definitions

• Data Protection Laws refers to all laws and regulations applicable to the processing of personal data, including the UK GDPR, the EU GDPR, and other applicable national laws.
• Personal Data means any information relating to an identified or identifiable individual.
• “Processing”, “Data Controller”, “Data Processor”, and “Data Subject” shall have the meanings ascribed to them under the GDPR.
• Sub-Processor means any third party engaged by Worksii to process Personal Data on behalf of the Customer.

2. Roles of the Parties

• The Customer acts as the Data Controller.
• Worksii (TechnoFex Ltd) acts as the Data Processor.
• Assign roles (Admin, Marketing, Support, Finance)

Worksii may engage Sub-Processors as described in this DPA.

3. Scope and Purpose

Worksii shall process Personal Data only for the purpose of providing messaging, automation, analytics, and support services under the primary agreement between the parties. Processing shall be carried out strictly in accordance with documented instructions provided by the Customer.

4. Sub-Processors

Worksii may use Sub-Processors to provide hosting, communication delivery, analytics, and support services. A list of current Sub-Processors is available upon request. The Customer will be notified of any intended changes concerning the addition or replacement of Sub-Processors.

Worksii shall ensure all Sub-Processors are contractually bound by obligations no less protective than those in this DPA.

5. Security Measures

Worksii implements appropriate technical and organizational measures to protect Personal Data including:

• Encryption in transit and at rest
• Access controls and authentication
• Logging and monitoring
• Data minimization and role-based access
• Regular risk assessments and training

Additional details are available upon request.

6. Data Subject Rights

Worksii shall assist the Customer in fulfilling obligations to respond to requests from Data Subjects exercising their rights under the GDPR or other applicable Data Protection Laws. These include the rights of access, rectification, erasure, restriction, portability, and objection.

7. Data Transfers

If Personal Data is transferred outside the UK or EEA, Worksii will ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs)
• International Data Transfer Addendums
• Additional technical or contractual protections

8. Data Breach Notification

In the event of a personal data breach affecting the Customer’s Personal Data, Worksii will:

• Notify the Customer without undue delay
• Provide sufficient details and status updates
• Assist the Customer in fulfilling legal reporting obligations

9. Data Retention and Deletion

Upon termination of the Agreement, Worksii shall, at the Customer’s request:

• Return all Personal Data processed on behalf of the Customer
• Or delete all such data unless retention is required by applicable law

Worksii may retain anonymized data for reporting and analytics purposes.

10. Audit Rights

The Customer has the right to audit Worksii’s compliance with this DPA. Audits must be:

• Scheduled with at least 30 days’ notice
• Conducted during normal business hours
• Subject to confidentiality obligations

Worksii will make relevant documentation and records available to demonstrate compliance.

11. Liability

Each party’s liability under this DPA is subject to the limitations set forth in the primary agreement. Nothing in this DPA shall limit either party’s liability for breaches of data protection laws.

12. Governing Law

This DPA shall be governed by the laws of the United Kingdom. Disputes arising from this DPA shall be subject to the exclusive jurisdiction of the courts of London, UK.

13. Contact

By using Worksii’s services, the Customer agrees to this Data Processing Addendum.