Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") forms part of the master subscription agreement between Labb Holding Ltd, a Cyprus private company limited by shares with its registered office at Anthipolochagou Georgiou M.Savva 26, Shop 1-2, 8201 Paphos, Cyprus, registered under HE 424230 (operating the PersoHR platform, the "Processor"), and the customer (the "Controller"). It governs the processing of personal data that the Processor carries out on behalf of the Controller in connection with the PersoHR platform and is designed to comply with Regulation (EU) 2016/679 (the "GDPR"). Where any provision of this DPA conflicts with the master agreement, this DPA prevails for matters of personal data processing. Capitalised terms used but not defined here have the meaning given to them in the master agreement or, where applicable, in the GDPR.

2. Subject matter, duration, nature and purpose

The Processor processes personal data for the sole purpose of providing the PersoHR HR-management service. The processing covers the management of employee records, leave and absence, onboarding, offboarding, time tracking, payroll preparation, performance reviews, recruitment, document storage, internal communication and other HR workflows configured by the Controller. Processing includes collection, recording, organisation, storage, retrieval, use, authorised disclosure, export and deletion for these services. This DPA continues to protect customer personal data while it is retained, including during an agreed return or deletion procedure under section 13. Processing for PersoHR's own purposes, as described in the Privacy Policy, is separate from this processor engagement. The Controller acknowledges that the precise scope and depth of processing depend on the modules and configuration the Controller chooses to enable.

3. Categories of personal data

The categories of personal data processed depend on the Controller's configuration of the platform and may include: personnel master data (name, contact details, postal address, date of birth, photograph, emergency-contact details); employment master data (job title, department, employment type, start and end dates, working hours, manager, disability status); document content (employment contracts, certifications, identity documents, other files uploaded by the Controller); performance and development data (objectives, reviews, feedback, training records); leave and absence data (requests, balances, public holidays); time-tracking data (clock-in / clock-out events, timesheets, overtime); payroll-preparation data (salary records, IBAN where supplied, tax and social-security identifiers where supplied, nationality, gender, marital status, number of children, place of birth, health-insurance provider and type, church-tax denomination); recruitment data (applications, CVs, interview notes, references); communication and chat data; authentication and security data (login timestamps, IP addresses, browser/device user-agent information and device-session records, two-factor state); and any other personal data the Controller chooses to upload or generate within the platform. The processing can also include electronic-signature content and signing evidence. Church-tax denomination can reveal religion. Disability status, sickness absence and medical-certificate records can reveal health data even without uploaded medical documents. Where special-category data is processed, the Controller must establish an Article 6 basis and an applicable Article 9 condition and instruct the Processor on necessary safeguards. Criminal-conviction data requires the conditions in Article 10 and must not be supplied without an agreed lawful and supported processing arrangement. The Processor remains responsible for its own applicable data-protection and security obligations.

4. Categories of data subjects

Categories of data subjects, in respect of the Controller and any affiliates the Controller chooses to administer through the platform, typically include: current employees, contractors, freelancers and other personnel, including workers below 18 where lawfully employed; former employees, contractors and personnel; applicants and candidates in active or past recruitment processes; and dependants or emergency contacts disclosed by any of the foregoing. The Controller is responsible for the lawfulness of including any specific data subject within the scope of processing.

5. Instructions and right to refuse

The Processor will process personal data only on the documented instructions of the Controller — including with regard to international transfers — unless required to do otherwise by Union or Member State law (in which case the Processor will inform the Controller before processing, except where that law prohibits such notice on grounds of important public interest). The Controller designates the persons exclusively authorised to issue processing instructions through the platform; in the absence of such designation, only natural persons authorised to legally represent the Controller may issue instructions. If the Processor reasonably believes that an instruction infringes the GDPR or other applicable data-protection law, it will immediately inform the Controller and may suspend execution of that instruction until the matter has been resolved between the parties.

6. Confidentiality

The Processor ensures that any natural person authorised to process personal data on its behalf is bound by an obligation of confidentiality, whether by contract or by statutory duty. Each party further agrees to keep confidential any non-public information it receives from the other party in connection with this DPA, including the contents of audits, security documentation and incident reports, and to use such information solely for the performance of the master agreement and this DPA. Information that is publicly known, was independently developed without use of the disclosing party's confidential information, was lawfully received from a third party without confidentiality obligation, or is required to be disclosed by binding legal process is excluded. General confidentiality obligations survive termination for five years. Obligations protecting personal data continue for as long as that data is retained, including where a longer statutory duty applies.

7. Security of processing (Article 32)

The Processor implements and maintains technical and organisational measures appropriate to the risk, taking account of the factors in Article 32 GDPR. Application safeguards include role-based and tenant-scoped access controls, time-limited authentication tokens, mandatory two-factor authentication for Owner and HR Admin roles, encryption of selected sensitive fields, and audit records for supported actions. The security annex at /legal/security describes these safeguards. The Processor's obligations to provide appropriate protection, availability and recovery are not limited to the features listed here. Updates to the measures must not materially reduce the overall level of security.

8. Sub-processors

The Controller authorises the Processor to engage the sub-processors listed at /legal/sub-processors. The Processor will inform the Controller in writing (including email) at least 30 days before adding or replacing a sub-processor. The Controller may object on reasonable data-protection grounds within 14 days of that notification; absent a timely objection, the change is deemed approved. If the parties cannot resolve a justified objection within a further 30 days, either party may terminate the master agreement on written notice without further liability, in which case the Controller is entitled to a pro-rata refund of any prepaid fees that cover the unused remainder of the subscription term. The Processor enters into written agreements with each sub-processor that impose data-protection obligations equivalent to those in this DPA, and remains responsible for the acts and omissions of its sub-processors.

9. Assistance with data subject rights

The Processor assists the Controller, taking account of the nature of processing and insofar as possible, with requests under Chapter III GDPR. The application provides data-export, correction and erasure tools with role and scope restrictions. These tools assist the Controller but do not determine whether an individual request must be granted. Article 20 portability is limited to data provided by the individual and processed automatically on consent or contract grounds; other records may fall within Article 15 access. The Processor provides reasonable additional assistance where the tools are insufficient. Requests concerning the Controller's HR processing received directly from an individual are referred to the Controller without undue delay.

Where an individual asks the Processor to delete their personal PersoHR account, the Processor closes the account at once. It ends the individual's access, deletes the account data it holds as controller (sign-in details, two-factor settings, sessions, account preferences and the support requests the individual made in the application, with their screenshots) and deletes the individual's conversations with the AI assistant, which the application shows to no one else. Copies of those support requests delivered to the Processor's support mailbox, and other correspondence with the Processor, are retained as described in the Privacy Policy. It does not erase or change any other record the Controller holds about the individual. It records the request against the individual's membership in each of the Controller's workspaces and notifies the Controller's owners and HR administrators in the application and by email without undue delay. The Controller decides whether to erase the records, using the application's erasure tool, or to keep them, and answers the individual. The Processor confirms the request to the individual by email and tells them by email once the Controller has recorded its decision in the application, or once the records have been erased because the workspace is being deleted.

The identity details on the individual's account that the Controller's records use (name, email address, date of birth and telephone number) are kept on behalf of the Controller and of any other customer whose records use them, until every workspace membership of the individual has been erased or its workspace deleted, and are then anonymised. An erased membership can leave records the Controller must keep by law, such as a working-time register kept under the individual's name, which follow their own retention period. The identity details change only on a Controller's instruction: the Controller may add a missing date of birth in the application, and any other correction is made by the Processor's support. The Processor uses them to write to the individual only for the confirmation and the decision notice described above, for notices the Controller is required by law to give, and for the final archive described below. A closed account cannot be reopened, and its email address cannot be used for a new account or invited to a workspace until every workspace membership of the individual has been erased or its workspace deleted.

Where the Controller has asked for its workspace to be deleted, a request that is open when the workspace starts closing, or that arrives while it is closing, is carried out once the workspace's final archive is complete (in the nightly run that follows completion, or follows the request where the archive was already complete), or when the workspace is deleted if that comes first, so the individual's records are part of any final archive the Controller receives. The Processor's copy of the final archive is deleted with the workspace. Where the individual is the contact the Controller left for that archive, the archive goes to another owner of the workspace who can still sign in, and to the individual's address only when there is none. Where the individual is the only owner of a workspace that is not being deleted, the request cannot be completed until the workspace has another active owner or an active HR administrator, or until the workspace is being deleted; where an active HR administrator exists, the Processor makes the longest-serving one an owner so that the Controller keeps an owner.

10. Personal data breach notification

The Processor notifies the Controller without undue delay, and in any event within 72 hours after becoming aware of a personal data breach affecting the Controller's data, in accordance with Article 33(2) GDPR. Available information includes the nature of the breach, affected categories and approximate numbers of individuals and records, likely consequences, contact details and measures taken or proposed. Information may be provided in phases without undue further delay. The Processor assists the Controller with its assessment and notification obligations under Articles 33 and 34. The Controller's qualified 72-hour supervisory-notification deadline is not a waiting period for the Processor.

11. DPIA and prior consultation

The Processor assists the Controller, on reasonable request, with data protection impact assessments under Article 35 and prior consultations with supervisory authorities under Article 36, taking into account the nature of the processing and the information available to the Processor.

12. Audits and inspections

The Processor makes available all information necessary to demonstrate compliance with Article 28 GDPR and allows and contributes to audits, including inspections, conducted by the Controller or its mandated auditor. The parties agree reasonable arrangements for notice, timing, confidentiality and protection of other customers' information. Independent reports and security documentation may help establish compliance but do not replace the Controller's statutory audit rights. Scheduling, frequency and auditor requirements must not prevent an audit required by law, a supervisory authority, a personal data breach or reasonable grounds to suspect non-compliance. Each party normally bears its own costs unless otherwise agreed or required by law.

13. Return or deletion of personal data

After the processing services end, the Processor returns or deletes personal data at the Controller's choice, and deletes existing copies unless Union or Member State law requires retention, in accordance with Article 28(3)(g) GDPR. The Controller should download required exports before paid access ends and contact support to arrange any further return or deletion. Ending subscription renewal does not itself submit an account-deletion request. The in-app account-deletion procedure schedules deletion after a 30-day cancellation window; an earlier or different legally required request should be addressed to the Processor directly. The parties must agree and carry out the return or deletion procedure without retaining data longer than necessary. Backup copies remain protected by this DPA until removed under the applicable backup schedule; any restoration must respect prior deletion instructions. Billing records processed for the Processor's own legal obligations are handled separately under the Privacy Policy.

14. International transfers

The Processor primarily processes personal data within the European Union. Where the Processor or any sub-processor needs to transfer personal data to a country outside the European Economic Area, the transfer is made only on the basis of an adequacy decision under Article 45 GDPR or appropriate safeguards under Article 46 GDPR — typically the European Commission's Standard Contractual Clauses (Decision 2021/914/EU) supplemented, where required, by additional technical and organisational measures. The current list of recipients and applicable transfer mechanisms is published at /legal/sub-processors.

15. Insolvency, seizure and third-party events

If the Controller's personal data is at risk because of seizure, confiscation, insolvency or composition proceedings, or any other action by a third party that could affect the Processor's ability to comply with this DPA, the Processor will inform the Controller without undue delay and inform the third party in writing that the data is the responsibility of the Controller as data controller within the meaning of the GDPR. The Processor will take reasonable steps to protect the integrity and availability of the Controller's data pending resolution of the third-party action.

16. Liability

Each party is liable for damage caused by its own breach of this DPA in accordance with Article 82 GDPR and applicable law. Nothing in this DPA excludes or limits any liability that cannot be excluded or limited by law, including for death or personal injury, fraud, fraudulent misrepresentation or wilful misconduct. Nothing in this DPA restricts the rights of data subjects or supervisory authorities. In all other respects, the limitations and exclusions of liability set out in the master agreement apply equally to this DPA.

17. Severability and final provisions

Amendments and supplements to this DPA must be recorded in writing, including electronically, and explicitly identify the provisions being amended. Article 28(9) GDPR permits the agreement to be in electronic form; it does not by itself establish acceptance of an amendment. If any provision of this DPA is or becomes invalid, illegal or unenforceable, the validity of the remaining provisions is not affected; the parties will replace the invalid provision with a valid one whose economic effect comes as close as possible to that of the invalid provision. This DPA may be executed and updated electronically and supersedes any prior data-processing arrangements between the parties for the same subject matter.

18. Governing law and jurisdiction

This DPA is governed by the laws of the Republic of Cyprus, excluding its conflict-of-laws rules and the United Nations Convention on Contracts for the International Sale of Goods. The courts of Paphos, Cyprus have exclusive jurisdiction over any dispute arising out of or in connection with this DPA, without prejudice to any mandatory consumer-protection or data-subject venue rights under the GDPR.

19. Contact

For matters relating to this DPA, contact Labb Holding Ltd at privacy@persohr.eu, or write to Labb Holding Ltd, Anthipolochagou Georgiou M.Savva 26, Shop 1-2, 8201 Paphos, Cyprus. The Controller's contact point for data protection is the user account designated as OWNER in the PersoHR platform.