Data Processing Addendum

This Data Processing Addendum applies when comPayr processes personal data on behalf of a business customer in connection with the Service.

If there is a conflict between this DPA and the main Terms and Conditions with respect to personal-data processing, this DPA controls to the extent of that conflict.

For workforce and other customer-directed personal data processed through the Service, the customer acts as controller, business, or equivalent decision-maker, and comPayr acts as processor, service provider, or contractor.

The customer is responsible for determining the lawful basis, scope, and purpose of the processing it instructs comPayr to perform.

The subject matter of the processing is the operation of the payroll calculation software Service, including payroll calculation, payroll records, user account management, support, reporting, document generation, tax-form preparation, and related optional workforce features.

Processing continues for the duration of the customer’s use of the Service and for any limited retention period required by law, security, backup, audit, dispute, or operational necessity.

• categories of data subjects may include customer administrators, employees, contractors, and other authorized workforce users
• categories of personal data may include identifiers, contact data, employment and payroll data, tax data, compensation data, leave data, optional benefits/deductions data, customer-submitted account-reference data, and generated documents or artifacts

comPayr will process personal data only on documented customer instructions, including instructions communicated through product configuration, submitted payroll inputs, support requests, and written directions, unless otherwise required by law.

If comPayr believes an instruction violates law, comPayr may suspend the instruction and notify the customer where legally permitted.

comPayr will require personnel with access to personal data to be subject to appropriate confidentiality obligations.

comPayr will maintain reasonable administrative, technical, and organizational security measures designed to protect personal data against unauthorized access, use, loss, alteration, or disclosure.

The customer acknowledges that no security measure is infallible and that security measures may evolve over time.

The customer authorizes comPayr to use subprocessors that are reasonably necessary to provide and support the Service, including providers in categories such as cloud hosting, authentication, analytics, communications, error monitoring, and address support.

comPayr will remain responsible for the performance of its subprocessors to the extent required by law and contract. Category-level information is published on the Subprocessors page and may change from time to time.

Taking into account the nature of the processing and information available to comPayr, comPayr will provide reasonable assistance to the customer in responding to applicable requests from data subjects and in meeting legal obligations related to the processed personal data.

Such assistance may be subject to reasonable technical and commercial limitations.

If comPayr becomes aware of a confirmed security incident affecting personal data processed under this DPA, comPayr will notify the customer without undue delay after confirmation and provide available information reasonably necessary for the customer to understand the incident and meet its own obligations.

comPayr may provide information in phases as additional details become available, and the customer remains responsible for legal assessments, notices, and regulatory decisions unless otherwise agreed in writing.

Upon termination of the applicable Services and subject to the limited export window described in the main Terms, comPayr will provide the customer a reasonable opportunity to retrieve customer data from the Service.

After that period, comPayr may delete or render inaccessible personal data, except to the extent retention is required or reasonably necessary for legal, tax, payroll, backup, audit, security, dispute, or operational reasons.

Upon reasonable written request, comPayr will make available information reasonably necessary to demonstrate compliance with this DPA, subject to confidentiality, security, privilege, and burden limitations.

The Service is intended to be U.S.-hosted and U.S.-processed for the first-launch environment described in this public legal set.

This DPA forms part of the Terms and Conditions and will apply automatically where comPayr processes personal data on behalf of a customer in the processor/service-provider role.

If the parties later sign a negotiated DPA, the negotiated DPA may supersede this public version to the extent expressly stated in that signed document.