Data Processing Addendum

2. Roles of the parties

The Client is the controller of the personal data it provides or makes accessible to Workoid. Workoid acts as processor and processes that personal data only on the Client's documented instructions, including as set out in the Agreement.

3. Scope and duration

Workoid processes personal data for the duration of the Agreement and only to provide the services. The subject matter, nature, and purpose of the processing, the types of personal data, and the categories of data subjects are described in Annex A.

4. Workoid's obligations

Workoid will:

• Process personal data only on the Client's documented instructions.
• Ensure that people authorized to process personal data are bound by confidentiality.
• Implement the technical and organizational security measures described in Annex B.
• Assist the Client, where reasonable, with data-subject requests and with the Client's own compliance obligations.
• Make available information reasonably necessary to demonstrate compliance with this DPA.

5. Subprocessors

The Client authorizes Workoid to engage subprocessors to help deliver the services. A current list of subprocessors is available at [P: subprocessor list location]. Workoid will inform the Client of any intended change to its subprocessors and give the Client a reasonable opportunity to object. Workoid remains responsible for its subprocessors' compliance with this DPA.

6. International transfers

Workoid operates as a distributed business, and personal data may be processed in Hong Kong, the European Union, and the countries where its talent and subprocessors are located. Where personal data is transferred across borders, Workoid puts appropriate safeguards in place, including [P: transfer mechanism, e.g. Standard Contractual Clauses].

7. Security

Workoid maintains the technical and organizational measures set out in Annex B, which reflect the security controls described on the Workoid Security page, including encrypted company devices, restricted administrator access, cloud-only storage, enterprise password management, and two-factor authentication.

8. Personal data breach

Workoid will notify the Client without undue delay, and in any event within [P: breach-notification timeframe], after becoming aware of a personal data breach affecting the Client's personal data, and will provide reasonable information to help the Client meet its own notification obligations.

9. Return and deletion

On termination of the Agreement, Workoid will delete or return the Client's personal data, at the Client's choice, except where retention is required by law.

10. Audit

Workoid will, on reasonable request and notice, make available information necessary to demonstrate compliance with this DPA, and allow for audits in line with the terms of the Agreement.

11. Governing law

This DPA is governed by the law of the Agreement, being the laws of Hong Kong.

Annex A: Details of processing

The finalized text for this section will be supplied by our content team following legal review.

• Subject matter: provision of managed remote teams and related services.
• Nature and purpose: [P: confirm and tailor per engagement].
• Types of personal data: [P: e.g. contact details, and any data the Client's team handles to perform the services].
• Categories of data subjects: [P: e.g. the Client's customers, staff, and contacts].
• Duration: for the term of the Agreement.

Annex B: Security measures

The finalized text for this section will be supplied by our content team following legal review.

• Encrypted company-provided devices.
• Restricted administrator access on company devices.
• Cloud-only storage, no local storage of Client data.
• Secured internal network.
• Enterprise password management (LastPass Enterprise).
• Two-factor authentication.
• Confidentiality obligations on all personnel.
• [P: add any further measures confirmed with legal.]