Data Processing Agreement
This Data Processing Agreement explains the data-processing terms that apply when Worklix processes personal data on behalf of a customer in connection with the Worklix service.
This page should be read together with the Worklix Terms of Service and Privacy Policy. If a signed customer agreement contains different data-processing terms, the signed agreement controls to the extent of that conflict.
1. Scope and processing roles
Where a customer determines the purposes and means of processing personal data submitted to Worklix, the customer acts as the controller or business responsible for that data and Worklix acts as the processor or service provider for the processing performed on the customer’s behalf.
The categories of personal data and data subjects depend on the features the customer enables and the workforce information the customer chooses to process through Worklix.
2. Processing on documented instructions
Worklix processes customer personal data to provide, secure, maintain, support, and improve the contracted service, and otherwise only on the customer’s documented instructions unless applicable law requires different processing.
Customers are responsible for ensuring their instructions, configuration choices, and use of Worklix comply with the laws and workplace obligations that apply to them.
3. Confidentiality and authorized personnel
Access to customer personal data is limited to personnel and service providers who need that access for legitimate service, security, support, or operational purposes.
People authorized to process customer personal data are expected to handle it under appropriate confidentiality obligations and follow Worklix security requirements.
4. Security measures
Worklix uses technical and organizational measures designed to protect customer personal data against unauthorized access, disclosure, alteration, loss, or destruction. Measures are selected in light of the nature of the service, the information processed, and the risks presented by the processing.
Customers also remain responsible for account security on their side, including user access, role assignment, device security, credentials, and the data they choose to place in the service.
5. Subprocessors
Worklix may use subprocessors to support hosting, infrastructure, communications, security, support, analytics, and other service functions. Any subprocessor that processes customer personal data on Worklix’s behalf is expected to be subject to data-protection obligations appropriate to the services it performs.
Worklix remains responsible for managing its subprocessors in accordance with the commitments that apply to the customer relationship.
6. Data subject requests and customer assistance
Where required by applicable law and taking into account the nature of the processing, Worklix will provide reasonable assistance so customers can respond to requests concerning access, correction, deletion, restriction, portability, or other rights relating to customer personal data.
If Worklix receives a request directly from a person whose data is controlled by a customer, Worklix may direct that person to the relevant customer unless the law requires Worklix to respond differently.
7. Personal data incidents
If Worklix becomes aware of a confirmed security incident involving customer personal data that requires customer notification under applicable data-protection law, Worklix will notify the affected customer without undue delay and provide information reasonably available to support the customer’s response.
Notification does not by itself constitute an admission of fault or liability.
8. International data transfers
Where customer personal data is transferred across borders, Worklix will use a lawful transfer mechanism where one is required. The exact mechanism may depend on the customer location, the destination of the transfer, and the applicable data-protection framework.
9. Compliance and audit information
Worklix will make information reasonably necessary to demonstrate compliance with applicable processor obligations available to customers where required by law or by the customer agreement.
Any audit or assessment request should be proportionate, protect the security and confidentiality of other customers, and avoid unnecessary disruption to the service.
10. Return and deletion of customer data
At the end of the applicable customer relationship, Worklix will handle customer personal data in accordance with the customer agreement, applicable retention requirements, and the technical capabilities of the service.
Where required, customer data will be returned or deleted after the service relationship ends unless applicable law requires continued retention for a defined period.
11. DPA questions and customer requests
Customers that need to review data-processing terms, security information, subprocessors, or a customer-specific DPA request can contact the Worklix team.
Contact Worklix