This Data Processing Agreement (“DPA”) forms part of the Terms of Service (the “Agreement”) between Atwork Solutions (“Atwork”, “Processor”) and the customer that uses the Service (the “Customer”, “Controller”). It governs the processing of personal data that Atwork carries out on the Customer’s behalf, and reflects the requirements of Article 28 of the EU General Data Protection Regulation (“GDPR”) and equivalent laws. If there is a conflict between this DPA and the Agreement on data-protection matters, this DPA prevails.
“Controller”, “Processor”, “Data Subject”, “Personal Data”, “Processing”, “Personal Data Breach” and “Supervisory Authority” have the meanings given in the GDPR. “Sub-processor” means any processor engaged by Atwork to process Personal Data. “Customer Personal Data” means Personal Data within Customer Content that Atwork processes on the Customer’s behalf.
For Customer Personal Data, the Customer is the Controller and Atwork is the Processor. The Customer is responsible for the lawfulness of the Personal Data it provides and for having a legal basis to process it. Atwork processes Customer Personal Data only as a Processor on the Customer’s behalf.
Atwork will process Customer Personal Data only (a) to provide, secure and support the Service in accordance with the Agreement, (b) on the Customer’s documented instructions (including through configuration and use of the Service), and (c) as required by law, in which case Atwork will inform the Customer unless legally prohibited. Atwork will notify the Customer if, in its opinion, an instruction infringes applicable data-protection law.
The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of Data Subjects are described in Appendix A.
Atwork ensures that persons authorized to process Customer Personal Data are bound by appropriate obligations of confidentiality and process the data only as instructed.
Atwork implements and maintains appropriate technical and organizational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, taking into account the state of the art, the costs of implementation and the risks involved (Article 32 GDPR). A summary of these measures is set out in Appendix B.
The Customer provides a general authorization for Atwork to engage Sub-processors to process Customer Personal Data, provided that Atwork (a) imposes data-protection obligations on each Sub-processor that are no less protective than those in this DPA, and (b) remains responsible for each Sub-processor’s performance. Atwork will maintain a current list of Sub-processors (published at atwork.so/subprocessors — see Appendix C) and will give the Customer reasonable notice of any intended addition or replacement so that the Customer can object on reasonable data-protection grounds.
Taking into account the nature of the processing, Atwork will assist the Customer with appropriate technical and organizational measures, insofar as possible, to (a) respond to requests from Data Subjects exercising their rights, and (b) meet its obligations regarding security, breach notification, data-protection impact assessments and prior consultation with a Supervisory Authority.
Atwork will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and will provide information reasonably available to it to help the Customer meet its own notification obligations.
Where Atwork transfers Customer Personal Data outside the European Economic Area, it will do so only subject to appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or an adequacy decision, which are incorporated into this DPA by reference where they apply.
Atwork will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, on reasonable prior notice, during business hours, subject to confidentiality and without unreasonably disrupting Atwork’s operations. Atwork may satisfy audit requests by providing relevant certifications or reports where available.
On termination of the Service and at the Customer’s choice, Atwork will delete or return Customer Personal Data, and delete existing copies, unless retention is required by law. A limited export window applies as described in the Agreement.
Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Agreement. This DPA takes effect on the effective date above and continues for as long as Atwork processes Customer Personal Data under the Agreement.
Atwork uses a limited set of vetted Sub-processors (for example cloud hosting and storage, email delivery, payment processing, analytics and AI providers). A current list is published at atwork.so/subprocessors, and questions can be sent to [email protected].
For most customers, this DPA applies automatically as part of the Agreement. If your organization requires a countersigned copy or has specific data-protection requirements, contact us at [email protected]. Atwork is established in the Netherlands at Atwork Solutions, 19A, 2511 AT, The Netherlands.