Data Processing Addendum

1. Purpose and scope

This DPA applies where HoneyBee processes Personal Data on behalf of Customer in connection with the Services.

This DPA sets out the Parties' rights and obligations with respect to such processing and is intended to satisfy the contractual requirements that apply when a controller appoints a processor under applicable data protection law.

If and to the extent HoneyBee processes Personal Data as a controller in its own right, this DPA does not apply to that processing.

2. Definitions

In this DPA:

• "Applicable Data Protection Law" means the GDPR, UK GDPR, Swiss data protection law, and any other applicable law governing the processing of Personal Data under the Agreement.
• "Controller" means the entity that determines the purposes and means of the processing of Personal Data.
• "Processor" means the entity that processes Personal Data on behalf of the Controller.
• "Data Subject" means an identified or identifiable natural person to whom Personal Data relates.
• "Personal Data" means any information relating to an identified or identifiable natural person processed by HoneyBee on behalf of Customer under the Agreement.
• "Processing" or "process" means any operation or set of operations performed on Personal Data, whether or not by automated means.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data processed by HoneyBee on behalf of Customer.
• "Subprocessor" means any third party engaged by HoneyBee to process Personal Data on behalf of Customer.
• "SCCs" means the Standard Contractual Clauses approved by the European Commission or other competent authority, as applicable.

Capitalised terms not defined here have the meaning given in the Agreement.

3. Roles of the Parties

3.1 Customer acts as Controller of the Personal Data processed under this DPA, except where Customer itself acts as a processor on behalf of another controller, in which case HoneyBee will act as Customer's subprocessor.

3.2 HoneyBee acts as Processor and will process Personal Data only on behalf of Customer and in accordance with this DPA, the Agreement, and Customer's documented instructions, unless required to do otherwise by applicable law.

3.3 The subject matter, duration, nature, purpose, categories of Personal Data, and categories of Data Subjects are described in Annex 1 to this DPA.

4. Customer instructions

4.1 HoneyBee will process Personal Data only on documented instructions from Customer, including with regard to transfers of Personal Data to a third country or international organisation, unless required to do otherwise by applicable law.

4.2 The Agreement, this DPA, Customer's use and configuration of the Services, and any written implementation or support instructions issued by Customer constitute Customer's documented instructions.

4.3 If HoneyBee believes an instruction infringes Applicable Data Protection Law, HoneyBee will inform Customer without undue delay, unless prohibited from doing so by law.

4.4 Customer is responsible for ensuring that its instructions comply with Applicable Data Protection Law.

5. Confidentiality

5.1 HoneyBee will ensure that all persons authorised to process Personal Data are subject to an appropriate duty of confidentiality, whether contractual or statutory.

5.2 HoneyBee will ensure that access to Personal Data is limited to personnel who need such access to perform the Services or comply with legal obligations.

6. Security of processing

6.1 HoneyBee will implement and maintain appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

6.2 Those measures will take into account: the nature, scope, context, and purposes of the processing; the risks to the rights and freedoms of natural persons; the state of the art; and the costs of implementation.

6.3 HoneyBee's baseline technical and organisational measures are described in Annex 2.

6.4 HoneyBee may update or modify the measures in Annex 2 from time to time, provided that the overall level of security is not materially reduced.

7. Subprocessors

7.1 Customer grants HoneyBee general written authorisation to engage Subprocessors for the processing of Personal Data, provided that HoneyBee complies with this Section.

7.2 HoneyBee will impose data protection obligations on each Subprocessor by written contract that are no less protective than those set out in this DPA, to the extent applicable to the nature of the services provided by that Subprocessor.

7.3 HoneyBee remains responsible for the performance of each Subprocessor's data protection obligations to the extent required by Applicable Data Protection Law and the Agreement.

7.4 HoneyBee will make available a current Subprocessor list or a mechanism by which Customer can obtain information about current Subprocessors.

7.5 Where commercially appropriate, HoneyBee will provide notice of material changes to Subprocessors and give Customer a reasonable opportunity to raise a substantiated objection on data protection grounds.

7.6 If Customer raises a reasonable objection that cannot be resolved, HoneyBee may, at its option:

• recommend a commercially reasonable alternative;
• stop using the relevant Subprocessor for Customer; or
• permit Customer to terminate the affected Services in accordance with the Agreement.

8. Assistance with Data Subject rights

8.1 Taking into account the nature of the processing, HoneyBee will provide Customer with reasonable assistance through appropriate technical and organisational measures to enable Customer to respond to requests by Data Subjects to exercise their rights under Applicable Data Protection Law.

8.2 If HoneyBee receives a request directly from a Data Subject relating to Personal Data processed on behalf of Customer, HoneyBee will:

• not respond directly except as required by law or as authorised by Customer;
• promptly inform Customer, where legally permitted;
• provide reasonable cooperation so Customer can respond.

9. Assistance with Customer compliance obligations

9.1 Taking into account the nature of the processing and the information available to HoneyBee, HoneyBee will provide reasonable assistance to Customer in relation to:

• security of processing;
• personal data breach notification obligations;
• data protection impact assessments;
• prior consultation with supervisory authorities;
• records and information reasonably needed to demonstrate compliance.

9.2 HoneyBee will provide this assistance to the extent required by Applicable Data Protection Law and proportionate to HoneyBee's role as Processor.

10. Security Incidents

10.1 HoneyBee will notify Customer without undue delay after becoming aware of a Security Incident affecting Personal Data processed on behalf of Customer.

10.2 To the extent known and reasonably available, HoneyBee's notification will include:

• a description of the nature of the Security Incident;
• the categories and approximate number of affected Data Subjects, where known;
• the categories and approximate number of affected records, where known;
• the likely consequences of the Security Incident, where known;
• measures taken or proposed to address the Security Incident.

10.3 HoneyBee will take commercially reasonable steps to investigate, contain, mitigate, and remediate the Security Incident.

10.4 HoneyBee's notification under this Section does not constitute an admission of fault or liability.

11. Return and deletion of Personal Data

11.1 Upon termination or expiry of the Agreement, and at Customer's choice, HoneyBee will:

• return Personal Data to Customer; or
• delete Personal Data,

unless Applicable Data Protection Law requires continued retention.

11.2 Where the Services provide self-service export functionality, Customer may use those tools to retrieve Personal Data during the applicable export window.

11.3 HoneyBee may retain limited records where required by law, for legitimate security, fraud-prevention, tax, audit, backup, dispute-resolution, or legal-hold purposes, provided that such retained data remains protected in accordance with this DPA.

11.4 If Customer does not make an election, HoneyBee may delete Personal Data after expiry of any applicable retention or export period stated in the Agreement or support documentation.

12. Information, audits, and inspections

12.1 HoneyBee will make available to Customer information reasonably necessary to demonstrate compliance with this DPA.

12.2 Where such information is insufficient for Customer's legal obligations, HoneyBee will allow and contribute to reasonable audits or inspections by Customer or an independent auditor mandated by Customer, subject to the following conditions:

• reasonable prior written notice;
• no more than once annually unless required by law or triggered by a Security Incident or substantiated compliance concern;
• audits must be limited in scope to the processing of Personal Data under the Agreement;
• audits must not unreasonably interfere with HoneyBee's business operations, security, or confidentiality obligations to other customers;
• Customer and any auditor must protect HoneyBee's confidential information;
• HoneyBee may satisfy audit obligations through provision of current third-party audit reports, certifications, summaries, or comparable documentation where appropriate.

12.3 Customer will bear its own audit costs, unless the audit reveals a material breach of this DPA by HoneyBee.

13. International transfers

13.1 Where HoneyBee processes Personal Data in a country outside the EEA, the UK, or Switzerland, and Applicable Data Protection Law requires a transfer mechanism, the Parties will implement an appropriate lawful transfer mechanism.

13.2 Where applicable, that mechanism may include:

• the European Commission's Standard Contractual Clauses;
• the UK International Data Transfer Addendum or UK-approved SCC version;
• Swiss transfer addendum language;
• adequacy decisions where available;
• any other lawful transfer mechanism recognised under Applicable Data Protection Law.

13.3 If the SCCs are required, they are incorporated by reference into this DPA or may be executed as a separate annex. Where the relevant SCC module already includes the Article 28 requirements, the Parties may rely on that SCC module rather than duplicating equivalent provisions.

13.4 The Parties will complete any required annexes, appendices, or transfer details using the information in Annex 1 and Annex 2 of this DPA, as supplemented where necessary.

14. Records and cooperation

14.1 HoneyBee will maintain records of processing activities where required by Applicable Data Protection Law.

14.2 HoneyBee will cooperate reasonably with supervisory authorities or equivalent regulators to the extent required by law in relation to processing under this DPA.

14.3 HoneyBee will promptly inform Customer if, in its opinion, an instruction from Customer violates Applicable Data Protection Law.

15. Liability

15.1 This DPA is subject to the liability limitations, exclusions, and allocation of risk set out in the Agreement, unless Applicable Data Protection Law requires otherwise.

15.2 Nothing in this DPA excludes or limits either Party's liability to the extent such exclusion or limitation is prohibited by law.

16. Order of precedence

If there is any conflict between this DPA and the Agreement with respect to the processing of Personal Data, this DPA will prevail to the extent of that conflict.

If the Parties execute SCCs or another transfer mechanism that conflicts with this DPA, the SCCs or that transfer mechanism will prevail to the extent legally required for the relevant transfer.

17. Governing law and jurisdiction

This DPA will be governed by the governing law and jurisdiction provisions of the Agreement, unless the SCCs or another mandatory transfer mechanism require otherwise for a specific claim or interpretation issue.

Details of processing

A. Subject matter of the processing

Provision of the HoneyBee platform and related services, including hosting, storage, workflow execution, support, implementation, migration, integration, mobile functionality, analytics, AI-assisted features where enabled, and related operational services.

B. Duration of the processing

For the duration of the Agreement and any agreed post-termination retention, export, backup, or legal-hold period.

C. Nature of the processing

Collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, alignment, combination, restriction, deletion, or destruction of Personal Data as necessary to provide the Services.

D. Purpose(s) of the processing

To provide the Services to Customer, including account administration, hosting, workflow management, project and finance processing, support, implementation, security, backups, exports, and any agreed integrations or private deployments.

E. Categories of Data Subjects

May include, depending on Customer's use of the Services:

• Customer personnel and users;
• employees, applicants, contractors, and consultants;
• clients, customers, and prospects;
• suppliers and vendors;
• site visitors or authorised third parties included in Customer records;
• any other individuals whose Personal Data Customer uploads or generates in the Services.

F. Categories of Personal Data

May include, depending on Customer's use of the Services:

• identification and contact data;
• user account and profile data;
• HR, attendance, and workforce data;
• payroll-supporting or finance-related records;
• project records and approval records;
• operational and service data;
• communications and support records;
• uploaded files, attachments, receipts, and documents;
• technical, log, and usage data;
• AI prompts and outputs where enabled and submitted by Customer users.

G. Special categories of Personal Data

The Services are not intended by default for special category or highly sensitive Personal Data unless expressly agreed by the Parties and supported by appropriate controls. If Customer chooses to upload such data, Customer is responsible for ensuring a lawful basis and giving documented instructions.

H. Frequency of the processing

Continuous or as initiated by Customer users, systems, integrations, or support interactions during the term of the Agreement.

I. Location(s) of processing

As stated in the Agreement, implementation documents, infrastructure documentation, Subprocessor documentation, or transfer documentation applicable to the relevant Service deployment.

Technical and organisational measures

HoneyBee will maintain technical and organisational measures appropriate to the risk, which may include:

A. Organisational measures

• internal access-control policies;
• role-based access to customer environments;
• confidentiality obligations for staff and contractors;
• onboarding and offboarding controls for personnel;
• incident response procedures;
• vendor and Subprocessor due diligence;
• change-management and release-management processes;
• documented security responsibilities.

B. Access controls

• authentication mechanisms and credential controls;
• optional or available MFA where supported;
• least-privilege access principles;
• restricted administrative access;
• logging of privileged or sensitive actions where appropriate.

C. Network and infrastructure security

• network segmentation or equivalent controls where appropriate;
• firewalling and perimeter protections;
• monitoring for suspicious activity;
• secure remote administration practices;
• patching and vulnerability-management processes.

D. Data protections

• encryption in transit using current industry-standard protocols where supported;
• encryption at rest where appropriate to the deployment model;
• logical isolation of customer environments where relevant;
• backup and recovery procedures;
• controls around export and deletion.

E. Availability and resilience

• backup routines;
• disaster recovery or service restoration measures;
• monitoring of service availability and core infrastructure health;
• continuity planning appropriate to the service tier.

F. Application and development security

• change control for production systems;
• issue tracking and remediation processes;
• testing before major releases where appropriate;
• access restrictions for development and support personnel.

G. Incident management

• procedures to detect, assess, escalate, contain, and remediate Security Incidents;
• communication workflows for incident notification;
• post-incident review processes where appropriate.

H. Physical security

Where HoneyBee relies on third-party data centres or infrastructure providers, physical security controls are managed by those providers under their own certified or documented controls, as applicable.

HoneyBee may update these measures over time so long as the overall level of protection is not materially reduced.

Optional SCC implementation notes

Use this annex only where the Parties need Standard Contractual Clauses for a restricted transfer. If required, complete a separate SCC attachment with:

• exporter and importer names and contact details;
• relevant SCC module:
  • Module 2 for controller-to-processor;
  • Module 3 for processor-to-processor;
• competent supervisory authority where required;
• description of transfer;
• technical and organisational measures (cross-reference Annex 2);
• list of subprocessors;
• supplementary measures if applicable.

The modernised 2021 SCCs (Modules 2 and 3) can also cover the Article 28 processor-contract requirements. Where the relevant SCC module already includes those requirements, the Parties may rely on that SCC module rather than duplicating equivalent provisions in this DPA.