Data Processing Addendum

Status and execution

This page is a reference template and does not become binding merely by visiting the site. It applies only when incorporated into an executed order form or agreement identifying the customer. In that event, the customer is “Controller” and Pro Boost Local LLC is “Processor,” except where each acts as an independent controller.

Processing details

Subject: provision, security, support, and improvement of StaffRooster. Duration: the service term plus deletion and backup rotation. People: customer users, prospects, customers, employees, and contacts submitted by Controller. Data: contact, account, communications, workflow, business, device, and usage data. Special-category data is excluded unless expressly approved in writing.

Processor obligations

• Process personal data only on documented instructions, including authorized product configuration, unless law requires otherwise.
• Ensure authorized personnel are bound to confidentiality and apply appropriate technical and organizational safeguards.
• Assist reasonably with individual-rights requests, security, breach notification, impact assessments, and regulator consultations, considering the nature of processing.
• Notify Controller without undue delay after confirming a personal-data breach involving Controller data and provide available information for required notices.
• At termination, delete or return data on request, subject to legal retention and secure backup rotation.
• Provide information reasonably necessary to demonstrate compliance and support an audit no more than annually, first through documentation and subject to confidentiality, security, and cost controls.

Subprocessors

Controller grants general authorization for the subprocessors listed in the Subprocessor Notice. We will impose materially equivalent data-protection duties and provide reasonable advance notice of a new subprocessor when the executed agreement supplies a notification channel. A good-faith objection must concern data protection; the parties will seek a reasonable alternative.

International transfers

If an EEA transfer requires safeguards, the then-current EU Standard Contractual Clauses may be incorporated by a signed instrument with the appropriate module and annexes. UK transfers may use the applicable UK Addendum. The parties will complete required transfer details and supplementary measures. This web page alone does not execute SCCs, an Addendum, or appoint an EU/UK representative.

Controller duties

Controller must provide lawful instructions, notices, and rights mechanisms; minimize and secure data; configure retention and human review; assess high-risk processing; and ensure its use complies with law. Controller will not submit excluded regulated data without written authorization.

Conflict

The executed service agreement controls commercial matters. This DPA controls conflicting terms about processing Controller personal data. Mandatory law prevails.