Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the StaffPortal Terms of Service and any other agreement governing a customer's use of StaffPortal.

This DPA applies whenever Underline LLC, doing business through StaffPortal ("StaffPortal," "we," "us," or "Processor"), processes Personal Data on behalf of a customer ("Customer" or "Controller") in connection with the StaffPortal service.

For purposes of this DPA:

• Customer means the organization that owns or controls a StaffPortal workspace.
• Customer Data means information submitted to, stored within, transmitted through, or otherwise processed through a Customer's StaffPortal workspace.
• Personal Data means any information relating to an identified or identifiable person and includes equivalent terms such as "personal information" where applicable law uses different terminology.
• Applicable Data Protection Law means privacy and data-protection laws applicable to the processing covered by this DPA.

1. Roles of the Parties

The Customer generally acts as the controller of Personal Data processed through its StaffPortal workspace because the Customer determines what Personal Data is collected, why it is processed, and how StaffPortal is used within its organization.

Underline LLC

1703 N Park Ave

Grand Island, Nebraska 68803

United States

acts as the processor when processing Personal Data on behalf of the Customer to provide StaffPortal.

Where applicable privacy law uses terms such as "business," "service provider," or "contractor" instead of controller and processor, the parties intend their respective roles to be interpreted consistently with those equivalent classifications.

Each party is responsible for complying with the obligations applicable to it under Applicable Data Protection Law.

2. Processing Details

Subject Matter

StaffPortal processes Personal Data as necessary to provide, secure, maintain, support, and operate the StaffPortal platform.

Duration

Processing continues for the duration of the Customer's subscription or other contractual relationship with StaffPortal, plus any applicable export, retention, backup, or deletion period described in this DPA.

Nature and Purpose

Processing may include:

• Collection
• Organization
• Storage
• Retrieval
• Consultation
• Transmission
• Display
• Modification
• Restriction
• Export
• Deletion
• Other processing necessary to provide the StaffPortal service

The purpose of processing is to provide StaffPortal's organizational workspace, staff administration, communication, policy, document, scheduling, workflow, security, audit, and related functionality.

3. Categories of Personal Data

Depending on how the Customer configures and uses StaffPortal, Personal Data may include:

• Names
• Email addresses
• Telephone numbers
• Contact information
• Account identifiers
• Staff profile information
• Employment and job information
• Department and organizational information
• Scheduling information
• Time and attendance records
• Applicant information
• Policy acknowledgements
• Workspace communications
• Messages
• Files and documents
• Tasks and workflow information
• Authentication information
• IP addresses and device information
• Audit activity
• Support information
• Other information submitted by the Customer or its authorized users

Customers control what Personal Data they choose to submit to StaffPortal.

4. Categories of Data Subjects

Personal Data processed through StaffPortal may relate to:

• Employees
• Staff members
• Contractors
• Applicants
• Former personnel
• Workspace administrators
• Authorized users
• Customer contacts
• Other individuals whose information the Customer lawfully enters into StaffPortal

5. Customer Instructions

StaffPortal will process Personal Data only on documented instructions from the Customer unless processing is required by applicable law.

The Customer's documented instructions include:

• The Terms of Service
• This DPA
• Applicable order forms or commercial agreements
• The Customer's configuration and use of StaffPortal
• Additional written instructions agreed to by the parties

If StaffPortal believes a Customer instruction violates Applicable Data Protection Law, StaffPortal may inform the Customer and suspend the affected processing where reasonably necessary while the issue is resolved.

The Customer is responsible for ensuring that its instructions and use of StaffPortal comply with applicable law.

6. Confidentiality

StaffPortal will ensure that personnel authorized to process Customer Personal Data are subject to appropriate confidentiality obligations.

Access to Customer Data is limited to personnel and systems requiring such access for legitimate operational purposes.

7. Security

StaffPortal will maintain appropriate technical and organizational measures designed to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, alteration, disclosure, or access.

These measures may include:

• Encryption of data in transit
• Encryption of stored files where supported
• Authentication controls
• Role-based and permission-based access controls
• Logical workspace isolation
• Administrative access controls
• Audit logging
• Security monitoring
• Infrastructure protections
• Backup and recovery controls
• Vulnerability and security-management practices

Additional information about StaffPortal's security practices is available on the StaffPortal Security page.

StaffPortal may update its security measures as technology, threats, and the service evolve, provided that such changes do not materially decrease the overall protection of Customer Personal Data.

8. Personal Data Breaches

StaffPortal will notify the Customer without undue delay after becoming aware of a Personal Data breach affecting Personal Data processed on the Customer's behalf.

Where reasonably available, the notification will include information necessary to assist the Customer in understanding:

• The nature of the breach
• Categories of affected data
• Categories or approximate number of affected individuals
• Likely consequences
• Measures taken or proposed to address the breach
• Measures intended to mitigate potential adverse effects

Information may be provided in phases where all details are not immediately available.

StaffPortal will take reasonable steps to contain, investigate, remediate, and mitigate Personal Data breaches affecting Customer Data.

Notification of an incident does not constitute an admission of fault or liability.

9. Assistance With Data Subject Requests

Taking into account the nature of the processing, StaffPortal will provide reasonable assistance to enable the Customer to respond to requests by individuals exercising rights available under Applicable Data Protection Law.

These requests may include rights of:

• Access
• Correction
• Deletion
• Restriction
• Objection
• Portability

Where a request relating to Customer-controlled Personal Data is submitted directly to StaffPortal, StaffPortal may direct the requester to the applicable Customer unless legally prohibited from doing so.

10. Compliance Assistance

Taking into account the nature of processing and the information available to StaffPortal, StaffPortal will provide reasonable assistance with the Customer's obligations relating to:

• Security of processing
• Personal Data breach assessment
• Regulatory notifications
• Data protection impact assessments
• Prior consultation with supervisory authorities where required
• Reasonable privacy and security reviews

The Customer remains responsible for determining whether its particular use of StaffPortal complies with applicable legal requirements.

11. Subprocessors

The Customer provides StaffPortal with general authorization to engage third parties to process Personal Data where reasonably necessary to provide the service.

StaffPortal's current subprocessors are identified on the StaffPortal Subprocessors page.

StaffPortal will require subprocessors that process Customer Personal Data to enter into contractual obligations providing appropriate protection for that data.

StaffPortal remains responsible for its subprocessors' processing to the extent required under Applicable Data Protection Law.

StaffPortal will provide notice of material additions or replacements to its subprocessors before the new subprocessor begins processing Customer Personal Data where reasonably practicable.

A Customer with a reasonable data-protection objection to a new subprocessor may contact StaffPortal to discuss the objection.

If the parties cannot reasonably resolve the objection, the Customer may discontinue the affected service in accordance with its applicable agreement.

12. International Data Transfers

StaffPortal may process Personal Data in the United States and other countries in which StaffPortal or its subprocessors operate.

Where Applicable Data Protection Law requires a transfer mechanism for international transfers, the parties will use an appropriate lawful transfer mechanism.

European Economic Area

Where required for a transfer subject to the GDPR, the parties incorporate the applicable modules of the European Commission's Standard Contractual Clauses for international transfers of Personal Data, as amended, replaced, or superseded from time to time.

The appropriate module will apply according to the parties' respective roles in the relevant transfer.

United Kingdom

Where a transfer is subject to UK data-protection law and requires an appropriate safeguard, the applicable UK International Data Transfer Agreement or International Data Transfer Addendum to the European Commission Standard Contractual Clauses will apply, as appropriate.

Switzerland

Where Swiss data-protection law applies, the applicable transfer mechanism will be interpreted or supplemented as necessary to satisfy Swiss requirements.

StaffPortal will implement supplementary safeguards where required by applicable law and the circumstances of the transfer.

13. Government and Legal Requests

Unless prohibited by law, StaffPortal will notify the Customer of legally binding requests from governmental authorities seeking disclosure of Customer Personal Data where reasonably permitted and appropriate.

StaffPortal will disclose only information it reasonably determines it is legally required to provide.

Where appropriate, StaffPortal may challenge requests that it reasonably believes are unlawful, overbroad, or otherwise improper.

14. Return and Deletion of Customer Data

Customers may export supported Customer Data while their workspace remains active.

Following termination or closure of a workspace, StaffPortal will delete or render inaccessible Customer Data from active production systems within 30 days, unless:

• The Customer requests an earlier supported deletion;
• Applicable law requires retention;
• The parties agree otherwise in writing; or
• Limited retention is reasonably necessary for security, fraud prevention, dispute resolution, or legal obligations.

Data contained in backups may remain until those backups are overwritten or expire according to StaffPortal's normal backup lifecycle.

Backup data will remain protected under this DPA while retained and will not be restored except for legitimate disaster recovery, security, or operational purposes.

Upon Customer request, StaffPortal may provide reasonable confirmation of deletion.

15. Audits and Compliance Information

StaffPortal will make available information reasonably necessary to demonstrate compliance with this DPA.

Customers may submit reasonable written privacy or security assessment questions no more than once during any twelve-month period, unless:

• Required by a competent supervisory authority;
• A Personal Data breach affecting the Customer has occurred; or
• Applicable Data Protection Law requires additional review.

Where available, StaffPortal may satisfy audit requests by providing relevant policies, certifications, security documentation, questionnaire responses, or third-party audit materials.

If additional inspection is legally required and the available documentation is insufficient, the parties will cooperate in good faith to arrange an audit that:

• Provides reasonable advance notice;
• Occurs during normal business hours;
• Does not unreasonably interfere with StaffPortal operations;
• Protects other customers' confidential information and systems; and
• Is subject to appropriate confidentiality and security requirements.

The Customer will bear its audit costs unless applicable law requires otherwise.

16. Customer Responsibilities

The Customer represents that it has an appropriate legal basis for Personal Data submitted to StaffPortal and is authorized to instruct StaffPortal to process that data.

The Customer is responsible for:

• Providing legally required notices to individuals
• Obtaining consents where required
• Configuring workspace permissions appropriately
• Managing authorized users
• Responding to data-subject requests as controller
• Determining appropriate retention requirements
• Ensuring that its use of StaffPortal complies with employment, privacy, and other applicable laws

17. Conflict and Precedence

If this DPA conflicts with the StaffPortal Terms of Service regarding the processing or protection of Personal Data, this DPA controls with respect to that conflict.

Any applicable Standard Contractual Clauses, UK transfer terms, or other mandatory data-transfer provisions will control over this DPA to the extent required by law.

Except as modified by this DPA, the Terms of Service remain in effect.

18. Changes to This DPA

StaffPortal may update this DPA to reflect changes in law, regulatory requirements, security practices, or the StaffPortal service.

StaffPortal will not materially reduce its data-protection obligations for Customer Personal Data during an active subscription without providing reasonable notice where required by law or contract.

19. Contact

Questions regarding this DPA, privacy requests, or requests for an executed copy may be sent to:

Underline LLC

StaffPortal Privacy

1703 N Park Ave

Grand Island, Nebraska 68803

United States

Email: privacy@underline.team