Acuerdo de procesamiento de datos

DATA PROCESSING AGREEMENT FOR WIZSCHEDULER Effective Date: April 5, 2026 1. SCOPE AND PURPOSE This Data Processing Agreement ("DPA") forms part of the Terms of Service between WizScheduler ("Processor") and the customer organization ("Controller"). It governs the processing of personal data by the Processor on behalf of the Controller in connection with the WizScheduler scheduling service. 2. DEFINITIONS Terms used in this DPA have the meanings given in the GDPR (Regulation (EU) 2016/679) unless otherwise defined herein. "Personal Data" means any data relating to an identified or identifiable natural person processed through the Service. 3. PROCESSING DETAILS - Subject Matter: Provision of AI-powered employee scheduling services. - Duration: For the term of the service agreement. - Nature and Purpose: Storage, retrieval, and AI-based optimization of employee scheduling data. - Types of Personal Data: Names, email addresses, work availability, role assignments, skill levels, interpersonal preferences, shift history. - Categories of Data Subjects: Employees and managers of the Controller's organization. 4. OBLIGATIONS OF THE PROCESSOR The Processor shall: - Process Personal Data only on documented instructions from the Controller. - Ensure that persons authorized to process Personal Data have committed to confidentiality. - Implement appropriate technical and organizational security measures. - Assist the Controller in responding to data subject rights requests. - Delete or return all Personal Data upon termination of the service. - Make available all information necessary to demonstrate compliance. - Notify the Controller without undue delay of any Personal Data breach. 5. SUB-PROCESSORS The Controller authorizes the use of the sub-processors listed in the "processors" field of this document. The Processor shall notify the Controller of any intended changes to sub-processors, giving the Controller the opportunity to object. The Processor shall ensure that sub-processors are bound by equivalent data protection obligations. 6. DATA TRANSFERS Where Personal Data is transferred outside the EEA, the Processor ensures appropriate safeguards are in place, including: - EU Standard Contractual Clauses (SCCs) with each sub-processor. - Transfer Impact Assessments where required. - Supplementary measures as necessary to ensure adequate protection. 7. SECURITY MEASURES The Processor implements the following measures: - Encryption of data at rest and in transit (TLS 1.2+). - Password hashing using bcrypt. - JWT-based authentication with configurable token expiration. - Multi-tenant data isolation at the application and database level. - Security headers (HSTS, X-Frame-Options, X-Content-Type-Options). - Regular security updates and vulnerability monitoring. 8. DATA BREACH NOTIFICATION In the event of a Personal Data breach, the Processor shall notify the Controller within 72 hours of becoming aware of the breach, providing: - The nature of the breach and categories of data affected. - Approximate number of data subjects affected. - Likely consequences of the breach. - Measures taken or proposed to mitigate the breach. 9. AUDITS AND INSPECTIONS The Processor shall allow for and contribute to audits and inspections conducted by the Controller or an authorized auditor. The Processor shall provide the Controller with all information necessary to demonstrate compliance with this DPA. 10. TERMINATION Upon termination of the service agreement, the Processor shall, at the Controller's choice, delete or return all Personal Data and certify deletion, unless retention is required by applicable law. 11. GOVERNING LAW This DPA shall be governed by the same law that governs the Terms of Service, supplemented by GDPR requirements where applicable.