Data Processing Agreement

This Data Processing Agreement ("DPA") applies whenever Workplume processes personal data on behalf of a Customer, and forms part of the Terms of Service. It takes effect when the Customer starts using the Service; no signature is required for it to apply. A Customer whose own procurement rules need a signed copy can request one at [email protected].

1. Roles

For workspace data — the personal data of the Customer's employees and contacts that the Customer or its users put into the Service — the Customer is the controller and Workplume is the processor. The Customer decides what to collect, who may see it, and how long it is kept.

For a limited set of data Workplume is itself the controller: the account holder's own contact details, billing records, security and audit logs, and technical diagnostics. That processing is described in the Privacy Policy, not here.

2. Subject matter and duration

The subject matter is the provision of the Workplume platform as described in the Terms. Processing lasts for as long as the Customer's workspace exists, and ends as set out in §8. Annex I describes the processing in the detail a controller is expected to record.

3. Instructions

Workplume processes workspace data only on the Customer's documented instructions. Using the Service — creating users, placing orders, uploading files, configuring the workspace — is itself the instruction. We do not process workspace data for our own purposes, do not use it to train models, do not sell it, and do not use it to profile or evaluate individual employees.

If we believe an instruction breaks applicable data-protection law, we will say so rather than silently carry it out or silently refuse.

4. Confidentiality

Everyone with access to workspace data is bound by confidentiality obligations. Access is limited to the people who need it to run and support the Service, and support staff access a workspace only where it is needed to answer a request or investigate a fault.

5. Security

We apply the technical and organisational measures in Annex II. Those measures are what the Service does today; they are described plainly rather than as aspirations, and Annex II changes when the measures do.

Breach notification. If we become aware of a personal-data breach affecting a Customer's workspace, we will notify that Customer's administrators without undue delay and in any event within 72 hours of becoming aware, with what we know at the time: what happened, which data was involved as far as we can tell, what we are doing, and what the Customer may need to do. We will not wait for a complete picture before telling you.

6. Sub-processors

The Customer authorises the sub-processors listed in Annex III. Each is bound by data-protection terms no less protective than these, and we remain responsible to the Customer for what they do.

We will give notice before adding or replacing a sub-processor by updating Annex III and the version date of this page, and by emailing workspace administrators where the change affects them. A Customer who objects on reasonable data-protection grounds may raise it at [email protected]; if we cannot resolve it, the Customer may terminate and receive a pro-rata refund of the unused period.

7. Assistance

Employees' requests to access, correct or delete their data go to their own employer, since the employer is the controller and holds the workspace. Where the Customer needs our help to answer one — extracting a person's data, correcting it, or deleting it — we will provide it, at no charge for a reasonable volume of requests. We will also help, taking into account what we know, with data protection impact assessments and with prior consultation of a supervisory authority.

If a request from an employee reaches us directly, we will not answer it ourselves. We will tell the person to contact their employer, and tell the Customer that we received it.

8. Deletion and return

A workspace is not deleted automatically when a subscription ends: it remains so the Customer can return or export, and is deleted when the Customer asks. On request we delete workspace data within 30 days and confirm when it is done. Deletion covers the live Service, our primary file storage, and the copies in our backup file store.

Independently of any request, a file that no longer exists in the Service is removed from the backup file store 90 days after it was deleted. That window exists so a mistaken deletion can be undone; it is bounded so that deleting something does not mean we keep it forever.

Database backups are the exception, and we would rather say so than imply otherwise: a backup taken before a deletion still contains the data until that backup rolls off. Backups are kept for the most recent 30 daily copies, so deleted data disappears from them within about 30 days. It is not restored into the live Service in the meantime.

The Customer can export workspace data from inside the app at any time while the workspace exists.

9. Audits

On reasonable request, and not more than once a year unless a breach or a supervisory authority requires otherwise, we will provide the information needed to demonstrate compliance with this DPA and answer a written security questionnaire. We do not currently hold a SOC 2 or ISO 27001 certification, and we would rather tell you that here than have you discover it during procurement. Any on-site audit is by agreement, at the Customer's cost, and must not compromise other customers' data.

10. International transfers

The Service does not run on infrastructure inside Qatar; personal data is processed in the United States and the European Union by the providers in Annex III. Where a transfer is restricted by applicable law, we rely on the standard contractual clauses and equivalent safeguards published by each provider as part of its own data-processing terms. Gulf data residency is not available today; a Customer who requires it should raise that before signing up.

11. Liability, term and changes

The limitations of liability in the Terms of Service apply to this DPA. This DPA lasts as long as we process workspace data. We may update it — for example when a sub-processor changes — by publishing a new version here with a new date; changes that materially reduce protection will be notified to workspace administrators in advance.

Where this DPA and the Terms of Service conflict on the processing of personal data, this DPA wins.

Annex I — Description of the processing

A. Parties

Controller: the Customer, being the company that created the workspace.
Processor: Shekew Import and Export, Qatar, operating Workplume.

B. Categories of data subject

• The Customer's employees and their managers and administrators;
• contacts at the Customer's vendors and suppliers, where the Customer enters them.

C. Types of personal data

• Identity and work contact details: name, work email address, phone number where entered;
• employment context: role, department, branch, reporting line, employment dates;
• workspace content: orders, approvals, leave requests, expense claims, tasks and comments, chat messages and their attachments;
• technical data: IP address, browser and device information, login timestamps, audit records.

The Service is not designed for special categories of personal data. Leave requests can imply absence for medical reasons; Customers should not record diagnoses, medical certificates or other health detail in free-text fields or attachments.

D. Nature and purpose of processing

Storage, organisation, retrieval and display of workspace content so that the Customer can run office ordering, approvals, tasks, leave, expenses and internal chat; sending service email arising from those actions; keeping security and audit records; and taking backups.

E. Frequency and duration

Continuous, for as long as the workspace exists, ending as described in §8.

F. Competent supervisory authority

Determined by where the Customer is established. For Customers in Qatar, the authority responsible for the Personal Data Privacy Protection Law (Law No. 13 of 2016).

Annex II — Technical and organisational measures

These are the measures in force today.

Annex III — Sub-processors

Contact

Questions about this DPA, requests for a signed copy, and sub-processor objections: [email protected]. Privacy questions and data requests: [email protected].