Status: Draft for counsel review
Effective date: [EFFECTIVE DATE]
This Data Processing Addendum (“DPA”) forms part of the Master SaaS Agreement between [JANNIE LEGAL ENTITY NAME] (“Jannie”) and Customer. Capitalized terms not defined here have the meaning in the Agreement.
1. Roles and instructions
For Customer workforce and operational personal data, Customer determines the purposes and means of processing and Jannie processes data on Customer’s documented instructions. The Agreement, Order Forms, Customer configurations, support requests, and authorized use of the service constitute documented instructions.
Each party will comply with privacy and security laws applicable to its role. Customer will ensure its instructions are lawful and will provide required workforce notices and authorizations.
2. Processing details
- Subject: providing and securing Jannie’s B2B operational service.
- Duration: subscription term, export period, backup rotation, purchased archive period, and any legally required retention.
- Data subjects: Customer administrators, staff, employees, contractors, client contacts, and other authorized adult users.
- Data categories: identifiers, contact data, tax-profile data, banking data, roles, assignments, schedules, attendance, point-in-time location, evidence photographs, operational notes, payroll and billing inputs, AI prompts and responses, device/IP data, audit logs, and support communications.
- Sensitive categories: SSN/TIN, bank account/routing data, precise location, credentials, and private evidence.
- Purposes: authentication, tenant isolation, attendance/evidence, approved operational workflows, customer-reviewed NACHA file generation, reporting, AI assistance, support, security, audit, and legal compliance.
3. Confidentiality and access
Jannie will limit access to persons with a need to perform the service, require confidentiality, use role-based and organization-scoped access, and maintain records of privileged access where appropriate. Jannie will not access Customer Data for unrelated purposes.
4. Security
Jannie will maintain safeguards appropriate to risk, including encryption in transit, appropriate encryption or field-level protection at rest, secret management, tenant enforcement, least privilege, authentication controls, logging, vulnerability and dependency management, backups, secure deletion, incident response, and employee/vendor confidentiality.
Customer is responsible for its endpoints, accounts, role configuration, user removal, lawful collection, and secure handling of exports and NACHA files.
5. Restricted AI processing
Jannie will not intentionally send SSN/TIN, bank account or routing numbers, dates of birth, photographs, exact coordinates, NACHA files, or tax forms to OpenAI. Customer will instruct users not to place restricted information in AI prompts. Jannie will apply filtering, tool-field allowlists, and logging controls before production use of the related promise.
6. Subprocessors
Customer generally authorizes the subprocessors in the current Subprocessor List. Jannie remains responsible for requiring each subprocessor to protect personal data consistently with its services and applicable obligations.
Jannie will provide [NOTICE PERIOD] advance notice of a new material subprocessor where reasonably practicable. Customer may object during the notice period on reasonable data-protection grounds. The parties will work in good faith on a commercially reasonable resolution; if none is available, either party may terminate the affected service under the Agreement.
7. Requests and assessments
Taking into account the nature of processing, Jannie will reasonably assist Customer with verified individual requests, data-protection assessments, regulator inquiries, and compliance information. Customer remains responsible for evaluating and responding to a request. Jannie may charge reasonable fees for exceptional assistance not caused by Jannie’s breach.
8. Security incidents
Jannie will notify Customer without undue delay after confirming unauthorized acquisition of Customer Data for which notice is required under applicable law or contract. The notice will include known information about the nature, affected data, likely consequences, containment, and contact point. Jannie may provide updates as investigation continues.
Notification is not an admission of fault. Customer is responsible for notices to workers, clients, regulators, and others unless law assigns that responsibility to Jannie. The parties will cooperate and will not issue statements identifying the other without consultation unless required by law.
[COUNSEL: select a contractual notice deadline consistent with insurance and Florida/Texas requirements.]
9. Return and deletion
During the subscription and 90-day post-termination export window, Customer may request an available export. After the window, Jannie may delete active data and allow backups to expire, unless retention is required by law or a purchased archive applies. On request, Jannie will provide reasonable confirmation of deletion.
10. Audit information
On reasonable written request no more than annually, Jannie will provide available security summaries, policies, or independent reports relevant to the service, subject to confidentiality and security restrictions. On-site audits require reasonable cause, advance notice, limited scope, and reimbursement of reasonable costs unless an audit identifies material noncompliance.
11. Government requests
Jannie will disclose Customer Data to an authority only when legally required and, where permitted, will notify Customer and challenge requests that are facially invalid or overbroad.
12. Priority and liability
If this DPA conflicts with the Agreement about personal-data processing, this DPA controls. Liability under this DPA is subject to the Agreement unless counsel-approved terms expressly state otherwise.