Data Processing Agreement (DPA)

1. Parties and Roles

1.1 Controller ("Customer"): the legal entity entering into the Agreement or Proposal or Terms and Conditions of Faqtic (and, if applicable, on behalf of its Group companies) that determines the purposes and means of processing.

1.2 Processor ("Faqtic"): Marvin Molijn, acting as a sole proprietor under the trading name "Faqtic", registered in Spain with tax identification number ESY8201689H and professional address at Calle Llobregos 259 01 02, 08032 Barcelona ("we", "us", "our" or "Faqtic"), which processes personal data on behalf of the Controller to deliver the Services, including onboarding, implementation, configuration, troubleshooting, support and training.

1.3 Factorial Platform Processor ("Factorial"): Everyday Software, S.L. ("Factorial") owns and operates the Factorial Platform. In relation to Customer personal data processed within the Factorial Platform, Factorial acts as a data processor directly on behalf of the Controller in accordance with Factorial's applicable Data Processing Agreement and platform terms.

Factorial is not appointed by Faqtic as a sub-processor for the operation of the Factorial Platform.

Faqtic may access and process Customer personal data contained within the Factorial Platform solely on behalf of, and in accordance with the documented instructions of, the Controller where necessary to provide the Services, including onboarding, implementation, configuration, troubleshooting, support and training.

Nothing in this DPA changes or replaces the separate data protection relationship between the Controller and Factorial in respect of the Factorial Platform.

1.4 The Controller and the Processor are each a "Party" and together the "Parties."

2. Background and Objective

2.1 The Parties have entered into a contractual relationship (the "Agreement"). Within the scope of its assignment, the Processor may access and process personal data for which the Controller is the data controller under applicable data protection legislation ("Data Protection Legislation").

2.2 The objective of this DPA is to comply with the requirements of the Data Protection Legislation for a written agreement between controller and processor.

2.3 The Processor shall process personal data only in accordance with this DPA and for the limited purpose of performing the obligations set out under the Agreement.

2.4 Processing by the Processor includes the actions specified in the Agreement and this DPA.

3. Definitions

3.1 Personal data: any information relating to an identified or identifiable natural person.

3.2 Processing: any operation performed on personal data (e.g., collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, alignment, restriction, erasure, destruction), automated or not.

3.3 Data controller: the natural or legal person which determines the purposes and means of processing personal data.

3.4 Data processor: the natural or legal person which processes personal data on behalf of the controller.

3.5 Sub-processor: a subcontractor engaged by the Processor that processes personal data on behalf of the Controller for the Processor's service.

3.6 Approved Transfer Mechanisms: where required under applicable Data Protection Legislation, an approved mechanism for the international transfer of personal data, including:

(a) the European Commission's Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914, as amended, replaced or superseded from time to time;

(b) the UK International Data Transfer Agreement ("IDTA") or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses ("UK Addendum"), as applicable and as amended, replaced or superseded from time to time; or

(c) another lawful transfer mechanism recognised under applicable Data Protection Legislation.

3.7 Data Protection Legislation: all applicable data protection and privacy legislation relating to the processing of personal data under this DPA, including, where applicable:

(a) Regulation (EU) 2016/679 ("EU GDPR");

(b) applicable Spanish data protection legislation, including Organic Law 3/2018 on Personal Data Protection and guarantee of digital rights;

(c) the UK GDPR, as incorporated into UK law;

(d) the UK Data Protection Act 2018; and

(e) any legislation amending, replacing or supplementing the above.

4. Undertaking and Instructions

4.1 The Processor shall process personal data on behalf of the Controller only to fulfil the Agreement and only during its term, except where continued retention is required by applicable law or expressly permitted under this DPA.

4.2 The Processor shall process personal data in accordance with Data Protection Legislation, this DPA, the Agreement, and any documented instructions from the Controller (including via ticket/email).

4.3 Where applicable EU, Spanish or UK law requires processing without the Controller's documented instructions, the Processor may carry out such processing but shall inform the Controller before doing so, unless applicable law prohibits such notification.

4.4 The Processor shall not use personal data for its own purposes.

4.5 The Processor shall ensure persons authorised to process personal data are subject to confidentiality (contractual or statutory).

5. Subject Matter, Duration, Nature and Purpose

5.1 Subject and purpose: processing strictly to deliver onboarding, implementation, configuration, troubleshooting, support and training under the Agreement.

5.2 Duration: for the term of the Agreement and any legally required retention.

5.3 Nature: access, storage, viewing, structured queries, ticket handling, configuration assistance, and related operations necessary to render the Services.

6. Categories of Data and Data Subjects

6.1 Data subjects: Customer employees, workers, contractors, candidates, and Platform users designated by the Controller.

6.2 Personal data: identification/contact details; employment/HR data; limited financial identifiers contained in HR records; logs/ticket metadata; and any data the Controller uploads or provides to Faqtic during the Services.

6.3 Special categories of personal data: The Services may involve access to or processing of special categories of personal data where the Controller chooses to record such information within the Factorial Platform or otherwise provides such information to Faqtic in connection with the Services.

Such data may include, where applicable, health and sickness information, disability information, racial or ethnic origin, religious or philosophical beliefs, trade union membership, biometric data used for identification, or other special-category data within the meaning of Article 9 of the EU GDPR or UK GDPR.

Faqtic shall process such information only where necessary to provide the Services and strictly in accordance with the Controller's documented instructions and this DPA.

The Controller remains responsible for determining the lawful basis and applicable Article 9 condition for its collection and use of special-category personal data and, where applicable, satisfying any additional requirements under the UK Data Protection Act 2018 or other applicable Data Protection Legislation.

7. Transfer of Personal Data

7.1 The Processor shall not make a restricted transfer of personal data outside the territory in which the applicable Data Protection Legislation permits that data to be processed freely, unless the Controller has authorised the transfer and an appropriate lawful transfer mechanism is in place.

Where EU GDPR applies, transfers outside the EEA shall be made in accordance with applicable EU GDPR transfer requirements.

Where UK GDPR applies, restricted transfers outside the UK shall be made in accordance with applicable UK GDPR transfer requirements.

Where applicable adequacy regulations or adequacy decisions cover a transfer, no additional transfer mechanism shall be required. Otherwise, the Parties shall use an applicable Approved Transfer Mechanism under Clause 3.6.

7.2 Where an international transfer is covered by an applicable adequacy decision or adequacy regulation, the Parties may rely on that mechanism.

7.3 Where an international transfer is not covered by an applicable adequacy decision or adequacy regulation, the Processor shall ensure that an appropriate transfer mechanism is in place as required by applicable Data Protection Legislation. This may include the European Commission Standard Contractual Clauses, the UK IDTA, the UK Addendum to the EU Standard Contractual Clauses, or another legally recognised safeguard.

7.4 Where required by applicable Data Protection Legislation, the Processor shall reasonably cooperate with the Controller in relation to any required transfer risk assessment or equivalent assessment.

8. Information Security

8.1 The Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk in accordance with applicable Data Protection Legislation.

8.2 The Processor shall inform the Controller of the security measures implemented and notify the Controller well in advance of material changes that could affect the protection of personal data.

9. Personal Data Breach

9.1 In the event of a personal data breach involving Customer personal data, the Processor shall notify the Controller without undue delay and no later than 72 hours after becoming aware of it, providing: (a) the nature of the breach, categories of data subjects and an estimate of affected persons; (b) information necessary for the Controller's statutory obligations; and (c) measures taken or proposed to address the breach and prevent recurrence.

9.2 The Processor shall provide updates as further information becomes available and cooperate reasonably with the Controller, including, where required, with the competent supervisory authority, including the Spanish Data Protection Agency (AEPD) or the UK Information Commissioner's Office (ICO), as applicable.

10. Assistance to the Controller

10.1 Taking into account the nature of the processing and the information available to it, the Processor shall reasonably assist the Controller in complying with its obligations under applicable Data Protection Legislation, including data subject rights, security, breach management, data protection impact assessments and prior consultations with supervisory authorities.

10.2 The Processor shall redirect end-user (employee/worker) requests to the Controller unless expressly authorised in writing to respond.

11. Sub-processors

11.1 General authorisation

The Controller provides general written authorisation for Faqtic to engage the sub-processors identified in Schedule 1 to this DPA where required to provide the Services.

11.2 Sub-processor obligations

Where Faqtic appoints a sub-processor to process Customer personal data on Faqtic's behalf, Faqtic shall enter into appropriate contractual arrangements requiring that sub-processor to provide a level of data protection consistent with Faqtic's obligations under this DPA and applicable Data Protection Legislation.

Faqtic remains responsible for the performance of its appointed sub-processors in accordance with applicable Data Protection Legislation.

11.3 Changes to sub-processors

Faqtic shall provide the Controller with reasonable prior written notice of any intended addition or replacement of a sub-processor that processes Customer personal data on Faqtic's behalf.

The Controller may raise a reasonable objection to the proposed sub-processor on documented data-protection grounds. The Parties shall work in good faith to resolve any such objection.

11.4 Factorial

Factorial is not a sub-processor appointed by Faqtic for the operation of the Factorial Platform. The processing of Customer personal data by Factorial and Factorial's own sub-processors is governed by the separate relationship between the Controller and Factorial, including Factorial's applicable Data Processing Agreement.

Where Faqtic escalates an issue through support channels operated by Factorial, those systems form part of Factorial's processing environment and are governed by Factorial's applicable data protection arrangements.

12. Audit and Compliance

12.1 The Processor shall make available to the Controller the information reasonably necessary to demonstrate compliance with this DPA and applicable Data Protection Legislation and shall facilitate audits, including inspections, by the Controller or a mandated independent auditor, provided that such auditor is not a competitor of Faqtic and is bound by appropriate confidentiality obligations.

12.2 Audits require reasonable prior notice, shall occur during business hours, be proportionate in scope, and avoid undue disruption. Costs are borne by the Controller unless a material non-compliance by the Processor is established.

13. Return and Deletion

13.1 Upon expiry or termination of the Agreement, and at the Controller's choice, the Processor shall return or delete Customer personal data in its possession—save for minimal retention required by law or presence in backups subject to secure, time-bound deletion.

13.2 Personal data held within the Factorial Platform is subject to the Controller's separate relationship with Factorial, including Factorial's applicable Data Processing Agreement, data retention policies and Platform functionality. Faqtic is not responsible for the retention, deletion or export of personal data held solely within the Factorial Platform.

14. Damages and Compensation

14.1 Subject to the limitations and exclusions of liability contained in the Agreement, including the aggregate liability cap set out in Clause 19.2 of the Faqtic Terms and Conditions, the Processor shall indemnify the Controller against direct damages, costs and claims to the extent attributable to the Processor's processing of personal data in breach of this DPA or applicable Data Protection Legislation.

For the avoidance of doubt, liability arising under this Clause 14 is subject to the liability cap in Clause 19.2 of the Faqtic Terms and Conditions.

Nothing in this DPA excludes or limits any liability to the extent that such liability cannot lawfully be excluded or limited.

14.2 Unless otherwise agreed in writing, the Processor's compensation under the Agreement includes compensation for the Processor's undertakings under this DPA.

15. Order of Validity

15.1 This DPA is an integral part of the Agreement. If the terms of the Agreement and this DPA diverge or conflict on data-protection matters, this DPA prevails.

16. Term and Termination

16.1 This DPA becomes effective when it is signed, accepted or incorporated into the Agreement and remains in force for as long as the Processor processes personal data on the Controller's behalf.

16.2 If the Processor breaches the DPA or Data Protection Legislation and fails to remedy within thirty (30) days of notice (or such other period agreed by the Parties), the Controller may terminate the Agreement with immediate effect (or on longer notice specified by the Controller).

16.3 Upon termination/expiry, the Processor shall act per Clause 13 (return/deletion) and promptly seek the Controller's instructions where needed.

17. Governing Law and Dispute Resolution

17.1 This DPA shall be governed by and construed in accordance with Spanish law, excluding conflict-of-law rules.

17.2 Disputes shall be resolved per the Agreement; absent such provision, disputes shall be submitted to the courts of Barcelona, Spain.

Schedule 1: Faqtic Sub-processors

The Controller provides general authorisation for Faqtic to use the following sub-processors for the limited purposes described below.

Use of sub-processors

Faqtic only permits its sub-processors to process Customer personal data to the extent necessary for the purposes described above.

The inclusion of a provider in this Schedule does not mean that Customer personal data will necessarily be processed by that provider during every engagement. For example, Google Workspace will only process employee or HR information under this DPA where such information is provided through email or another relevant Workspace service, and Clarify will only process meeting content where meeting recording or transcription is enabled.

Faqtic shall notify the Controller of intended additions or replacements to these sub-processors in accordance with Clause 11.3.