Data Processing Agreement

This DPA defines and sets clear guidelines on:

WorkHex processes Customer Personal Data solely to deliver SaaS platform modules, including:

Processing activities are performed strictly as necessary to sustain and run the requested service instances.

Depending on which platform components you activate, we may process:

Processor operations comprise basic technical activities including:

The Controller maintains exclusive responsibility and liability for:

The Processor agrees to strictly comply with the following mandates:

WorkHex provides tracking modules containing GPS-based time tracking, selfie attendance verification, and login logs.

The client remains strictly liable for employee disclosures, statutory notices, and compliance with local tracking regulations. WorkHex serves solely as the technical developer supplying database storage.

Compensation, employee bank accounts, and HR structures represent highly sensitive operations.

WorkHex enforces role-based access filtering (RBAC) to isolate wage details and payroll calculations, meaning only administrators or assigned staff roles within your organization can view these panels.

WorkHex features smart assistants, resume parsing scoring, and automated pipelines.

All automated metrics, score reports, and suggestion lists represent recommendations. The customer is solely responsible for auditing and validating hiring choices and financial decisions.

To secure user databases, prevent unauthorized access, and match compliance guidelines, WorkHex records major modifications, including login tracking, database modification, payroll tuning, and administrative permission changes.

WorkHex partners with verified infrastructure vendors (“Subprocessors”) to deliver core services (such as cloud hosting, mail distribution, SMS gateways, and Meta integrations).

We bind all subprocessors to data protection requirements equivalent to those in this DPA.

Client databases are securely hosted and backed up inside cloud infrastructure primarily located in **India**.

We apply rigid technical precautions to prevent data loss or hardware failovers across all hosting locations.

We execute reasonable technical protocols, including:

If we identify a verified data breach impacting your account, WorkHex will promptly:

• Initiate immediate containment procedures.
• Notify Controller representatives with relevant details where required.
• Supply updates on our mitigation plans.

For hosting backups or syncing with external subprocessors (such as calendar integrations), data may be transmitted or saved outside your primary operational territory. We ensure all such transfers adhere to standard contractual clauses.

Upon cancellation, client databases are kept in secure backups for up to **90 days** to support emergency recovery or compliance checks, after which they are permanently wiped.

The Controller holds the sole responsibility to export all internal lists and bookkeeping ledgers before account termination.

If you need to execute access, export, correction, or structural deletion requests, please contact our support desk directly at support@workhex.com.

WorkHex operates exclusively as a data processor. The Controller holds complete liability for establishing consent, payroll accuracy, legal compliance, and defining access roles. WorkHex is not liable for structural fines, employment conflicts, or legal infractions caused by customer settings.

This Data Processing Agreement is governed by the laws of **India**. Any disputes shall be subject exclusively to the courts of **Kozhikode, Kerala, India**.

For any technical questions, data compliance queries, or DPA clarifications, please connect with the Brandstrek help desk: