Xanivar Field

Field — Data Processing Addendum

Effective date: [INSERT DATE] Last updated: [INSERT DATE]

Final draft for review by Xanivar Labs' legal counsel prior to publication. Items in [brackets] are to be completed by Xanivar Labs.

This Data Processing Addendum ("DPA") forms part of, and is subject to, the Field Terms and Conditions or other written agreement (the "Agreement") between Xanivar Labs Pte. Ltd. (UEN 202607828N), a company incorporated in Singapore ("Xanivar Labs", "we", "us", "Processor"), and the customer organisation that has entered into the Agreement (the "Customer", "you", "Controller"). It records the parties' obligations when Xanivar Labs processes Customer Personal Data on the Customer's behalf in providing the Field service (the "Service").

Where there is a conflict between this DPA and the Agreement in relation to the processing of Customer Personal Data, this DPA prevails. Where there is a conflict between this DPA and the Standard Contractual Clauses (Annex 4), the Standard Contractual Clauses prevail.

1. Definitions

1.1 Capitalised terms not defined here have the meaning given in the Agreement.

1.2 In this DPA:

• "Data Protection Laws" means all laws applicable to the processing of Customer Personal Data under this DPA, including the Singapore Personal Data Protection Act 2012 ("PDPA"), the EU General Data Protection Regulation (2016/679) ("EU GDPR"), the UK GDPR and Data Protection Act 2018 ("UK GDPR"), and the California Consumer Privacy Act as amended ("CCPA"), each to the extent applicable.
• "Customer Personal Data" means personal data contained in Customer Data that Xanivar Labs processes on the Customer's behalf under the Agreement, as further described in Annex 1.
• "Data Subject", "personal data", "processing", "controller", "processor", and "personal data breach" have the meanings given in the applicable Data Protection Laws.
• "Sub-processor" means any third party engaged by Xanivar Labs to process Customer Personal Data.
• "Standard Contractual Clauses" or "SCCs" means (a) the standard contractual clauses for the transfer of personal data to third countries approved by the European Commission in Decision 2021/914 (the "EU SCCs"); and (b) the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (the "UK Addendum"), as applicable.

2. Roles and scope of processing

2.1 For Customer Personal Data, the Customer is the controller and Xanivar Labs is the processor. Where the Customer is itself a processor acting on behalf of a third-party controller, Xanivar Labs is a sub-processor, and the Customer warrants it has the third party's authority to enter into this DPA on its behalf.

2.1A Worker Profile Data is outside this DPA. The Service also maintains a profile that belongs to an individual worker rather than to any one employer — their identity and contact details, the credentials, licences and training records they hold, and their verified work record. That profile follows the individual between employers and is not maintained on the Customer's instructions, so Xanivar Labs is the CONTROLLER of it and it is not Customer Personal Data. It is not processed on the Customer's behalf, is not covered by this DPA, and is not returned or deleted under Section 10 when the Agreement ends. It records the Customer as the employer together with the shape of the work — dates, hours, counts, and whether attendance was verified — and does not include the Customer's clients, the premises at which work was performed, or the Customer's pricing or commercial information. Xanivar Labs' handling of it is described in the Field Privacy Policy.

2.2 Xanivar Labs will process Customer Personal Data only: (a) to provide, secure, and support the Service; (b) in accordance with the Customer's documented instructions (including as configured through the Service and as set out in the Agreement and this DPA); and (c) as required by law, in which case Xanivar Labs will inform the Customer of that legal requirement before processing, unless the law prohibits it.

2.3 The subject matter, duration, nature and purpose of the processing, the types of Customer Personal Data, and the categories of Data Subjects are described in Annex 1.

2.4 Xanivar Labs will inform the Customer if, in its opinion, an instruction infringes Data Protection Laws (without obligation to provide legal advice).

3. Xanivar Labs' obligations

3.1 Confidentiality of personnel. Xanivar Labs will ensure that persons authorised to process Customer Personal Data are subject to appropriate confidentiality obligations and process the data only as instructed.

3.2 Security. Xanivar Labs will implement and maintain the technical and organisational measures described in Annex 2 to protect Customer Personal Data against a personal data breach, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing.

3.3 Assistance to the Customer. Taking into account the nature of the processing and the information available to it, Xanivar Labs will provide reasonable assistance to the Customer to help it: (a) respond to requests from Data Subjects to exercise their rights (Section 6); (b) ensure the security of processing; (c) notify and communicate personal data breaches (Section 5); and (d) carry out data protection impact assessments and prior consultations with supervisory authorities where required (Section 7).

3.4 No sale of data. Xanivar Labs will not sell Customer Personal Data, will not retain, use, or disclose it for any purpose other than providing the Service (or as otherwise permitted by Data Protection Laws), and will not combine it with other data except as needed to provide the Service.

4. Sub-processors

4.1 The Customer provides general authorisation for Xanivar Labs to engage Sub-processors to process Customer Personal Data. Xanivar Labs' current Sub-processors are listed in Annex 3.

4.2 Xanivar Labs will impose data-protection obligations on each Sub-processor that are no less protective than those in this DPA, and remains responsible for its Sub-processors' performance of those obligations.

4.3 Xanivar Labs will give the Customer notice (for example by email or by updating a published list) before adding or replacing a Sub-processor. The Customer may object on reasonable data-protection grounds within [30] days of notice. If the parties cannot resolve the objection, the Customer may, as its sole remedy, terminate the affected part of the Service.

5. Personal data breach

5.1 Xanivar Labs will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.

5.2 The notification will include, to the extent known and permitted, the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed. Xanivar Labs will provide further information as it becomes available and reasonable assistance to help the Customer meet its own breach-notification obligations.

5.3 Xanivar Labs' notification is not an acknowledgement of fault or liability.

6. Data subject requests

6.1 If Xanivar Labs receives a request from a Data Subject to exercise rights under Data Protection Laws in respect of Customer Personal Data, it will, unless legally required to respond, direct the Data Subject to the Customer and promptly notify the Customer.

6.2 Xanivar Labs will provide reasonable assistance, including through the functionality of the Service, to enable the Customer to respond to such requests.

7. Impact assessments and consultation

Taking into account the nature of processing and the information available to it, Xanivar Labs will provide reasonable assistance to the Customer with data protection impact assessments and any prior consultation with a supervisory authority that the Customer is required to carry out under Data Protection Laws.

8. International transfers

8.1 Xanivar Labs will not transfer Customer Personal Data to a country outside the country of origin unless it has taken measures necessary to ensure the transfer is lawful under Data Protection Laws.

8.2 EU/EEA and UK transfers. Where Xanivar Labs processes Customer Personal Data subject to the EU GDPR or UK GDPR and transfers it to a country not subject to an adequacy decision, the Standard Contractual Clauses apply and are incorporated into this DPA:

(a) the EU SCCs apply, with Module Two (controller-to-processor) where the Customer is a controller, and Module Three (processor-to-processor) where the Customer is a processor; with the options and annexes completed as set out in Annex 4; and

(b) the UK Addendum applies to transfers subject to the UK GDPR, completed as set out in Annex 4.

8.3 PDPA transfers. For Customer Personal Data subject to the PDPA, Xanivar Labs will take reasonable steps to ensure a standard of protection comparable to the PDPA for any transfer outside Singapore.

8.4 Data residency. Where the Customer selects a data-residency option in the Service (for example, the European Union), Xanivar Labs will store the relevant Customer Personal Data in the selected region in accordance with that configuration.

9. Audit

9.1 Xanivar Labs will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA and Article 28 of the EU/UK GDPR.

9.2 The Customer may audit Xanivar Labs' compliance no more than once per year (unless required more frequently by a supervisory authority or following a personal data breach), on reasonable prior written notice, during business hours, subject to confidentiality, and without unreasonably disrupting Xanivar Labs' operations. Xanivar Labs may satisfy an audit request by providing a recent third-party audit report or security summary where available.

10. Return and deletion

10.1 On expiry or termination of the Agreement, the Customer's account becomes export-only for thirty (30) days. Within that period Xanivar Labs will, at the Customer's choice, delete or return Customer Personal Data and delete existing copies, unless retention is required by law. This is the same period as in Clause 4.4B and Clause 16.4 of the Terms.

10.2 Backups containing Customer Personal Data are deleted in accordance with Xanivar Labs' standard backup-retention cycle. Until deleted, such data remains protected under this DPA.

11. United States — service provider terms

11.1 To the extent the CCPA applies, the Customer is a "business" and Xanivar Labs is a "service provider". Xanivar Labs will not: (a) sell or share Customer Personal Data; (b) retain, use, or disclose it for any purpose other than the business purposes specified in the Agreement, or outside the direct business relationship; or (c) combine it with other personal information except as permitted by the CCPA. Xanivar Labs certifies that it understands and will comply with these restrictions.

12. Liability and precedence

12.1 Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement.

12.2 This DPA is governed by the same law and subject to the same dispute-resolution provisions as the Agreement, except where the Standard Contractual Clauses require otherwise. Except as amended by this DPA, the Agreement remains in full force.

Annex 1 — Details of processing

• Subject matter: Xanivar Labs' provision of the Field service to the Customer under the Agreement.
• Duration: the term of the Agreement, plus the return/deletion period in Section 10.
• Nature and purpose: hosting, storing, and processing Customer Personal Data to provide field-workforce management functionality (worker onboarding, credentials, scheduling, clock-in/time tracking — including via QR-code or NFC-tag scanning, visits and tasks, media, voice-to-text notes, reporting, notifications) and related support and security.
• Categories of Data Subjects: the Customer's Authorized Users, employees, workers, contractors, field staff, and — where the Customer inputs it — the Customer's own customers/contacts.
• Categories of Customer Personal Data: identity and contact details; country/residency; right-to-work and credential documents submitted to the Customer; shift/roster, clock-in and time records; task and visit records; location/visit data (where enabled); media (e.g., photos) captured in the course of work; voice/audio input for voice-to-text dictation (transcribed to text); the Customer's own customer and contact records; account, device, usage, and log data. Does NOT include Worker Profile Data, for which Xanivar Labs is controller — see Section 2.1A.
• Special categories (if any): not intentionally processed, except as the Customer chooses to include (for example, within credential documents). [Confirm.]
• Frequency: continuous, for the duration of the Agreement.

Annex 2 — Technical and organisational security measures

[Confirm/adjust to match Xanivar Labs' actual controls before publication.]

• Encryption: Customer Personal Data encrypted in transit (TLS); encryption at rest provided by our infrastructure providers.
• Access control: role-based access, least-privilege principles, unique credentials, and strong authentication for administrative access; access to production data restricted to authorised personnel on a need-to-know basis.
• Network and application security: hosting on reputable cloud infrastructure; bot/abuse protection; input validation; secure development practices; dependency and vulnerability management.
• Segregation: logical separation of Customer data within a multi-tenant environment; optional regional data residency.
• Logging and monitoring: application and error monitoring, audit logging of relevant events, and alerting on anomalous activity.
• Backup and resilience: regular backups and defined retention/deletion cycles; recovery procedures.
• Personnel: confidentiality obligations and security awareness for staff with access to Customer Personal Data.
• Sub-processor management: contractual data-protection terms with Sub-processors and periodic review.
• Incident response: documented process for detecting, assessing, and notifying personal data breaches.
• Certifications: [None currently held / list any, e.g., SOC 2, ISO/IEC 27001, once obtained.]

Annex 3 — Approved Sub-processors

[Confirm exact legal entity, role, and processing location for each before publication.]

Annex 4 — Standard Contractual Clauses: completed options

EU SCCs (Decision 2021/914):

• Module in operation: Module Two (controller-to-processor) and/or Module Three (processor-to-processor), as applicable per Section 8.2.
• Clause 7 (docking clause): [applies / does not apply].
• Clause 9 (sub-processors): Option 2 (general written authorisation); notice period [30] days (Section 4.3).
• Clause 11 (independent dispute resolution): optional wording [not used].
• Clause 17 (governing law): the law of [Ireland / an EU Member State — confirm].
• Clause 18 (forum and jurisdiction): the courts of [same Member State].
• Annex I (parties, description of transfer): as set out in Annex 1 of this DPA; data exporter = Customer; data importer = Xanivar Labs Pte. Ltd.
• Annex II (technical and organisational measures): as set out in Annex 2 of this DPA.
• Annex III (sub-processors): as set out in Annex 3 of this DPA.

UK Addendum:

• Table 1 (parties) / Table 2 (SCCs) / Table 3 (appendix information): as above.
• Table 4 (ending the Addendum): [importer / exporter / neither] may end the Addendum as permitted.

Signatures

Controller (Customer) Name: ______________________ Title: ______________________ Date: __________

Processor — Xanivar Labs Pte. Ltd. Name: ______________________ Title: ______________________ Date: __________

This document should be reviewed and approved by Singapore-qualified counsel (and, for the SCCs/UK Addendum, EU/UK-qualified counsel) before use. Keep Annexes 2 and 3 current as your controls and sub-processors change.

Terms · Privacy Policy · Authorized User Terms · Cookie Policy · Privacy settings · Delete account