Data Processing Addendum
Effective September 3, 2026 · Version 2026-09-03
This Data Processing Addendum ("DPA") forms part of the ServiceOS Terms when ServiceOS processes personal data on behalf of a business customer in connection with the Service.
1. Roles
The business customer acts as controller/business or otherwise determines the purposes and means of processing its customer/workforce data. ServiceOS acts as processor/service provider to the extent it processes that data solely to provide the Service and according to documented customer instructions.
2. Processing instructions
ServiceOS will process covered personal data to provide, secure, maintain, support, and improve the contracted Service; comply with documented configuration and support instructions; and comply with applicable law. ServiceOS will not sell covered customer personal data or use it for unrelated third-party advertising.
3. Confidentiality and security
ServiceOS will use reasonable safeguards appropriate to the nature of the Service and limit access to personnel or service providers that need access for authorized purposes and are subject to appropriate confidentiality obligations.
4. Service providers/subprocessors
ServiceOS may use infrastructure, payment, communications, security, support, and other providers to deliver the Service. ServiceOS remains responsible for imposing appropriate data-protection obligations on providers that process customer personal data on its behalf.
5. Individual rights requests
Taking into account the nature of processing, ServiceOS will provide commercially reasonable assistance through available product and support mechanisms when a customer needs to respond to a verified data-subject/consumer request concerning data controlled by that customer.
6. Security incidents
ServiceOS will notify affected business customers without undue delay after confirming a security incident involving customer personal data when notification is required by applicable law or contract, and will provide available information reasonably necessary for the customer to meet its own obligations.
7. Return and deletion
During the subscription, customers may use available export and deletion functionality. Following account termination, ServiceOS may delete or de-identify customer data after applicable retention, recovery, legal, and backup periods unless continued retention is required by law.
8. International processing
If personal data is transferred across jurisdictions, each party is responsible for any transfer mechanism legally required for its role. Customers with specific cross-border requirements should contact ServiceOS Support before placing regulated data in ServiceOS.
9. Customer obligations
The customer is responsible for lawful collection of the data, notices and consents, instructions provided to ServiceOS, account access management, and determining whether the Service is appropriate for data subject to industry-specific requirements.