Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of and is incorporated by reference into the agreement governing the use of the Peepel platform (the "Principal Agreement") entered into between Peepel and the customer or partner acting as data controller (the "Controller"):

"Controller" means any customer or partner that uses the Platform and determines the purposes and means of the Processing of Personal Data.

Peepel, a private limited company ("besloten vennootschap") incorporated, organized, and existing under the laws of Belgium, with its registered office at Dok-Noord 3A/403, 9000 Ghent, Belgium, and registered with the Crossroads Bank for Enterprises ("Kruispuntbank van Ondernemingen") under enterprise number 1012.072.363, trading under the name "Peepel" (hereinafter Peepel).

The Controller and the Processor are hereinafter together referred to as the Parties and each individually as a Party.

Considerations

The Processor shall process Personal Data on behalf of the Controller in the context of the Controller's use of the Processor's cloud-based HR software platform marketed under the name "Peepel" (the Platform).

The Parties intend to ensure that such processing is carried out in compliance with Applicable Data Law, in particular article 28 GDPR.

This DPA sets out the respective rights and obligations of the Parties with regard to such processing.

This DPA results from free and informed negotiations. The Parties acknowledge that its terms were deliberately agreed and included, consider them fair and balanced, and confirm they had the opportunity to seek independent advice.

THE PARTIES HAVE AGREED AS FOLLOWS:

1. Interpretation and definitions

1.1 Interpretation

In this DPA: (a) headings are for convenience only and do not affect interpretation; (b) in writing and written mean written form including email, but not other electronic forms unless stated otherwise; and (c) include and words of similar effect mean "including without limitation".

Capitalized terms and expressions, including their conjugations, derivatives, and combinations with other words or prefixes, have the meanings set out in Article 1.2 of this DPA, unless the context clearly requires otherwise. The terms Controller, Data Subject, Personal Data, Personal Data Breach, and Processor shall have the meaning given to them in the GDPR. Unless the context clearly requires otherwise, the singular includes the plural and vice versa.

1.2 Definitions

• Applicable Data Law means any law, statute, regulation, rule, code, ordinance, decree, order, judgment, treaty, international convention, or other legal requirement of any Competent Authority that is binding on a Party, the performance of that Party's obligations under this DPA, or the subject matter of this DPA, in each case as amended, re-enacted, consolidated, or replaced and in force from time to time. Applicable Data Law includes the GDPR and all national implementing acts.
• Article means any numbered article in this DPA.
• Business Day means any day on which commercial banks in Belgium are generally open for business, other than a Saturday, Sunday, or public holiday.
• Competent Authority means any supervisory, regulatory, judicial or administrative authority competent under Applicable Data Law, including the competent data protection authority.
• DPA means this data processing agreement, including the Schedules attached hereto.
• Electronic Signature means any electronic process that is: (a) attached to or logically associated with this DPA; and (b) executed through a method that reliably identifies the signatory and records their intent to be legally bound, including qualified, advanced, or other electronic signatures within the meaning of Regulation (EU) 910/2014, or comparable methods under applicable law (including widely used e-signature platforms such as DocuSign, Connective, Adobe Sign, or similar).
• GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, as may be amended or replaced from time to time.
• Notice means any notice, request, consent, demand, or other formal communication that this DPA requires to be given as a Notice, which shall be in writing and delivered in accordance with Article 15.1 of this DPA.
• Platform has the meaning set out in consideration (A) of this DPA.
• Schedule means any document attached to this DPA that forms part of it, whether titled as a schedule, annex, appendix, or otherwise.
• Services means all services, functions, responsibilities and outputs of Processor provided in relation to the Platform.
• Sub-Processor means any third party engaged by the Processor who processes Personal Data on behalf of the Controller.

2. Scope of processing

The Processor shall process Personal Data as necessary for the performance of the Services and in accordance with this DPA, unless the Processor is required by Applicable Data Law to process Personal Data beyond the Controller's instructions. The Processing will cover the categories of Data Subjects, categories of Personal Data, and purposes set out in Schedule 1.

This DPA constitutes the Controller's complete and final instructions to the Processor regarding the Processing of Personal Data. Any additional or alternative instructions shall require the prior written agreement of both Parties and shall be commercially reasonable and technically feasible. The Processor shall be entitled to suspend execution of any instruction that it reasonably believes infringes Applicable Data Law, until the Controller modifies or withdraws such instruction.

The Controller hereby explicitly instructs the Processor, for the purposes of performing the Services, to disclose and make available Personal Data to payroll providers, social secretariats and similar service providers designated by the Controller, insofar as such disclosure is necessary for the execution of the Services and in accordance with this DPA.

3. Obligations of the Controller

The Controller shall:

• comply with all Applicable Data Law in relation to the Processing of Personal Data under this DPA;
• be solely responsible for determining the purposes and means of the Processing of Personal Data, including identifying a valid legal basis under Applicable Data Law and, where required, obtaining any necessary consents, notices, or authorizations from Data Subjects or third parties;
• ensure that any Personal Data provided to the Processor are accurate, complete, up to date and adequate for the intended Processing, and promptly notify the Processor of any relevant changes or inaccuracies; and
• implement and maintain appropriate technical and organizational measures for the protection of Personal Data in respect of all components, systems and credentials under its control, including user workstations, data transfer mechanisms, and access credentials.

4. Obligations of the Processor

As long as Personal Data is processed by the Processor in relation to the Platform, the Processor shall:

• process Personal Data only on documented instructions from the Controller, unless required to do so by Applicable Data Law. Where such law prevents prior notice, the Processor shall inform the Controller as soon as legally permitted;
• not process Personal Data for its own purposes;
• ensure that persons authorized to process Personal Data are subject to confidentiality obligations under contract, policy, or law;
• implement and maintain technical and organizational measures as described in Article 9 of this DPA;
• provide reasonable assistance to the Controller as further detailed in Article 5 of this DPA in fulfilling the Controller's obligations under Applicable Data Law, insofar as this is possible and taking into account the nature of the Processing and the information available to the Processor; and
• make available to the Controller information reasonably necessary to demonstrate compliance with this DPA and Applicable Data Law.

5. Assistance to the Controller

5.1 Data Subjects' rights

The Controller shall be solely responsible for enabling Data Subjects to exercise their rights under Applicable Data Law. If a Data Subject contacts the Processor directly, the Processor shall, within a reasonable period, inform the Controller of the request and redirect the Data Subject to the Controller, unless expressly and reasonably otherwise instructed by the Controller or required by Applicable Data Law. The Processor shall not be required to take further action unless agreed in writing, but shall provide reasonable cooperation insofar as this is possible and taking into account the nature of the processing and the information available to the Processor.

5.2 Cooperation with assessments and DPIAs

The Processor shall provide reasonable assistance to the Controller, insofar as this is possible and taking into account the nature of the processing and the information available to the Processor, with data protection impact assessments and consultations with Competent Authorities that are required under Applicable Data Law in connection with the processing carried out under this DPA, subject always to reimbursement of the Processor's reasonable costs.

5.3 Notices of Competent Authority requests

Unless prohibited under Applicable Data Law, the Processor shall inform the Controller without undue delay if it or any Sub-Processor: (a) receives an inquiry, subpoena, inspection request, or audit demand from a Competent Authority relating to the Processing; (b) is required to disclose Personal Data to a Competent Authority outside the scope of the Services; or (c) receives an instruction that the Processor reasonably believes infringes Applicable Data Law.

The Processor shall provide such cooperation as is reasonably required, taking into account the nature of the Processing and the information available to the Processor, to enable the Controller to comply with its statutory obligations, subject always to reimbursement of the Processor's reasonable costs, except where the relevant request or investigation results directly from a fault or negligence of the Processor.

6. Disclosure

The Processor shall not disclose Personal Data to any third party, public authority, or other recipient except: (a) on the documented instructions of the Controller; (b) to authorized Sub-Processors in accordance with Article 7 of this DPA; or (c) where required by Applicable Data Law, provided that, where legally permitted, the Processor shall use reasonable efforts to inform the Controller in advance.

The Processor shall ensure that any person acting under its authority who has access to Personal Data: (a) is bound by appropriate confidentiality obligations under contract, policy, or law; and (b) accesses Personal Data only where necessary for the performance of their duties.

7. Use of Sub-Processors

The Controller acknowledges and agrees to the Sub-Processors listed in Schedule 2. The Processor may engage additional or replacement Sub-Processors to support the provision of the Services, provided that the Processor informs the Controller. The Processor shall publish all relevant information relating to its Sub-Processors on https://trust.peepel.io/. The Controller may object to a new Sub-Processor on reasonable grounds based on compliance with Applicable Data Law by providing written Notice within thirty (30) days of receiving the Processor's information. If the Controller does not object within that period, the Sub-Processor shall be deemed approved. If the Controller does object, the Processor will use reasonable efforts to make available a reasonable alternative. If no alternative is available, either Party may terminate the affected Services by written Notice.

The Processor shall ensure that each Sub-Processor is bound by written obligations providing a level of protection for Personal Data not less than that required under Applicable Data Law. The Processor shall use reasonable efforts to ensure compliance by its Sub-Processors.

The Processor shall make available to the Controller an up-to-date list of contracted Sub-Processors, either upon written request or by publication on a designated website or portal.

8. Location of processing

The Processor may process and store Personal Data within the European Economic Area (EEA) and, where required for the provision of the Services, in other jurisdictions, provided that such processing complies with Applicable Data Law.

Where the Processing of Personal Data involves a transfer outside the EEA, the Processor shall implement and rely on an appropriate transfer mechanism recognized under Applicable Data Law and shall inform the Controller of the transfer and the mechanism relied upon. The Controller shall be deemed to have approved such transfers provided a valid mechanism is in place. The Controller remains solely responsible for determining whether any transfer impact assessment or supplementary measures are required in connection with such transfer. The Processor shall provide reasonable cooperation and assistance in this regard, limited to the information in its possession. For clarity, the Processor shall not be responsible for the legal sufficiency of any transfer mechanism mandated or adopted under Applicable Data Law.

If the Processor becomes aware that a transfer mechanism relied upon is no longer valid or effective, it shall inform the Controller. The Processor may continue the relevant transfer for as long as permitted under Applicable Data Law and shall not be obliged to suspend processing unless and until the Controller provides alternative lawful instructions.

9. Technical and organizational measures

The Processor shall implement and maintain appropriate technical and organizational measures designed to protect Personal Data against accidental, unauthorized or unlawful access, disclosure, alteration, loss or destruction, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing. Such measures may include, where appropriate, encryption, access controls, backup and recovery procedures, and regular testing and evaluation.

Upon receiving Notice from the Controller, the Processor shall, within a reasonable period, provide a general description of its technical and organizational measures sufficient to demonstrate compliance with Applicable Data Law. The Processor may fulfill this obligation by providing, where available, relevant third-party certifications, audit reports, or equivalent documentation. Adherence to an approved code of conduct under article 40 GDPR or to an approved certification mechanism under article 42 GDPR may also serve as evidence of sufficient guarantees under this Article 9. Any cooperation beyond the scope of this Article 9 shall remain subject to confidentiality and security restrictions and to reimbursement of the Processor's reasonable costs.

10. Personal Data Breaches

In the event of a known or reasonably suspected Personal Data Breach, the Processor shall inform the Controller without undue delay and in any event within forty-eight (48) hours of becoming aware. At such time, the Processor shall communicate the information then available to it.

The Processor shall inform the Controller as further information is obtained, and shall cooperate with the Controller to investigate the Personal Data Breach, take appropriate steps to mitigate its adverse effects, and assist with any notifications to Competent Authorities or Data Subjects as required by Applicable Data Law.

11. Audit rights

The Processor shall make available to the Controller, upon written request, information reasonably necessary to demonstrate compliance with this DPA and Applicable Data Law. Where available, the Processor may satisfy this obligation by providing up-to-date third-party audit or certification reports (such as ISO, SOC, or equivalent), which the Controller agrees shall be sufficient to discharge this obligation.

The Controller may carry out an audit (including inspections) only where the information provided under Article 11.1 of this DPA is not reasonably sufficient to demonstrate compliance. Any such audit shall: (a) be conducted no more than once in any twelve (12) month period; (b) be subject to at least thirty (30) days' prior Notice; (c) take place during normal business hours; and (d) be strictly limited to documents and systems relevant to the processing of Personal Data under this DPA.

Each Party shall bear its own costs in connection with any audit. Any additional cooperation or resources required from the Processor beyond providing existing information or reports shall be subject to reimbursement of the Processor's reasonable costs.

12. Liability

Each Party shall be liable for breaches of its own obligations under this DPA and Applicable Data Law. The Processor shall not be liable for: (a) fines or penalties imposed directly on the Controller, unless and to the extent such fines or penalties result from the Processor's own breach of this DPA or Applicable Data Law; (b) indirect, consequential, punitive or exemplary damages; or (c) losses arising from the Controller's own failure to comply with Applicable Data Law or to give lawful instructions.

To the fullest extent permitted under applicable law, the Processor shall not be liable for any indirect, incidental, consequential, special, or reliance damages ("indirecte schade"), however caused and under any theory of liability. This includes loss of revenue, loss of profits, loss of anticipated savings, loss of business or goods, loss of goodwill, reputational harm, opportunity loss, loss or corruption of data or other information, and the cost of procuring substitute goods or services.

Except in cases of willful misconduct or bodily injury each Party's aggregate liability for damages under this Agreement, regardless of the legal basis (including contract, statute, equity, tort, or negligence), shall not exceed one hundred percent (100%) of the amounts paid by the Controller for its use of the Platform in the twelve (12) months preceding the event giving rise to the claim.

The Parties expressly exclude the application of article 6.3, §§1 and 2 of the Belgian Civil Code. Accordingly, extracontractual liability between the Parties, and their agents, subcontractors, directors, employees, principals or other representatives, shall be excluded for any claims arising out of or in connection with the performance of this Agreement.

13. Deletion and return of Personal Data

The Processor shall retain Personal Data only for as long as necessary to perform the Services or as required by Applicable Data Law. Upon termination of the Controller's use of the Platform, the Processor shall, at the Controller's choice and within a reasonable period and subject to its technical capabilities: (a) make available for download to the Controller a copy of the Personal Data in a commonly used format; or (b) securely delete the Personal Data, except to the extent retention is required by Applicable Data Law. Where Applicable Data Law requires continued storage, the Processor shall notify the Controller (unless legally prohibited) and shall ensure such Personal Data is kept securely and not processed for any other purpose.

Any additional data export, migration, or assistance requested by the Controller shall be subject to the Processor's standard professional services terms and the reimbursement of its reasonable costs.

14. Term and termination

This DPA shall enter into force upon the effective date of the applicable Principal Agreement and shall remain in force for as long as Peepel processes Personal Data on behalf of the Controller. Termination of the Controller's use of the Platform shall automatically result in termination of this DPA, except to the extent the Processor continues to process Personal Data on behalf of the Controller, in which case this DPA shall remain in force until such processing ceases and the Processor has complied with its obligations under Article 13 of this DPA.

Each Party may terminate this DPA, or the affected part of the Services, with immediate effect by Notice to the other Party if that other Party is in material breach of this DPA and fails to remedy such breach within a reasonable period (not less than thirty (30) days) of receiving Notice thereof. Where the Processor is unable to comply with Applicable Data Law due to the invalidation or ineffectiveness of a transfer mechanism under Article 8 of this DPA, the Controller may only terminate if the Processor has not implemented a suitable alternative transfer mechanism within sixty (60) days of becoming aware of such invalidation or ineffectiveness.

The provisions of this DPA that are expressly stated to survive, or that by their nature should reasonably survive termination or expiry, will remain in effect. This includes Articles 6, 12, 14, and 15 of this DPA.

15. Miscellaneous

Notices. Notices under this DPA shall be sent to the contact details specified in the applicable Principal Agreement or as otherwise communicated by a Party in writing.

Amendment. This DPA may be amended or modified only by a written document, excluding email, signed by duly authorized representatives of all Parties. Signature by means of an Electronic Signature is permitted. Any unilateral attempt by a Party to amend, supplement, or override this DPA, whether by Notice, conduct, or otherwise, shall have no legal effect and shall be deemed rejected in advance.

Validity and severability. If any provision of this DPA, or any part of it, is found to be invalid, illegal, or unenforceable, that provision or part will be interpreted in a way that keeps it valid and enforceable under applicable law. If it would still exceed what applicable law allows, the provision or part will apply only to the extent permitted. If it remains invalid, illegal, or unenforceable even after that adjustment, it will be limited or severed to the extent necessary, without affecting the rest of this DPA or the unaffected portion of that provision. The Parties shall replace any invalid provision with one that reflects its intent and purpose as closely as possible. The deciding court may make that substitution.

Assignment. Neither Party may assign or transfer any of its rights or obligations under this DPA without the prior written consent of the other Party. By way of exception: (a) the Processor may delegate processing obligations to authorized Sub-Processors in accordance with Article 7 of this DPA; and (b) the Processor may assign this DPA to a successor in interest including by merger, reorganization or sale of business, or may assign this DPA to any of its affiliates, in each case provided that the assignee assumes the Processor's obligations under this DPA in full.

Governing law and jurisdiction. This DPA is governed by and shall be construed in accordance with the laws of Belgium, excluding its conflict of law rules. Any dispute arising out of or in connection with this DPA is subject to the exclusive jurisdiction of the courts of Ghent, Belgium. Each Party irrevocably waives any objection to the jurisdiction of these courts.

Schedule 1 - Details of the processing

Schedule 2 - List of current Sub-Processors

Available via https://trust.peepel.io/.