Horapod Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Horapod Terms of Service between Primo Postura Services ("Horapod," "we") and the company that uses Horapod ("Customer," "you"). It applies when Horapod processes personal information about the Customer's workers on the Customer's behalf.

1. Roles

The Customer is the controller of its work records. Horapod is the Customer's processor (or "service provider" under California law). Horapod is responsible for its own account, billing, and website information, as explained in the Privacy Policy.

2. What is processed

• Purpose: providing Horapod to the Customer (time tracking, activity, screenshots, photos, location, reports, alerts, and optional AI features).
• People: the Customer's workers, invitees, and team members.
• Information: as listed in the Privacy Policy and on What we track, depending on the Customer's plan and settings.
• Duration: while the Customer uses Horapod, and as described in section 10.

3. Customer instructions

Horapod processes work records only on the Customer's documented instructions, which are this DPA, the Terms, and the Customer's settings in Horapod, unless the law requires otherwise. If so, Horapod will tell the Customer before processing unless the law prohibits it. Horapod will inform the Customer if it believes an instruction breaks data protection law.

Horapod does not sell or share work records, use them for its own purposes, combine them with other information except to provide the service, or keep or use them outside its business relationship with the Customer.

4. Customer responsibilities

The Customer decides what is tracked and is responsible for having a lawful basis for it, informing its workers as required by local law, carrying out any required impact assessment, and making sure its use of Horapod is lawful where its workers are located.

5. Confidentiality

Anyone authorised by Horapod to process work records is bound by confidentiality.

6. Security

Horapod uses appropriate technical and organisational measures to protect work records, as summarised in Annex 2.

7. Sub-processors

The Customer gives general authorisation for Horapod to use the sub-processors in Annex 1. Horapod will notify the Customer's account owner by email at least 14 days before adding or replacing a sub-processor. The Customer may object before the change takes effect; if the parties cannot resolve the objection, the Customer may close its account. Horapod puts data protection terms in place with each sub-processor that are consistent with this DPA, and remains responsible to the Customer for its sub-processors.

8. Assistance

Taking into account the nature of the processing and the information available to it, Horapod will help the Customer to:

• respond to requests from workers exercising their rights;
• meet its obligations on security, breach notification, impact assessments, and consultations with authorities.

9. Personal data breaches

Horapod will notify the Customer without undue delay after becoming aware of a personal data breach affecting work records, with the information available to it.

10. End of service

At the end of the service, the Customer chooses whether Horapod returns its work records (by export through the available tools or, on request, by other reasonable means) or deletes them. Horapod then deletes the remaining work records, unless the law requires them to be kept. Copies in backups or provider logs expire on their normal cycles.

11. Information and audits

Horapod will make available the information reasonably needed to show compliance with this DPA and will allow and contribute to audits, including inspections, by the Customer or an auditor it appoints, on reasonable notice and subject to confidentiality.

12. International transfers

Horapod operates from the Philippines and uses providers in other countries (Annex 1). Where the GDPR or UK GDPR applies to the Customer's work records and no other transfer mechanism applies, the Standard Contractual Clauses approved by European Commission Decision (EU) 2021/914 ("SCCs") are incorporated into this DPA, completed as follows:

• Module: Module Two (controller to processor), with the Customer as data exporter and Horapod as data importer.
• Clause 7 (docking clause): does not apply.
• Clause 9(a): Option 2, general written authorisation; the time period is at least 14 days in advance, as set out in section 7 of this DPA.
• Clause 11(a): the optional language does not apply.
• Clause 13: the competent supervisory authority is the one determined under Clause 13(a) for the data exporter.
• Clauses 17 and 18: the law and courts of Ireland.
• Annex I.A (parties): the Customer (exporter, controller) and Primo Postura Services, Philippines (importer, processor). Before relying on the SCCs or the UK Addendum, the parties complete a Party Details annex (each party's full name, address, contact person, and role), exchanged privately by email at hello@horapod.com. That annex forms part of this DPA and is not published.
• Annex I.B (description): as set out in section 2 of this DPA; transfers are continuous while the service is used; retention as described in the Privacy Policy and section 10.
• Annex II (security): Annex 2 of this DPA.
• Annex III (sub-processors): Annex 1 of this DPA.

For transfers subject to UK GDPR, the UK International Data Transfer Addendum (version B1.0) applies, with Tables 1 to 3 completed with the information above, and for Table 4 neither party may end the Addendum when it changes.

13. Changes

Horapod will notify the Customer's account owner by email of changes to this DPA before they apply.

14. Precedence

If this DPA conflicts with the Terms, this DPA applies to the processing of work records.

Annex 1: Sub-processors

• Supabase: Database and sign-in. Singapore.
• Cloudflare: Web app hosting, file storage (screenshots, photos, logos), website. Global network.
• Resend: Email delivery (reports, notices). United States.
• Anthropic: Optional AI daily summaries and weekly briefing. United States.
• Google: Sign-in, only for users who choose Google sign-in. Global.

The payment provider acts as merchant of record and processes payment information under its own terms, not as Horapod's sub-processor.

Annex 2: Security summary

• Encryption of data in transit.
• Access to work records limited by account and role.
• Server credentials kept on the server, not in the apps.
• Screenshots, photos, and location deleted on fixed schedules.
• Confidentiality for anyone with access.