Data Processing Addendum

Effective date

Effective with the agreement incorporating it

1. Parties, scope and precedence

This Data Processing Addendum forms part of the Clockneo Terms of Service between Panivon Ltd, company number 17399934, registered in England and Wales, of 426 Stockfield Road, Yardley, Birmingham, B25 8JJ, England, and the UK business recorded at acceptance.

It is a binding written agreement, including where accepted electronically.

“Customer Personal Data” means personal data Panivon processes on the customer’s behalf in providing Clockneo. The customer is the controller and Panivon is the processor for that processing.

“Data Protection Law” means the UK GDPR, the Data Protection Act 2018 and other applicable UK data-protection legislation, as amended.

This DPA prevails over conflicting provisions of the agreement concerning Customer Personal Data. Mandatory transfer instruments prevail to the extent their terms require.

The DPA does not turn genuinely independent controller activities into processor activities. Panivon’s separate controller processing is described in its Privacy Notice.

2. Customer rights, obligations and instructions

The customer determines the purposes of its workforce processing and must ensure its instructions, collection, disclosures and use are lawful.

The customer is entitled to give documented instructions, obtain the assistance and information described here, object to subprocessor changes, conduct audits and choose return or deletion.

The customer’s instructions comprise this agreement, the agreed service configuration and scope, and subsequent instructions from an authorised customer contact.

Panivon will process Customer Personal Data only on those documented instructions, including instructions concerning transfers outside the UK, unless domestic law requires different processing. In that case, Panivon will tell the customer about the legal requirement before processing unless the law prohibits that information on important public-interest grounds.

Panivon will immediately inform the customer if, in its opinion, an instruction infringes Data Protection Law. It may pause the affected processing while the parties clarify a lawful instruction.

Panivon will not use Customer Personal Data for advertising, sale, unrelated profiling or training general-purpose AI models.

3. Authorised personnel and confidentiality

Panivon will allow access only to people who need it for an authorised purpose.

People authorised to process Customer Personal Data must be bound by appropriate contractual confidentiality commitments or a statutory duty of confidentiality.

Panivon will maintain appropriate access approval, review and removal arrangements.

4. Security

Panivon will implement and maintain the technical and organisational measures required by Article 32, taking account of the state of the art, implementation costs, the nature, scope, context and purposes of processing, and risks to people.

The baseline measures are described in Annex 2.

Panivon may update those measures to maintain or improve protection. It will not materially reduce the overall protection of Customer Personal Data without first addressing the resulting contractual and legal requirements.

5. Subprocessors

The customer gives general written authorisation for the subprocessors applicable to its enabled services in the Subprocessor Schedule. Panivon will impose the same data-protection obligations required by Article 28, obtain sufficient guarantees, and remain responsible for their performance as required by law.

Panivon will give the customer’s nominated privacy contact at least 14 days’ notice by email before a new or replacement subprocessor begins processing Customer Personal Data. The notice will identify the provider, the purpose, the data concerned and the processing locations. Panivon will update the Subprocessor Schedule at the same time.

The customer may object on reasonable data-protection grounds during the notice period. Panivon will consider the objection in good faith and, where practicable, will not use the new subprocessor for the customer’s data while the objection is being discussed. If the parties cannot resolve it, the customer may terminate the affected service by written notice and receive a refund of prepaid fees for the period after termination.

Where an urgent replacement is needed to protect the security or continuity of the service, Panivon may give shorter notice. It will notify the customer as soon as practicable, and the customer has the same right to object and terminate.

A subprocessor’s changes to its own providers are governed by its terms with Panivon. Panivon will tell the customer about such a change where it materially affects the protection of Customer Personal Data.

6. International transfers

Panivon will make a restricted transfer of Customer Personal Data only on documented instructions and where a lawful transfer arrangement applies.

For the enabled services, the customer instructs the transfers specifically described in the completed Subprocessor Schedule. That instruction is not a waiver of the transfer requirements.

Where required, Panivon will put in place the applicable UK adequacy route, UK International Data Transfer Agreement or UK Addendum to the Standard Contractual Clauses, complete the required assessment and apply appropriate supplementary measures.

Panivon will provide relevant transfer information on request. It will notify the customer of a material change affecting the lawfulness or protection of an instructed transfer and suspend the affected transfer if a lawful arrangement is no longer available.

7. Assistance with individual rights

Taking account of the nature of the processing, Panivon will assist the customer through appropriate technical and organisational measures, insofar as possible, to fulfil its obligations concerning individual rights under Chapter III of the UK GDPR.

Panivon will promptly forward a request concerning Customer Personal Data to the customer. It will not disclose, correct or delete that data in response without the customer’s instruction unless legally required.

Panivon may acknowledge a request, seek proportionate identifying information and explain the customer’s role without prejudicing the person’s rights.

8. Security, DPIAs and regulator assistance

Taking account of the nature of processing and information available to it, Panivon will assist the customer with compliance under Articles 32–36, including:

• security assessments;
• breach investigation and notification;
• information for affected individuals;
• data-protection impact assessments; and
• prior consultation with the regulator.

Panivon will provide relevant information about its service and providers. The customer remains responsible for the necessity, proportionality and lawful basis of its particular employment-monitoring deployment.

9. Personal-data breaches

Panivon will notify the customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data.

The notification will provide, so far as known:

• the nature of the breach;
• affected categories and approximate numbers of individuals and records;
• a contact for further information;
• likely consequences; and
• measures taken or proposed to address the breach and reduce harm.

Information may be supplied in phases without undue further delay.

Panivon will take appropriate containment and remediation steps, preserve relevant evidence and cooperate with the customer.

The customer makes its own controller notification decisions. Panivon’s notification is not delayed until the customer’s regulatory deadline or until an investigation is complete.

10. Return, deletion and copies

At the customer’s choice, Panivon will return Customer Personal Data and delete its copies, or delete it without return, after processing services end.

The customer’s initial instruction is to allow the 30-day exit period in the Terms and then delete, unless the customer gives a different lawful instruction.

Panivon will begin deletion from active systems promptly after a verified deletion instruction or the end of the exit period and complete it without undue delay. If Panivon expects it to take longer than 30 days, it will tell the customer the reason and the expected completion date. Panivon will also delete, or instruct relevant subprocessors to delete, the related data they hold, and track completion.

Removal from recovery copies works as follows:

• the database provider’s rolling recovery history for the production database, currently six hours, expires automatically on that cycle;
• manual database snapshots and branch copies made for maintenance or recovery do not expire automatically. Panivon records their purpose, restricts access, deletes them when they are no longer needed for that purpose and identifies in the completion statement any copy that still contains the customer’s data; and
• other subprocessors’ backups and logs expire under their own arrangements.

Recovery copies will not be used for another purpose. Valid deletion instructions will be reapplied before restored data returns to ordinary operation.

Panivon may retain Customer Personal Data where domestic law requires its storage. It will identify the requirement and scope to the customer unless prohibited, restrict the retained data to that purpose and delete it when the requirement ends.

A general reference to disputes, security, provider convenience or possible future claims does not authorise indefinite retention of Customer Personal Data.

Any separate controller record retained by Panivon must have its own lawful purpose, minimum necessary content and retention rule. Reclassifying a workforce database as a controller record is not permitted.

Panivon will provide a scoped completion statement identifying active deletion, provider actions, recovery copies that still contain the data and when they are expected to be removed, and any lawful exception.

11. Compliance information and audits

Panivon will make available all information necessary to demonstrate compliance with Article 28 and will allow for and contribute to audits, including inspections, conducted by the customer or an auditor it appoints.

The parties will normally begin with relevant documentation, written questions and remote review to avoid unnecessary disruption. That sequence does not remove inspection rights or require the customer first to prove a material concern.

Audits must use reasonable confidentiality, security and tenant-protection arrangements. Notice, scope and timing will be agreed reasonably, with shorter notice where an incident, regulator or other urgent circumstance requires it.

Panivon will not use confidentiality, fees, frequency limits or administrative conditions to prevent a legally required audit. The customer is not entitled to unrelated customer information, credentials or security secrets; appropriate controlled evidence will be provided instead.

Each party ordinarily bears its own audit costs. Any charge for exceptional assistance beyond legal and contractual obligations must be agreed beforehand and must not delay mandatory assistance.

12. Duration and liability

This DPA continues for as long as Panivon or its subprocessors retain Customer Personal Data.

Terms clause 17 applies to claims between the parties only to the extent lawful. Its higher confidentiality and data-protection limit applies to Panivon’s liability to the customer for breaches of this DPA. It does not reduce mandatory processor obligations, subprocessor responsibility, individuals’ rights or regulatory powers, or limit any statutory right of contribution under Article 82(5) of the UK GDPR to the extent that right cannot lawfully be limited. Mandatory data-transfer instruments prevail where their terms require.

Annex 1 — Processing details

Annex 2 — Security measures

Panivon will maintain:

• organisation and role-based access restrictions, including appropriate site scope;
• protected authentication, employee PIN and kiosk credentials;
• encrypted transport and applicable provider storage protections;
• controlled privileged access and separation of ordinary application access from database administration;
• logging and review appropriate to security and accountability;
• secure development, change review and proportionate testing;
• backup and recovery arrangements whose scope and retention are recorded;
• incident identification, escalation and response procedures;
• authorised export, deletion and provider-propagation procedures; and
• periodic review of permissions, subprocessors and material risks.

No certification, penetration-test result, recovery-time guarantee or particular encryption-at-rest implementation is represented unless separately evidenced.