Data Processing Addendum

How this addendum works

This Data Processing Addendum ("addendum") is between Purple Willow Consulting, LLC ("we", "us") and the customer organization whose users use Willow Workbench ("you"). It forms part of the Terms of Service and takes effect when your organization's users accept them.

If your organization needs a signed copy, email [email protected] and we'll countersign this addendum as it stands on that date. Where this addendum and the Terms of Service disagree about the processing of Customer Data, this addendum wins.

Definitions

• Customer Data means data your users bring to the service: SDM exports and other files they upload, configuration and employee records fetched from the UKG environments they connect, the results the tools produce from them, and the UKG credentials they save.
• Personal Data means Customer Data about an identified or identifiable person.
• Data Protection Law means the data protection and privacy laws that apply to the processing of Customer Data.
• Sub-processor means a provider we engage that processes Customer Data for us.
• Security Incident means a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Data.

Roles

For Customer Data, you are the controller, or a processor acting for your own clients, and we are your processor, or sub-processor. You're responsible for having a lawful basis and any authorization needed from your clients to connect each UKG environment and upload each file.

We are the controller of your users' account details, billing details, usage log and server logs, which we handle as described in the Privacy Policy. They are outside this addendum.

Details of the processing

Our commitments

• We process Customer Data only on your documented instructions, which are the Terms of Service, this addendum and your users' actions in the service, unless the law requires otherwise. If we think an instruction breaks Data Protection Law, we'll tell you.
• Only people who need access to run and support the service can reach Customer Data, and each is bound by confidentiality.
• We don't sell Customer Data, use it to train models or build products, or use it for marketing.
• We don't keep copies of uploaded files or UKG data, only the results a tool shows your users, encrypted for at most 24 hours. No tool keeps a real employee's name, contact details, pay or manager; the most it keeps is their person number. The exceptions are the changed copy of your users' own file that a file utility hands back, API Probe, which only our administrators can use, and Pay Policy Analysis's usage check, which also keeps the shifts people worked on work rule transfers, each with the person number, date, punch in and punch out times, total hours and the hours (or money amount) of each pay code it paid. Assignment Analysis anonymizes employee records as they arrive, and the key behind the codes is destroyed when the pull finishes.
• If a government or other third party asks us for Customer Data, we'll check the request is valid, direct it to you where we can, and tell you before disclosing anything unless the law forbids it.

Security

We keep technical and organizational measures in place that are appropriate to the risk, and won't reduce their overall level during your subscription. They include:

• Encryption in transit: the site is served only over HTTPS, and tools connect to UKG only over HTTPS.
• Encryption at rest: UKG passwords, client secrets and organization values are encrypted with AES-256-GCM using a key unique to each user, derived from a master key kept outside the database. The database and its backups are encrypted.
• Access control: invitation-only accounts, required two-factor authentication, account lockout and rate-limited sign-in, sessions that end after 15 minutes without activity, and roles that limit each user to their organization's tools and their own UKG environments.
• Minimal data: client data is processed, not kept; uploads waiting for a tool are encrypted and deleted once read, and results, on screen or downloadable, are discarded within 24 hours.
• Operations: security updates and dependency alerts, daily encrypted backups kept off the server, server logs kept for 90 days, written security policies reviewed every year, and an incident response plan.

The Trust and Security page describes these measures in more detail.

Sub-processors

You authorize us to use these sub-processors:

UKG is your own provider: the tools reach your UKG environments under your users' credentials. Stripe handles only billing details, never Customer Data. Our help desk and the application itself run on infrastructure we operate.

Each sub-processor is bound by written terms that protect Customer Data at least as well as this addendum, and we remain responsible for its work. We'll email your administrators at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we can't resolve it, you may end your subscription and we'll refund any fees paid for the time after it ends.

Helping you

• If someone asks us to access, correct or delete their Personal Data in Customer Data, we'll pass the request to you and won't answer it ourselves unless you ask us to.
• We'll give reasonable help with your own responses to such requests, data protection impact assessments and questions from regulators, using the information we have.

Security incidents

If we confirm a Security Incident affecting your Customer Data, we'll tell your administrators without undue delay, and within 72 hours. We'll say what happened, what data is involved, what we're doing about it and what you should do, and keep you updated until it's closed. We'll help you meet any duty you have to notify regulators or the people affected. Telling you about an incident isn't an admission of fault.

Deletion

• Uploaded files are deleted as soon as a tool reads them, data fetched from UKG is kept only in the results a tool shows, and results, on screen or downloadable, are discarded within 24 hours.
• A UKG environment and its saved credentials are deleted when its owner deletes it or their account is removed.
• When your organization's agreement ends, we delete any remaining Customer Data within 30 days.
• Encrypted backups are kept for up to 12 months, so deleted data can remain in them until they expire. We don't restore it except to recover the service.

Information and audits

On request, we'll give you the information you reasonably need to check that we meet this addendum, including our completed security questionnaire and a summary of our security policies, and answer your security questionnaire once a year. If that isn't enough to meet a requirement of Data Protection Law, or after a Security Incident, you may audit us at your own cost, on at least 30 days' notice, during business hours, and under confidentiality.

Information and audits cover how we protect and handle Customer Data, including what each tool reads, keeps, sends and changes. They don't extend to our source code or how the tools work out their results, which are our trade secrets. Where checking a commitment in this addendum needs more, we'll show it in a way that protects them, such as a walkthrough rather than a copy. What we share for them is our confidential information under the Terms of Service.

Data location

Customer Data is processed and stored in the United States, and reaches us through Cloudflare's global network. We'll tell you before that changes. If Data Protection Law requires a transfer mechanism for data you bring, such as the EU Standard Contractual Clauses, contact us and we'll work with you to put one in place.

General

This addendum lasts as long as we process Customer Data for you. The limitation of liability and governing law sections of the Terms of Service apply to it. We may update it as the service or the law changes, in the same way as the Terms of Service, and won't reduce the protection it gives Customer Data during a paid period.