Data Processing Agreement

Governing At Heart B.V.'s processing of Employee Data on behalf of the Customer, forming part of the Agreement.

At Heart B.V. · Rodezand 80, 3011 AN Rotterdam, Netherlands

Version 1.0 · Last updated: May 13, 2026 · [email protected]

1. Introduction & Incorporation

This Data Processing Agreement (“DPA”) forms part of and is incorporated into the Agreement between At Heart B.V. (“At Heart”) and the Customer. It applies automatically from the date the Customer accepts the Terms of Service, executes an Order Form, or otherwise begins using the Service, whichever occurs earliest, and governs At Heart's processing of Employee Data on the Customer's behalf.

This DPA is intended to satisfy the requirements of Article 28(3) GDPR (and equivalent provisions of the UK GDPR) for a binding written agreement between a controller and a processor. In the event of any conflict between this DPA and the Terms of Service regarding the processing of Employee Data, this DPA prevails.

2. Definitions

The following terms have the meanings set out below. Capitalized terms not defined here have the meaning given in the Terms of Service.

3. Roles of the Parties

1. In relation to Employee Data, the Customer is the Controller and At Heart is the Processor, within the meaning of the GDPR.
2. The Customer is solely responsible for determining the legal basis on which Employee Data is processed, for the accuracy and legality of Employee Data submitted to the Service, and for informing Data Subjects in accordance with Articles 13 - 14 GDPR.
3. At Heart processes Employee Data only as a Processor and only on the Customer's documented instructions, unless required to do otherwise by Union or Member State law or, for Customers whose Employee Data is hosted in the United States region, United States federal or state law, to which At Heart is subject. In that case At Heart will inform the Customer of that legal requirement before processing, unless that law prohibits this on important grounds of public interest.
4. Where Employee Data includes personal information of California residents, At Heart acts as a "service provider" within the meaning of the California Consumer Privacy Act (CCPA). At Heart shall process such personal information only for the business purpose of providing the Service, shall not sell or share it, shall not retain, use, or disclose it outside the direct business relationship with the Customer except as permitted by the CCPA, and shall not combine it with personal information from other sources except as permitted by the CCPA. At Heart certifies that it understands these restrictions and will comply with them. At Heart shall notify the Customer if it determines that it can no longer meet its obligations under the CCPA. The Customer may, upon notice, take reasonable and appropriate steps to stop and remediate any unauthorized use of personal information by At Heart.

4. Subject Matter, Duration, Nature & Purpose

The subject matter, duration, nature and purpose of processing, the categories of Data Subjects, and the categories of Employee Data are set out in Annex 1 (Details of Processing).

5. Customer's Instructions

1. At Heart shall process Employee Data only on the documented instructions of the Customer, including with regard to transfers of Employee Data to a third country, unless required to do otherwise by Union or Member State law or, for Customers whose Employee Data is hosted in the United States region, United States federal or state law, to which At Heart is subject.
2. The Customer's instructions are set out in the Agreement, the Customer's configuration of the Service, and any additional written instructions given by the Customer from time to time.
3. At Heart shall promptly inform the Customer if, in its opinion, an instruction infringes the GDPR or other applicable Data Protection Laws.

6. Confidentiality

At Heart shall ensure that persons authorized to process Employee Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and process Employee Data only to the extent necessary to provide the Service.

7. Security of Processing

Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk to the rights and freedoms of Data Subjects, At Heart shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as set out in Annex 3 (Security Measures).

At Heart may update the security measures from time to time, provided that such updates do not materially decrease the overall level of security.

8. Sub-processing

1. The Customer provides general written authorization for At Heart to engage Sub-processors to assist in providing the Service, subject to the conditions in this Section 8. The current list of Sub-processors is set out in Annex 2 (Sub-processors).
2. At Heart shall impose data protection obligations on any Sub-processor that are substantially the same as those set out in this DPA, in particular providing sufficient guarantees to implement appropriate technical and organizational measures.
3. At Heart shall inform the Customer of any intended addition or replacement of a Sub-processor at least 14 days in advance, by updating Annex 2 and notifying the Customer by email or through the Service, giving the Customer the opportunity to object on reasonable data protection grounds within that period.
4. If the Customer objects and the parties cannot resolve the objection within a reasonable time, the Customer may terminate the affected part of the Service without penalty, as its sole and exclusive remedy.
5. At Heart remains fully liable to the Customer for the performance of a Sub-processor's obligations under this DPA.
6. Customer-Enabled Integrations are not Sub-processors. Where the Customer connects a Customer-Enabled Integration, messages and other Employee Data exchanged through it are processed by the provider of that platform under the Customer's own agreement with that provider. At Heart is responsible only for its own processing of Employee Data it sends to or receives from that platform.

9. Assistance with Data Subject Rights

Taking into account the nature of the processing, At Heart shall assist the Customer, insofar as this is possible, by appropriate technical and organizational measures, in fulfilling the Customer's obligation to respond to requests from Data Subjects exercising their rights under Chapter III of the GDPR (access, rectification, erasure, restriction, portability, and objection).

If At Heart receives a request from a Data Subject relating to Employee Data, it will not respond directly (unless legally required to do so) and will instead promptly forward the request to the Customer.

At Heart shall similarly assist the Customer, insofar as this is possible, in responding to requests from Data Subjects exercising rights under the CCPA (including the rights to know, delete, correct, and opt out of the sale or sharing of personal information) or other applicable Data Protection Laws.

10. Personal Data Breach Notification

At Heart shall notify the Customer without undue delay, and in any event no later than 48 hours, after becoming aware of a Personal Data Breach affecting Employee Data. Such notification shall, to the extent then known, describe:

• The nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and records concerned;
• The likely consequences of the Personal Data Breach;
• The measures taken or proposed to address the Personal Data Breach, including measures to mitigate its possible adverse effects;
• The name and contact details of At Heart's contact point for data protection matters ([email protected]).

At Heart shall cooperate with the Customer and take reasonable steps to assist in the investigation, mitigation, and remediation of the Personal Data Breach, and, where relevant, to enable the Customer to comply with its obligations under Articles 33 and 34 GDPR. At Heart shall provide the same cooperation and assistance to enable the Customer to meet any breach notification obligations under other applicable Data Protection Laws, including applicable US state data breach notification statutes.

11. Data Protection Impact Assessments

Taking into account the nature of processing and the information available to it, At Heart shall provide reasonable assistance to the Customer with any data protection impact assessments, and prior consultations with supervisory authorities, which the Customer reasonably considers to be required under Articles 35 or 36 GDPR.

12. Audits & Information

1. At Heart shall make available to the Customer all information reasonably necessary to demonstrate compliance with the obligations set out in Article 28 GDPR and this DPA, primarily through written documentation of At Heart's technical and organizational measures and responses to reasonable security questionnaires.
2. Where such documentation does not reasonably address a specific compliance concern, At Heart shall allow for, and contribute to, an audit, including an on-site inspection, conducted by the Customer or an auditor mandated by the Customer, subject to: at least 30 days' advance notice; confidentiality obligations; execution during normal business hours, accompanied by At Heart personnel; the Customer bearing its own costs of the audit; and no more than once per 12-month period unless triggered by a Personal Data Breach or a supervisory authority requirement.
3. At Heart may satisfy the information obligations under this Section 12 by providing relevant third-party audit reports or certifications of its Sub-processors, where these reasonably address the Customer's request. Nothing in this Section limits the Customer's audit rights under Article 28(3)(h) GDPR.

13. International Data Transfers

1. Hosting regions. Employee Data of Customers established in the EEA, Switzerland or the United Kingdom is hosted in At Heart's European region (DigitalOcean AMS3, Amsterdam, the Netherlands). Employee Data of all other Customers is hosted in whichever of At Heart's two regions, the European region or its United States region (DigitalOcean ATL1, Atlanta, United States), is closest to the Customer's location. At Heart shall not move a Customer's Employee Data to another hosting region without prior written notice to the Customer.
2. Onward transfers. Certain Sub-processors listed in Annex 2 are established in, or may access Employee Data from, countries outside the EEA, Switzerland or the UK that are not subject to an adequacy decision. At Heart, as data exporter, shall ensure that any such transfer is covered by a valid transfer mechanism, being the EU-US Data Privacy Framework (including the UK Extension and the Swiss-US Data Privacy Framework) where the Sub-processor is certified, or otherwise the SCCs (Module Three, processor to processor), the UK International Data Transfer Addendum, or the SCCs as adapted for the FADP, as applicable.
3. Non-European Customers. Where At Heart, as a Processor established in the EEA, transfers Employee Data to a Customer established outside the EEA, Switzerland or the UK, the SCCs (Module Four, processor to controller) apply to that transfer as set out in Annex 4.
4. Government access requests. If At Heart receives a request from a public authority for access to Employee Data, At Heart shall, unless legally prohibited, promptly notify the Customer, assess the lawfulness of the request, challenge it where there are reasonable grounds to do so, and disclose only the minimum Employee Data required.
5. Where the SCCs apply, they take precedence over any conflicting provision of this DPA or the Agreement to the extent of the conflict.

14. Return or Deletion of Employee Data

Upon termination or expiry of the Agreement, At Heart shall, at the Customer's choice, return Employee Data to the Customer in a commonly used format or delete it. At Heart shall make Employee Data available for export for 30 days after termination, after which it shall delete or anonymize all remaining Employee Data, unless Union or Member State law requires its retention, in which case At Heart shall isolate and protect that data from further processing. Employee Data in backups is deleted in the ordinary course of At Heart's backup cycle. At Heart shall confirm deletion in writing upon the Customer's request.

15. Liability

Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service. Nothing in this DPA relieves either party of its own direct responsibilities and liabilities under the GDPR.

16. Term & Termination

This DPA takes effect on the date set out in Section 1 and remains in force for as long as At Heart processes Employee Data on behalf of the Customer, notwithstanding the termination of the Agreement, until such processing ceases in accordance with Section 14.

17. General

1. Governing law and jurisdiction are as set out in the Terms of Service.
2. This DPA may be updated where reasonably necessary to reflect changes in applicable Data Protection Laws, regulatory guidance, or the Service. Material changes will be notified in accordance with the Terms of Service.
3. If any provision of this DPA is held invalid or unenforceable, the remaining provisions remain in full force and effect.
4. Annexes 1 to 4 form an integral part of this DPA.

Annex 1 Details of Processing

1. Subject Matter. The provision of the At Heart HR software platform and associated services by At Heart to the Customer.

2. Duration and Retention. For the duration of the Subscription Term, plus the retention and deletion periods described in Section 14 of this DPA.

3. Nature & Purpose of Processing. The processing of Employee Data necessary to provide the Service, including hosting and storage, HR workflow automation, employee lifecycle management, importing directory and profile data from Customer-Enabled Integrations, sending and receiving messages and notifications to and from personnel through Customer-Enabled Integrations, AI Features enabled by the Customer (including logging of AI queries and responses within the Customer's account), recording and transcription of performance review conversations where enabled by the Customer, and related support.

4. Categories of Data Subjects. Employees, contractors, and other personnel of the Customer, and (where entered) their family members for notification purposes.

5. Categories of Employee Data. Identification data (name, employee ID, date of birth, nationality, national identification number where entered); copies of identity documents and residence or work permits where entered; contact data (personal and work email, phone numbers, home address); employment data (job title, department, manager, employment and contract type, start and end dates, salary where entered); family and lifecycle data (partner and children's names and dates of birth, important personal dates, emergency contacts, where entered); leave and absence data; performance review data (ratings, feedback, goals, manager notes, AI-generated summaries); where enabled by the Customer, audio recordings and transcripts of performance review conversations and related consent records; contract documents; profile data imported from Customer-Enabled Integrations (including profile pictures); content of messages exchanged with personnel through the Service and Customer-Enabled Integrations; inputs to and outputs of AI Features; usage and log data.

   Special Categories of Data. The Service is not designed to require special categories of personal data. Health data may nevertheless be processed where the Customer records sickness-related absence or enables recording of performance review conversations. The Customer is responsible for having a lawful basis under Article 9 GDPR for any such data it submits.

6. Frequency of Processing. Continuous for the duration of the Subscription Term.

Annex 2 Sub-processors

This Annex identifies the categories of Sub-processors engaged by At Heart in connection with the Service. An up-to-date list of Sub-processors is set out below.

Customer-Enabled Integrations and changes to this Annex are governed by Section 8.

Annex 3 Security Measures

At Heart implements at least the following technical and organizational measures:

• Encryption of data in transit (TLS 1.2 or higher) and at rest;
• Role-based access controls based on least privilege;
• Multi-factor authentication for administrative access;
• Logical separation of Customer data to prevent cross-tenant access;
• Logging of privileged access to production systems;
• Regular backups;
• A documented incident response procedure;
• Physical security of data centers, provided by the cloud infrastructure provider.

Annex 4 International Transfers

Where the SCCs (Module Four, processor to controller) apply under Section 13.3:

• Data Exporter: At Heart B.V., acting as Processor;
• Data Importer: the Customer, acting as Controller;
• Docking Clause (Clause 7): not used;
• Independent dispute resolution (Clause 11): the optional wording is not used;
• Governing law (Clause 17): the laws of the Netherlands;
• Jurisdiction (Clause 18): the courts of the Netherlands; and
• Annexes I and II: the information in Annex 1 and Annex 3 of this DPA.

For transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the SCCs applies.

For transfers subject to the FADP, the SCCs apply with the following adaptations: the Swiss Federal Data Protection and Information Commissioner (FDPIC) is the competent supervisory authority insofar as the transfer is governed by the FADP; references to “Member State” are interpreted so that data subjects in Switzerland can exercise their rights in their place of habitual residence; and references to the GDPR are understood as references to the FADP insofar as the transfer is governed by the FADP.