This Data Processing Addendum (“DPA”) applies where Taskworld processes personal data on behalf of a Customer in connection with Ongo Audit and the Customer’s processing is subject to the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”) or the UK GDPR. This DPA forms part of the Customer Agreement between the Customer and the Applicable Taskworld Entity.
7.1 Definitions. Capitalized terms have the meanings given in the Customer Agreement or, if not defined there, in the GDPR. “Taskworld” refers to the Applicable Taskworld Entity that is a party to the Customer Agreement.
7.2 Roles. The Customer is the controller and Taskworld is the processor with respect to Customer Personal Data processed in connection with the Services. Each party will comply with its obligations under applicable data protection law.
7.3 Subject matter, duration, nature, and purpose of processing.
- Subject matter: provision of Ongo Audit and related services.
- Duration: the duration of the Customer Agreement, plus any period required for return or deletion as set out below.
- Nature and purpose: hosting, storing, transmitting, processing, displaying, and otherwise making available Customer Personal Data to enable Authorized Users to perform inspections, audits, and incident reporting; providing related support, security, and analytics for the Services.
- Categories of data subjects: Authorized Users (employees, contractors, agents of the Customer), and persons whose data the Customer chooses to include in form responses, photos, and other Submission Data.
- Categories of personal data: Identity, Contact, Authentication, Device, Technical, Submission, Geolocation, Photo, Usage, Diagnostic, and Support Data, as described in the Privacy Policy.
7.4 Customer instructions. Taskworld will process Customer Personal Data only on documented instructions from the Customer, including with regard to international transfers, except where required by applicable law (in which case Taskworld will inform the Customer of the legal requirement before processing, unless prohibited by that law). The Customer Agreement, the Order Form, and the documented configuration of the Services constitute the Customer’s complete instructions.
7.5 Confidentiality. Taskworld will ensure that personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations.
7.6 Security. Taskworld will implement and maintain appropriate technical and organizational measures designed to ensure a level of security appropriate to the risk, taking into account the state of the art, costs of implementation, and the nature, scope, context, and purposes of processing. The measures in effect include those set out in the Security page and Taskworld’s then-current security documentation, available on request via security@taskworld.com.
7.7 Sub-processors.
-
The Customer authorizes Taskworld to use sub-processors to provide the Services, subject to the conditions in this Section 7.7.
-
The current list of authorized sub-processors is published on our Sub-processors page and is incorporated into this DPA by reference.
-
Taskworld will impose data-protection obligations on each sub-processor that are no less protective than those in this DPA.
-
Taskworld will give the Customer prior notice of any intended changes to the list of sub-processors, by updating the Sub-processors page (and, where the Customer has subscribed to notifications, by email). The Customer may object on reasonable data-protection grounds within fourteen (14) days of notice; if the parties cannot agree on a resolution, the Customer may terminate the affected portion of the Customer Agreement.
7.8 Data subject rights. Taking into account the nature of the processing, Taskworld will assist the Customer with appropriate technical and organizational measures, insofar as possible, in fulfilling the Customer’s obligations to respond to data subject requests under Articles 12–22 GDPR. If a data subject submits a request directly to Taskworld, Taskworld will forward the request to the Customer without undue delay and will not respond to the request itself except to confirm receipt and refer the data subject to the Customer.
7.9 Personal data breach. Taskworld will notify the Customer without undue delay (and in any event within seventy-two (72) hours) after becoming aware of a personal data breach affecting Customer Personal Data, and will provide such information as the Customer reasonably requires to comply with its obligations under Articles 33 and 34 GDPR.
7.10 Data protection impact assessments. Taskworld will provide reasonable assistance to the Customer with data protection impact assessments and, where required, prior consultations with supervisory authorities, in each case solely in relation to the Services.
7.11 Return and deletion. Upon termination of the Customer Agreement, Taskworld will, at the Customer’s choice, return or delete Customer Personal Data, subject to the timelines set out in the Customer Agreement and the Privacy Policy, except where retention is required by applicable law.
7.12 Audits. Taskworld will make available to the Customer information necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by the Customer or an independent auditor mandated by the Customer, in each case subject to reasonable notice, confidentiality obligations, and a maximum of one (1) audit per twelve (12)-month period (more frequently if required by a supervisory authority or following a security incident affecting Customer Personal Data). The Customer may rely on existing third-party certifications (such as ISO 27001 or SOC 2 reports) provided by Taskworld in lieu of an on-site audit, where reasonable.
7.13 International transfers. Where Taskworld transfers Customer Personal Data outside the EEA, the UK, or another jurisdiction with applicable transfer restrictions, Taskworld will ensure appropriate safeguards are in place, including the EU Standard Contractual Clauses or the UK International Data Transfer Addendum, as applicable, which are incorporated by reference into this DPA.
7.14 Liability. Each party’s liability under this DPA is subject to the limitations of liability in the Customer Agreement.
7.15 Conflict. In the event of conflict between this DPA and the Customer Agreement, this DPA controls with respect to the processing of Customer Personal Data.
Annex A — Technical and organizational measures. The measures described on the Security page, supplemented by Taskworld’s then-current security documentation, available on request via security@taskworld.com.
Annex B — Authorized sub-processors. The current list of authorized sub-processors is published and maintained on our Sub-processors page.