User Data Processing Agreement

User Data Processing Agreement ("Agreement") is between the information participant (“Participant”) and WORKPLACED Technologies Ltd ("Company") - a private limited company by shares incorporated in the Dubai International Financial Markets under License Number CL9112, that has developed comprehensive, data-driven workplace SaaS solutions and offer professional services such as consultancy and project management.

By accessing or using the WORKPLACED software ("Software"), the Participant agrees to be bound by this Agreement.

For (i) Participants of Customers located in the European Union or the European Economic Area or (ii) Participants who independently of any Customers subscribes to the Software and are located in the European Union or the European Economic Area, the contracting entity (i.e. the counterparty of the Participant) is WORKPLACED Technologies Europe BV - a private limited liability company incorporated under the laws of the Netherlands under registration number 95622462, with its registered office at Smienteneiland, 8, Meerstad, 9613 BG Groningen, Netherlands - instead of WORKPLACED Technologies Ltd.

References to the 'Company' in this Agreement shall be construed accordingly (i.e. a reference to WORKPLACED Technologies Europe BV instead of WORKPLACED Technologies Ltd). All data processing activities for the Participant shall be governed by the Data Protection Laws.

WORKPLACED Technologies Ltd is the parent company of WORKPLACED Technologies Europe BV. Where WORKPLACED Technologies Europe BV is the counterparty to this Agreement, it is acknowledged that WORKPLACED Technologies Europe BV operates under a licensing arrangement with its parent company, WORKPLACED Technologies Ltd, for the provision of the Software and related services.

Certain services under this Agreement may be subcontracted by WORKPLACED Technologies Europe BV to WORKPLACED Technologies Ltd or other third-party providers; however, WORKPLACED Technologies Europe BV shall remain fully responsible to the Participant and/or the Customer, as the case may be, for the performance of all obligations under this Agreement, including compliance with applicable Data Protection Laws. Any subcontracting shall not relieve WORKPLACED Technologies Europe BV of its liability for the proper execution of the Agreement.

The Company collects and processes personal data for information purposes, including assessments, surveys, and various other information-gathering activities. The data collected may be subject to the European Data Protection Laws and other applicable data protection laws.

“Data Protection Laws” means all applicable worldwide legislation relating to data protection and privacy which applies to the respective party in the role of Processing Personal Data in question under the Agreement, including without limitation European Data Protection Laws, in each case as amended, repealed, consolidated or replaced from time to time.

"European Data Protection Laws" means data protection laws applicable in Europe, including: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) ("GDPR"); (ii) Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector; and (iii) applicable national implementations of (i) and (ii); or (iii) GDPR as it forms parts of the United Kingdom domestic law by virtue of Section 3 of the European Union (Withdrawal) Act 2018 ("UK GDPR"); and (iv) Swiss Federal Data Protection Act and its Ordinance ("Swiss DPA"); in each case, as may be amended, superseded or replaced.

“Personal Data” means any information relating to an identified or identifiable individual where (i) such information is contained within Participant data; and (ii) is protected similarly as personal data, personal information, or personally identifiable information under applicable Data Protection Laws.

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed by us and/or our Sub-Processors in connection with the provision of the Subscription Services. "Personal Data Breach" will not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.

“Processing” means any operation or set of operations which is performed on Personal Data, encompassing the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction or erasure of Personal Data. The terms “Process”, “Processes” and “Processed” will be construed accordingly.

“Sub-Processor” means any Processor engaged by the Company or its affiliates to assist in fulfilling the Company’s obligations with respect to the provision of the services. Sub-Processors may include third parties or the Company’s affiliates but will exclude any Company’s employee or consultant.

2.1. Compliance with Laws. Within the scope of the Agreement and in its use of the services, Participant will be responsible for complying with all requirements that apply to it under applicable Data Protection Laws with respect to its Processing of Personal Data and the instructions it issues to the Company. In particular but without prejudice to the generality of the foregoing, Participant acknowledges and agrees that it will be solely responsible for: (i) the accuracy, quality, and legality of its data and the means by which it acquired Personal Data; (ii) complying with all necessary transparency and lawfulness requirements under applicable Data Protection Laws for the collection and use of the Personal Data, including obtaining any necessary consents and authorizations; (iii) ensuring it has the right to transfer, or provide access to, the Personal Data to Company for Processing in accordance with the terms of the Agreement; (iv) ensuring that its instructions to the Company regarding the Processing of Personal Data comply with applicable laws, including Data Protection Laws; and (v) complying with all laws (including Data Protection Laws) applicable to any emails or other content created, sent or managed through the services, including those relating to obtaining consents (where required) to send emails, the content of the emails and its email deployment practices. Participant will inform the Company without undue delay if it is not able to comply with its responsibilities under this 'Compliance with Laws' section or applicable Data Protection Laws.

2.2. Participant Instructions. The parties agree that the Agreement, together with the Participant use of the services of the Company, constitute its complete instructions to the Company in relation to the Processing of Personal Data, so long as it may provide additional instructions during the term of the Agreement that are consistent with the Agreement, the nature and lawful use of the Company’s services.

2.3. Security. Participant is responsible for independently determining whether the data security provided for in the Company’s services adequately meets its obligations under applicable Data Protection Laws. Participant is also responsible for its secure use of the Company’s service, including protecting the security of Personal Data in transit to and from the services (including to securely backup or encrypt any such Personal Data).

The Company Processes Personal Data provided by the Participant for gathering information and providing analytical insights. The data collected will be used exclusively for this purpose and for the performance of the Company’s services to the Participant.

By voluntarily providing Personal Data and agreeing to this Agreement, the Participant consents to the collection and processing of their Personal Data for the specified purpose. The Participant has the right to withdraw consent at any time by contacting the Company.

5.1. Compliance with Instructions. The Company will only Process Personal Data for the purposes described in this Agreement, the provision of its services to Participant or as otherwise agreed within the scope of your lawful Instructions, except where and to the extent otherwise required by applicable law. The Company is not responsible for compliance with any Data Protection Laws applicable to Participant or its industry that are not generally applicable to the Company.

5.2. Conflict of Laws. If the Company becomes aware that it cannot Process Personal Data in accordance with Participant’s instructions due to a legal requirement under any applicable law, the Company will (i) promptly notify the Participant of that legal requirement to the extent permitted by the applicable law; and (ii) where necessary, cease all Processing (other than merely storing and maintaining the security of the affected Personal Data) until such time as Participant issues new instructions with which we the Company is able to comply. If this provision is invoked, we will not be liable to you under the Agreement for any failure to perform the applicable Subscription Services until such time as you issue new lawful Instructions with regard to the Processing.

5.3. Security. The Company will implement and maintain appropriate technical and organizational measures to protect Personal Data from Personal Data Breaches ("Security Measures"). Notwithstanding any provision to the contrary, the Company may modify or update the Security Measures at its discretion provided that such modification or update does not result in a material degradation in the protection offered by the Security Measures.

5.4. Confidentiality. The Company will ensure that any personnel whom it authorizes to Process Personal Data on its behalf is subject to appropriate confidentiality obligations (whether a contractual or statutory duty) with respect to that Personal Data.

5.5. Personal Data Breaches. The Company will notify Participant without undue delay after it becomes aware of any Personal Data Breach and will provide timely information relating to the Personal Data Breach as it becomes known or reasonably requested by the Company. At Participant’s request, the Company will promptly provide the Participant with such reasonable assistance as necessary to enable it to notify relevant Personal Data Breaches to competent authorities and/or affected data subjects (the individual to whom the Personal Data relates), if it is required to do so under Data Protection Laws.

5.6. Deletion or Return of Personal Data. The Company will delete or return all data, including Personal Data (including copies thereof) Processed pursuant to this Agreement, on termination or expiration of its services with the Company in accordance with the procedures set out in the applicable terms thereof. This term will apply except where the Company is required by applicable law to retain some or all of the data, or where the Company have archived the data on back-up systems, which data we will securely isolate and protect from any further Processing and delete in accordance with our deletion practices.

5.7. Data Collection. The Company will collect and process only the Personal Data that is relevant and necessary for the information-gathering activities and analytics. The data may include, but is not limited to, name, email, demographic information, and any other information provided.

The Participant has the right to access, rectify, or erase their Personal Data held by the Company. To exercise these rights or request more information, please contact the Company at support@workplaced.com.

Participant agrees that the Company may engage Sub-Processors to Process Personal Data on Participant’s behalf, and the Company does so in three ways. First, it may engage Sub-Processors to assist the Company with hosting and infrastructure. Second, it may engage with Sub-Processors to support product and services features and integrations. Third, it may engage with its affiliates as Sub-Processors for service and support.

Where the Company engages Sub-Processors, it will impose data protection terms on the Sub-Processors that provide at least the same level of protection for Personal Data as those in this Agreement, to the extent applicable to the nature of the services provided by such Sub-Processors. It will remain responsible for each Sub-Processor’s compliance with the obligations of this Agreement and for any acts or omissions of such Sub-Processor that cause the Company to breach any of its obligations under this Agreement.

Participant acknowledges and agrees that the Company may access and Process Personal Data on a global basis as necessary to provide its services, and in particular that Personal Data may be transferred to and Processed by the Company in the United Arab Emirates and to other jurisdictions where its affiliates and Sub-Processors have operations. Wherever Personal Data is transferred outside its country of origin, each party will ensure such transfers are made in compliance with the requirements of Data Protection Laws.

The Company shall comply with all applicable Data Protection Laws in connection with its Processing of Personal Data under this Agreement, including the GDPR and the DIFC Data Protection Law (DIFC Law No. 5 of 2020). The Parties acknowledge that transfers of EEA Personal Data from the Company’s affiliate in Netherlands to the Company constitute Restricted Transfers under Chapter V of the GDPR, and agree to execute and be bound by the applicable module of the Standard Contractual Clauses set out in Commission Implementing Decision (EU) 2021/914 ("EU SCCs"), which are incorporated by reference herein and shall prevail over any conflicting provision of this Agreement in respect of such transfers. Prior to any such transfer, the Company shall conduct a transfer impact assessment and implement such supplementary technical and organizational measures as may be required to ensure an adequate level of protection for Data Subjects. The Company shall Process EEA Personal Data received from its affiliate in the Netherlands solely for the purposes contemplated by this Agreement, maintain appropriate security measures in accordance with Article 32 GDPR, notify such affiliate within forty-eight (48) hours of any Personal Data breach affecting such data, and shall not onward transfer such data without equivalent contractual safeguards in place. The Company’s affiliate in the Netherlands shall update its EULA and data processing transparency documentation to disclose the transfer to the Company, the applicable transfer mechanism, and the identity of each party in its relevant data processing capacity, prior to any transfer taking place.

The Participant acknowledges that they have read and understood this Agreement and consents to the processing of their personal data for the specified information-gathering purposes.

The Company may update this Agreement as needed to remain in compliance with GDPR.

By providing personal data and agreeing to this Agreement, the Participant acknowledges their understanding and consent to the processing of their personal data by WORKPLACED in accordance with the GDPR and other applicable data protection laws.