SparxUp Ltd. Data Processing Agreement

1. Key terms

The following roles apply under this DPA:

• Controller - that is you (the Customer). You decide what employee and HR data to collect and why.
• Processor - that is us, SparxUp Ltd. We process personal data only to provide the service and related support.
• Subprocessor - vendors we use to help process data (for example authentication, hosting, or database providers).

2. Scope of processing

When you use A-Char, SparxUp Ltd. processes personal data that you and your users submit to the platform. This may include employee profiles, employment records, organizational structure, time-off data, goals, performance reviews, survey responses, authentication data, and related HR information. We also process limited technical data (such as IP addresses, device information, and cookies) needed to operate and secure the service. We process data only to provide HR management features, reporting, communications, and related functionality. We do not use your organization's data for our own marketing or profiling, and we do not sell customer data to third parties.

3. Data retention

Retention periods depend on your subscription and agreements with us:

• Customer account and organization data is kept while your account is active.
• Employee and HR data is retained to provide the service and historical records you need.
• After cancellation or trial expiry without subscription, data may be deleted after a reasonable period as described in our Terms and Privacy Policy.
• You may request deletion of your organization's data by contacting us.

4. Subprocessors

We use trusted service providers to process data on our behalf to help us operate A-Char. We may add or replace subprocessors and will update this page when we do.

5. International data transfers

Personal data may be processed in countries outside your own, including outside the European Union and European Economic Area, where our infrastructure or subprocessors operate. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses and our subprocessors' compliance with applicable data protection laws.

6. Security measures

We implement appropriate technical and organizational measures, including:

• Encryption in transit via HTTPS.
• Access controls and role-based permissions so users see only data their role allows.
• Organizational isolation between customer tenants.
• Backups and secure hosting with reputable vendors.

7. Roles and responsibilities

Each party has the following obligations:

Your responsibilities as the data controller:

• Ensure you have a lawful basis to collect and process personal data.
• Inform employees and other data subjects as required by applicable law.
• Implement privacy notices, cookie banners, or consents where required.
• Manage data subject requests relating to data you control.

Our responsibilities as the data processor:

• Process data only on your documented instructions and to provide the service.
• Keep data secure and confidential.
• Assist you in meeting your data protection obligations, within reason and as agreed.

8. Data access and exports

A-Char provides access to data processed on your behalf through the platform according to your permissions and available features. Exports reflect data as stored in the service. Specific export formats and availability may depend on your plan and product capabilities. Contact us if you need assistance with data access or portability requests.

9. Governing law

This DPA is governed by the laws of the European Union and the Republic of Bulgaria, without regard to conflict-of-law principles, except where mandatory local law applies.