1. Overview and incorporation
This Data Processing Addendum (the "DPA") forms part of the agreement between you ("Customer") and Worqen OÜ ("Worqen") for use of the Worqen services (the "Services"), and applies to the extent Worqen processes Personal Data subject to the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"), the United Kingdom Data Protection Act 2018 and the UK GDPR (the "UK GDPR"), the Brazilian Lei Geral de Proteção de Dados (Law No. 13,709/2018, the "LGPD"), the Indian Digital Personal Data Protection Act 2023 (the "DPDP Act"), or the Swiss Federal Act on Data Protection (the "FADP"), on behalf of Customer.
This DPA is a starting framework intended for B2B Customers. For the avoidance of doubt, Customer is the controller of Personal Data Worqen processes on its behalf; Worqen is the processor. Where a particular processing activity is performed by Worqen as an independent controller (for example, our own KYC, anti-fraud and security operations on Worqen account-holders), that activity is governed by Worqen's Privacy Policy, not by this DPA.
For execution: please contact legal@worqen.com to receive an executable copy of this DPA. The web version below is provided for transparency and is also incorporated by reference into the principal Services agreement.
2. Definitions
Capitalised terms not defined here have the meaning given in the GDPR. "Personal Data", "Processing", "Controller", "Processor", "Data Subject", "Sub-processor", "Personal Data Breach" and "Supervisory Authority" have the meaning given in Article 4 GDPR.
"Affiliate" means an entity that controls, is controlled by, or is under common control with a party. "EU SCCs" means the Standard Contractual Clauses for the transfer of personal data to third countries adopted by the European Commission Implementing Decision 2021/914, Module Two (Controller to Processor). "UK IDTA" means the United Kingdom International Data Transfer Addendum to the EU SCCs. "Restricted Country" means a country outside the EEA or the United Kingdom that is not the subject of an adequacy decision.
3. Scope and roles
Customer instructs Worqen to process Personal Data only as necessary to provide the Services in accordance with the Services agreement, this DPA, the Worqen documentation, and Customer's lawful written instructions. Annex A sets out the subject-matter, duration, nature and purpose of processing, the categories of Data Subjects and the types of Personal Data processed.
3A. Duties of Customer as controller
Customer, as controller, will:
- Warrant that it is the controller of the Personal Data it submits (or has been authorised by the relevant controller to act on its behalf) and that it has the authority to give the instructions set out in this DPA;
- Ensure that it has, and maintains for as long as the processing continues, a valid legal basis under the GDPR, UK GDPR and any other applicable data-protection law for the processing it instructs Worqen to carry out, and that it has obtained and kept any consents that law requires;
- Provide to Data Subjects all privacy notices and other transparency information that applicable data-protection law requires, including in respect of the processing and international transfers described in this DPA;
- Be responsible for the accuracy, quality and legality of the Personal Data it submits to the Services, and for the means by which it acquired that Personal Data;
- Warrant that its documented instructions, and the processing it requests, comply with applicable data-protection law and will not put Worqen or any Sub-processor in breach of that law; and
- Not instruct Worqen to process Personal Data in a way that infringes the GDPR, UK GDPR, LGPD, DPDP Act, FADP or any other applicable data-protection law.
Worqen will inform Customer without undue delay if, in Worqen's opinion, an instruction infringes the GDPR, UK GDPR or another applicable data-protection law. Worqen is not obliged to follow, and may decline to act on or suspend, any instruction that it reasonably considers to be unlawful until Customer confirms, amends or withdraws it, and Worqen will not be in breach of this DPA or the Services agreement for doing so.
4. Duties of Worqen as processor
Worqen will:
- Process Personal Data only on documented Customer instructions, including with regard to transfers, unless required to process Personal Data by EU or Member State law to which Worqen is subject (in which case Worqen will inform Customer of that requirement before processing, unless that law prohibits such information on important grounds of public interest);
- Ensure that personnel authorised to process Personal Data are bound by appropriate confidentiality obligations;
- Implement and maintain the technical and organisational measures described in Annex B, as updated from time to time, designed to ensure a level of security appropriate to the risk;
- Engage Sub-processors only in accordance with Section 6;
- Assist Customer, taking into account the nature of processing, by appropriate technical and organisational measures, in fulfilling its obligations to respond to Data Subject rights requests;
- Assist Customer in ensuring compliance with Articles 32–36 GDPR (security, breach notification, DPIA and prior consultation), taking into account the information available to Worqen;
- At Customer's choice, delete or return all Personal Data after the end of the provision of the Services, and delete existing copies, unless Union or Member State law requires storage;
- Make available to Customer the information necessary to demonstrate compliance with this Article 28 GDPR DPA, and allow for and contribute to audits, including inspections, in accordance with Section 9.
5. Security and breach notification
Worqen will implement and maintain the technical and organisational measures set out in Annex B. We may update those measures from time to time, provided the level of protection is not materially reduced.
Worqen will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will include the information set out in Article 33(3) GDPR to the extent then known, and Worqen will provide updates as more information becomes available.
6. Sub-processors
Customer provides general written authorisation for Worqen to engage Sub-processors. The current list of authorised Sub-processors is published at /legal/subprocessors. Worqen will:
- Notify Customer of any intended addition or replacement of a Sub-processor at least30 days in advance, by updating the Sub-processors page and via the notification mechanism described on that page;
- Give Customer the opportunity to object on reasonable grounds related to data protection during that 30-day window. If Customer objects on reasonable grounds and the parties cannot reach agreement within a reasonable time, Customer may terminate the affected Services without penalty;
- Impose on each Sub-processor written terms providing for at least the same level of data-protection obligations as those set out in this DPA;
- Remain fully liable to Customer for the performance of each Sub-processor's obligations under this DPA.
7. International data transfers
Where Worqen transfers Personal Data from the EEA, the United Kingdom or Switzerland to a Restricted Country, the parties agree that the EU SCCs (Module Two: Controller-to- Processor) are incorporated into this DPA and are deemed entered into and completed as follows:
- The data exporter is Customer; the data importer is Worqen and / or its Sub-processors;
- Clause 7 (Docking Clause) does not apply;
- Option 2 of Clause 9 (general written authorisation) applies, with the 30-day prior- notice period set out in Section 6;
- The optional language of Clause 11 is not used;
- The governing law for Clause 17 is the law of the Republic of Estonia;
- The forum and jurisdiction for Clause 18 are the courts of Estonia;
- Annex I (description of the transfer) and Annex II (technical and organisational measures) are populated by Annexes A and B of this DPA respectively;
- Annex III (Sub-processors) is populated by /legal/subprocessors.
For transfers from the United Kingdom, the UK IDTA is incorporated into this DPA and completed in accordance with the table at the end of the IDTA, with reference made to the corresponding EU SCC clauses above. For transfers from Switzerland, the EU SCCs apply with the modifications described in the FDPIC's relevant guidance (including references to the FADP and to the FDPIC).
Transfer-impact assessment. Before relying on the EU SCCs, the UK IDTA or the Swiss mechanism for a transfer to a Restricted Country, and on an ongoing basis thereafter, Worqen conducts and maintains a transfer-impact assessment in line with Clause 14 of the EU SCCs. That assessment takes into account the specific circumstances of the transfer, the laws and practices of the destination country (including any that would permit public authorities to access Personal Data), and the technical, organisational and contractual supplementary measures described in Annex B. Where an assessment indicates that the safeguards in place are not sufficient to ensure an essentially equivalent level of protection, Worqen will adopt additional supplementary measures or, if adequate protection cannot be ensured, suspend or end the affected transfer. This is a continuing process commitment; it is not a certification or a completed independent audit.
Government and lawful-access requests. If Worqen receives a legally binding request from a public authority (including a judicial authority) for disclosure of Customer Personal Data, or becomes aware of any direct access by a public authority to such data, then in accordance with Clause 15 of the EU SCCs Worqen will:
- Notify Customer and, where appropriate and lawful, the affected Data Subjects, unless legally prohibited from doing so; where notification is prohibited, use reasonable efforts to obtain a waiver of the prohibition and to communicate as much information as possible as soon as possible, and document those efforts so as to be able to demonstrate them on request;
- Review the legality of the request and challenge it where, after a careful assessment, Worqen concludes that there are reasonable grounds to consider it unlawful under the laws of the requesting country, applicable international law, or the standard of protection required by the EU SCCs — including, where appropriate, seeking interim measures to suspend the effects of the request until a competent court has decided;
- Provide only the minimum amount of Personal Data permissible when responding to a request, based on a reasonable interpretation of that request;
- Document each request received and each response provided, retain that record for as long as permitted, and make it available to Customer or the competent Supervisory Authority on request.
Nothing in this Section requires Worqen to act unlawfully in the jurisdiction to which it is subject. Because settlement occurs on the public Solana blockchain through the non-custodial Worqen escrow program, on-chain transaction data is inherently public and outside Worqen's control; the commitments in this Section apply to the off-chain Personal Data that Worqen processes as processor.
8. Data Subject rights
Worqen will assist Customer, by appropriate technical and organisational measures described in Worqen documentation, in fulfilling Customer's obligation to respond to requests for the exercise of Data Subject rights. If a Data Subject contacts Worqen directly with a rights request relating to Customer Personal Data, Worqen will, without undue delay, refer the Data Subject to Customer.
9. Audit
Worqen will make available to Customer all information necessary to demonstrate compliance with this DPA. On reasonable prior written notice (and not more than once per year, except where required by a Supervisory Authority), Customer (or a mutually agreed independent third-party auditor bound by confidentiality) may audit Worqen's compliance with this DPA. Audits must be conducted during business hours, with minimum disruption, and at Customer's expense. Worqen may satisfy this obligation by providing third-party audit reports (such as SOC 2 Type II or ISO 27001 certificates) in place of an on-site audit, where reasonably appropriate.
10. Term and termination
This DPA remains in effect for as long as Worqen processes Customer Personal Data. On termination of the Services, Worqen will, at Customer's choice, delete or return all Personal Data, and delete existing copies, except to the extent storage is required by Union or Member State law (including AML retention) or for routine back-up rotation.
Unless Customer instructs otherwise, Worqen will act on Customer's choice as follows:
- Return — where Customer elects return, Worqen will make the Personal Data available for export in a structured, commonly-used and machine-readable format within 30 days of Customer's written request;
- Deletion — where Customer elects deletion, or once any return has been completed, Worqen will delete the Personal Data and existing copies from its live systems within 30 days, and from routine back-ups on the ordinary back-up rotation cycle and in any event within 90 days;
- Certification — on Customer's written request, Worqen will provide written certification that the deletion described above has been completed.
These obligations do not extend to Personal Data that Worqen is required to retain by Union or Member State law (including AML and sanctions-screening retention). Such data will continue to be protected, processed only for the purpose that requires its retention, and deleted on expiry of that requirement. They also do not extend to data recorded on a public blockchain: wallet addresses and transaction data written to the Solana ledger as part of payment-flow orchestration (see Annex A and Section 10A) are immutable and cannot be deleted or altered by Worqen or any other party, and any certification of deletion is given subject to that limitation.
10A. Blockchain data limitations
Part of the processing described in Annex A involves recording payment and escrow transactions on the Solana public blockchain. When an end-user funds, releases or refunds escrow, a limited set of Personal Data is written on-chain — namely Solana wallet addresses, transaction signatures, escrow-program interactions, amounts and timestamps. This is pseudonymous Personal Data.
On-chain data is public and permanent by design. It is written to a decentralised ledger that Worqen does not control and cannot alter, overwrite or delete, and it may be independently copied and retained by third parties operating the network. The escrow logic runs in a non-custodial on-chain program (program ID 6FtagT9Xm9b6eBHgDmxggam2KuiQbPYywUXnrs7B2gEJ); Worqen does not custody the funds and cannot reverse a settled transaction.
Notwithstanding Sections 4, 8 and 10, Worqen's obligations to delete or return Personal Data, to assist Customer with erasure and rectification requests, and to delete existing copies, apply only to Personal Data held in Worqen's off-chain systems. Worqen cannot erase, rectify or restrict Personal Data already recorded on the blockchain, and no such capability is implied by this DPA. Where Customer or a Data Subject requests erasure or rectification, Worqen will action the request for the off-chain copies within its control and will inform the requester that the on-chain record cannot be changed.
Customer should take this limitation into account when assessing its own obligations under Articles 16, 17 and 18 GDPR and when informing Data Subjects, and should not submit to the Services for on-chain settlement any Personal Data it does not wish to be permanently and publicly recorded.
11. Liability and order of precedence
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the principal Services agreement. In case of conflict between this DPA and the principal Services agreement, this DPA prevails to the extent of the conflict. In case of conflict between the EU SCCs and any other term of this DPA, the EU SCCs prevail to the extent of the conflict.
12. US State Privacy Addendum (CCPA/CPRA)
This Section applies only to the extent Worqen processes Personal Data that is subject to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (together, the "CCPA"), or to an analogous US State privacy law, on behalf of a Customer that qualifies as a "business" (or equivalent controller) under that law. Where it applies, this Section supplements the rest of this DPA; the other Sections continue to apply to that Personal Data except where this Section provides otherwise.
Terms used in this Section that are defined in the CCPA — including "business", "service provider", "sell", "share", "consumer", "business purpose" and "personal information" — have the meaning given in the CCPA. In this Section, references to Personal Data include the personal information of California residents (and, where an analogous US State law applies, residents of that state) that Worqen processes on Customer's behalf.
With respect to that Personal Data, Worqen acts as a service provider (or, under an analogous US State law, a processor) to Customer, and Worqen will:
- Process, retain, use and disclose the Personal Data only for the limited and specified business purposes of providing the Services set out in the Services agreement and this DPA, and not for any other purpose except as permitted by the CCPA;
- Not sell or share the Personal Data within the meaning of the CCPA;
- Not retain, use or disclose the Personal Data for any commercial purpose other than providing the Services, nor outside the direct business relationship between Worqen and Customer;
- Not combine the Personal Data with personal information Worqen receives from, or on behalf of, any other person, or collects from its own interaction with the consumer, except as the CCPA permits in order to perform a business purpose;
- Provide the same level of privacy protection with respect to the Personal Data as is required of a business by the CCPA, and notify Customer without undue delay if Worqen determines that it can no longer meet its obligations under the CCPA;
- Assist Customer, taking into account the nature of the processing, in responding to verifiable consumer requests to know, delete, correct, opt out of sale or sharing, and limit the use of sensitive personal information, and refer any such request that a consumer submits directly to Worqen back to Customer, consistent with Section 8;
- Enable Customer to take reasonable and appropriate steps to help ensure that Worqen uses the Personal Data in a manner consistent with Customer's obligations under the CCPA, and to stop and remediate any unauthorised use of the Personal Data.
Worqen certifies that it understands the restrictions set out in this Section and will comply with them. Nothing in this Section makes Worqen a licensed, registered or certified entity in any US state, requires Worqen to hold any US privacy certification, or requires Worqen to have completed any particular third-party audit; the information-provision and audit arrangements in Section 9 apply to compliance with this Section.
Annex A — Description of processing
- Subject-matter: provision of the Worqen marketplace, identity- verification, escrow, dispute-resolution, communications and related services.
- Duration: for so long as Customer uses the Services, plus retention periods set out in the Privacy Policy and applicable law.
- Nature and purpose: hosting, transmission, storage, retrieval, consultation, alignment, restriction and erasure of Personal Data; payment-flow orchestration via Solana smart contracts; identity-verification and sanctions screening; provision of moderation and customer support.
- Categories of Data Subjects: Customer's account-holders and end-users (Workers, Employers and visitors), and any other Data Subjects whose data Customer submits.
- Categories of Personal Data: identification data; profile data; authentication data; communications and message content; transaction data; KYC and identity-verification data; technical and device data; location data; tax and sanctions-screening data; any other Personal Data Customer chooses to submit.
- On-chain data: Solana wallet addresses, transaction signatures, escrow-program interactions, amounts and timestamps recorded on the public Solana blockchain (see Section 10A).
- Sensitive data: biometric data and government-issued identifiers (where KYC is performed); see Identity Verification Policy.
- Frequency: continuous, for the duration of the Services.
Annex B — Technical and organisational measures (summary)
- Encryption in transit — TLS 1.2 or higher for all client-server communication; certificate-pinning where appropriate.
- Encryption at rest — AES-256 / Fernet for sensitive credentials and PII fields; encrypted database volumes.
- Access controls — role-based access; principle of least privilege; mandatory multi-factor authentication for staff access to production systems.
- Audit logging — privileged-action logs; tamper-evident retention.
- Pseudonymisation — pseudonymised identifiers in error-monitoring; no production Personal Data in non-production environments.
- Resilience — automated back-ups; documented disaster-recovery procedure; defined recovery-time and recovery-point objectives.
- Incident response — documented incident-response plan; on-call rotation; breach-notification workflow targeting 72 hours.
- Vendor management — Sub-processor due diligence; written data-protection terms with each Sub-processor.
- Personnel — background checks where lawful; confidentiality obligations; security and privacy training.
- Vulnerability management — third-party Vulnerability Disclosure Programme (see VDP); routine security testing.
Contact
DPA execution: legal@worqen.com
Data Protection Officer: dpo@worqen.com