Data Processing Addendum

1. Scope and parties

This Data Processing Addendum ("DPA") forms part of the Terms of Service between the Customer and [LEGAL ENTITY NAME], doing business as PayrollGrove ("PayrollGrove"). It applies to personal data that the Customer, its users, or its workers submit to the Service ("Customer Personal Data").

For Customer Personal Data, the Customer is the controller (or "business") and PayrollGrove is the processor (or "service provider"). If a partner firm manages the Customer's account, the partner acts on the Customer's behalf.

2. Details of processing

3. Processing instructions

PayrollGrove processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA, and the Customer's use and configuration of the Service are the Customer's complete instructions. PayrollGrove will tell the Customer if it believes an instruction violates law. PayrollGrove may also process data where required by law, after notifying the Customer where legally allowed.

4. Confidentiality and personnel

PayrollGrove ensures that personnel who may access Customer Personal Data are bound by confidentiality obligations and trained in security. PayrollGrove staff have no standing access to Customer Personal Data. Support access requires a request with a reason and scope, approval by a Customer owner or administrator in the Service, expires within 72 hours, can be revoked by the Customer at any time, and every action taken under it is recorded in the Customer's audit log. Staff never impersonate users.

5. Security measures

PayrollGrove maintains the technical and organizational measures in Annex A and will not materially reduce the overall level of protection during the term.

6. Subprocessors

The Customer authorizes the subprocessors listed at /legal/subprocessors/. PayrollGrove imposes data protection terms on each subprocessor that are at least as protective as this DPA and remains responsible for their performance. PayrollGrove will give at least 30 days' notice of a new subprocessor. The Customer may object on reasonable data protection grounds; if the parties cannot resolve the objection, the Customer may terminate the affected Service and receive a refund of prepaid fees for it.

7. Data location

Customer Personal Data is stored and processed in the United States only. PayrollGrove will not transfer it outside the United States without the Customer's prior written consent.

8. Security incidents

PayrollGrove will notify the Customer without undue delay, and in any case it targets notice within 72 hours, after becoming aware of a breach of security leading to unauthorized access to, or accidental or unlawful destruction, loss, alteration, or disclosure of, Customer Personal Data. The notice will describe, as far as known, the nature of the incident, the data and data subjects affected, likely consequences, and measures taken. PayrollGrove will provide updates as it learns more and will reasonably help the Customer meet its own notification duties under state breach laws. Notice is not an admission of fault.

9. Assistance, deletion, and return

Assistance. Taking into account the nature of the processing, PayrollGrove will help the Customer respond to data subject requests (most can be handled with self-service tools and the full data export) and with reasonable security, impact assessment, and regulator inquiries.

Return. The Customer can export all Customer Personal Data at any time, and for 90 days after account closure, using the full data export.

Deletion. After that window, PayrollGrove retains Customer Personal Data only for the record retention periods described in the Privacy Policy, which reflect payroll and employment record laws, and then deletes it. On the Customer's written request after those legal minimums, PayrollGrove permanently deletes the Customer's data by destroying its encryption keys, which makes restricted data unreadable in the live system immediately. Encrypted backups containing those keys expire on the schedule in the Privacy Policy (about 4 weeks for point-in-time backups and up to 7 years for yearly archives), after which deletion is complete. PayrollGrove will certify deletion on request.

10. Audits

PayrollGrove targets a SOC 2 Type I report within six months after general availability, followed by Type II. Until then, PayrollGrove will answer a reasonable security questionnaire once a year and provide summaries of its policies and of independent penetration test results. If those materials are not sufficient to show compliance with this DPA, the Customer may conduct an audit at its own cost, once per year, on 30 days' notice, during business hours, under confidentiality, and without access to other customers' data.

11. CCPA terms

For Customer Personal Data, PayrollGrove will not: sell or share it; retain, use, or disclose it for any purpose other than the business purposes in this DPA; retain, use, or disclose it outside the direct business relationship with the Customer; or combine it with personal information received from others, except as permitted by the CCPA. PayrollGrove will notify the Customer if it can no longer meet its obligations under the CCPA, and the Customer may take reasonable steps to stop and remediate unauthorized use.

12. Liability and order of precedence

Each party's liability under this DPA is subject to the limitations in the Terms. If this DPA conflicts with the Terms regarding Customer Personal Data, this DPA controls.

Annex A: Technical and organizational measures