Data Processing Agreement

Workfree Limited (trading as PAIDD) | Company Number: 13799043
128 City Road, London, EC1V 2NX, United Kingdom · hello@paidd.io · www.paidd.io

1. Agreement Overview

This Data Processing Agreement ("DPA") forms part of the Partnership Agreement between you (the "Controller") and Workfree Limited trading as PAIDD (the "Processor") and governs the processing of personal data in connection with our early payment discount platform services.

This DPA ensures compliance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR) and the Data Protection Act 2018.

This DPA applies when:

• Customer uses the Platform for invoice processing that involves personal data
• Contact information of suppliers, vendors, or individuals is processed through the Platform
• PAIDD acts as processor on Customer's behalf for personal data
• Processing occurs within PAIDD's systems during service delivery

2. Scope of Personal Data Processing

Business contact information

• Supplier contacts: names and email addresses of supplier representatives
• Customer users: names and email addresses of platform users within Customer's organisation
• Invoice contacts: contact details when included in invoice data by Customer
• Communication records: email communications sent through platform notifications
• Telephone numbers, where Customer enables WhatsApp or SMS notifications

Platform usage information

• Authentication data: email address, single-use sign-in codes, passkey public keys and session information
• Audit logs: logins, account changes, invoice and early-payment actions, and ERP syncs
• Support communications: records of customer support interactions where personal data is involved

What we don't process

• Extensive personal data databases or profiles
• Special category data
• Profiling for marketing or advertising
• Sale of personal data
• Personal financial information
• Payment card or cardholder data
• Hotel guest data

Categories of data subjects

• Supplier representatives: employees and contacts of Customer's suppliers
• Customer employees: users of the Platform within Customer's organisation
• Individual suppliers: sole traders and individual contractors
• Invoice contacts: individuals designated for invoice-related communications

3. Processing Details

Nature and purpose. PAIDD processes personal data for platform authentication, service delivery, system integration with Customer's accounting and ERP systems, customer support, security monitoring and fraud prevention, legal compliance, and creating anonymised, aggregated data, which is no longer personal data once created.

Duration. Processing continues for the term of the Partnership Agreement and the retention periods set out in section 9.

Retention periods. Active service period: duration of the Partnership Agreement. Post-termination: 30 days read-only access for export. Session records (sign-in time, IP address and browser details): retained for the duration of the Partnership Agreement. Audit logs: retained for the duration of the Partnership Agreement; detailed ERP synchronisation logs are deleted after 7 days. Support records: 2 years. PAIDD's own accounting records relating to fees charged to Customer are retained for 6 years as required by UK tax law; this does not extend to personal data processed on Customer's behalf.

4. Controller and Processor Obligations

Customer obligations as Controller. Customer warrants that it has a lawful basis for processing all personal data provided to PAIDD, has authority to provide it, will obtain necessary consents where required, and will maintain records of processing activities. Customer will provide appropriate privacy notices to suppliers and contacts, inform data subjects of PAIDD's involvement in processing, and handle data subject requests regarding their rights.

Processing instructions. PAIDD processes personal data only according to Customer's documented instructions, does not process personal data for its own purposes except as legally required or to create anonymised, aggregated data as set out in section 3, immediately informs Customer if instructions appear to violate applicable law, and maintains records of all processing carried out on Customer's behalf.

Personnel. PAIDD ensures that all personnel authorised to process personal data are bound by a duty of confidentiality and have received appropriate data protection training.

Assistance. PAIDD assists Customer, taking into account the nature of processing and the information available to it, in complying with its obligations in relation to security, breach notification, data protection impact assessments, and prior consultation with a supervisory authority.

Compliance. PAIDD makes available to Customer all information necessary to demonstrate compliance with this DPA, and immediately informs Customer if it can no longer meet its obligations.

5. Security Measures

• Data in transit: TLS 1.2 or higher encryption for all connections and data transfers; unencrypted connections are refused
• Access controls: role-based access; sign-in by passkey (with device biometrics or PIN) or by single-use code sent by email, valid only in the browser session that requested it
• Session security: secure session management with automatic logout after 4 hours of inactivity
• Network security: cloud firewalls and DDoS protection provided by our infrastructure providers; application error and security-event monitoring
• API security: secure integration protocols with Customer systems
• Audit logging: logins, account changes, invoice and early-payment actions, and ERP syncs are logged

6. Sub-Processing

Authorisation and notice. Customer authorises the sub-processors listed below. PAIDD will give Customer at least 30 days' notice of any intended addition or replacement of a sub-processor, and Customer may object on reasonable data protection grounds. Each sub-processor is bound by written terms offering the same level of protection as this DPA.

Sub-processor	Service	Location
DigitalOcean	Platform hosting	London, UK
Amazon Web Services	File storage	Stockholm, EU
SendGrid	Email delivery	US (with SCCs)
Twilio	WhatsApp and SMS notifications	US (with SCCs)
Stripe	Payment processing for fees	US/EU (with SCCs)
Sentry	Error monitoring, including the user's email address on error reports	US (with SCCs)
Intercom	Support and analytics	US (with SCCs)
Google Workspace	Business communications	EU/UK
Microsoft Clarity	Session analytics	US (with SCCs)
Google Analytics	Usage analytics	US (with SCCs)

7. Data Subject Rights

When PAIDD receives a data subject request, we will:

• Notify Customer within 48 hours
• Provide details of the personal data processed
• Support Customer in responding to the request
• Extract relevant data in a usable format where possible

8. Data Breach Response

For personal data breaches, PAIDD will:

• Contain and assess the breach immediately upon discovery
• Notify Customer without undue delay and in any event within 24 hours of becoming aware
• Provide an initial assessment of breach scope and impact
• Implement immediate remediation measures

9. Data Return and Deletion

Upon service termination, PAIDD will provide personal data in a structured format (CSV, JSON), 30 days read-only access for export and migration, reasonable technical assistance with data transfer, and confirmation of successful transfer before deletion. At Customer's choice, PAIDD deletes or returns all personal data.

10. International Transfers

Platform data is hosted in the United Kingdom (DigitalOcean, London) and the European Union (AWS, Stockholm). Limited personal data is processed in the United States by the sub-processors identified in section 6. Personal data transferred from the European Economic Area to PAIDD's systems in the United Kingdom is transferred on the basis of the European Commission's adequacy decision for the United Kingdom of 19 December 2025. Where personal data is transferred onward to a country without an adequacy decision, PAIDD puts in place Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum.

PAIDD also applies adequacy decisions where available, supplementary safeguards where required, and reviews transfer risks regularly.

11. Compliance and Audit

Customer may:

• Request compliance documentation and reports
• Conduct audits with reasonable advance notice (30 days)
• Engage qualified third parties for audits
• Review security certifications and assessment reports

12. Contact

For questions about this Data Processing Agreement, contact hello@paidd.io.

Data protection lead: Yury Kusik, CTO