Data Processing Agreement

Your organization is the controller (in India: the data fiduciary) of the personal data it puts into Vorklee. Vorklee is the processor and acts only on your documented instructions: the Subscription Agreement, this DPA and the settings you choose in the apps.

Kinds of people: your users, employees, contacts, customers and vendors you record in Vorklee.

Kinds of data: identity and contact details, employment and payroll records, CRM and ERP records, tasks, documents and files, sign-in and audit logs.

Purpose: to host and run the Vorklee apps, keep them secure, give support and send the emails you ask for. We do not sell personal data or use it for advertising.

We keep each organization's data apart with row-level security in the database, encrypt data in transit (TLS) and at rest, limit staff access to what is needed, log admin actions and test backups. Details are on our Trust & Security page.

Everyone at Vorklee who can reach personal data is bound by confidentiality.

You allow Vorklee to use the subprocessors listed on our public Subprocessors page (/legal/subprocessors). Each one is bound by data protection terms at least as strict as this DPA.

We update that page before a new subprocessor starts processing your data. If you object for a reasonable data protection reason, tell us within 30 days; if we cannot solve it, you may end the affected service and get a pro-rata refund.

Application data is stored in the region shown on the Subprocessors page. Some vendors (sign-in, hosting edge, email, error monitoring) may process data in other countries; such transfers use the EU Standard Contractual Clauses or another lawful transfer tool.

Your admins can export or erase a person's records from VHome People → Privacy & DSAR. Each signed-in user can download their own data and delete their own account from VHome Settings → Privacy & data.

If a person contacts us directly, we pass the request to you. We help with data protection impact assessments and regulator questions when you ask.

If we become aware of a personal data breach that affects your data, we tell your organization owner by email without undue delay and in any case within 72 hours. The notice says what happened, what data and roughly how many people, what we did and who to contact. We keep updating you until it is closed.

At the end of the service you can export your data first. We then delete it from the live system within 30 days and from backups when they expire, unless the law makes us keep it.

We answer reasonable security questionnaires and share summaries of our security tests once a year on request. An on-site audit needs 30 days' notice, happens in working hours and is at your cost unless it finds a material breach of this DPA.

Privacy questions and signed copies: privacy@vorklee.com.