Data Processing Agreement (DPA) — Version 5

This Agreement governs the processing of personal data by absentify on the Customer's behalf in providing the Software-as-a-Service solution absentify. The parties' roles are described as Controller and Processor; corresponding roles under applicable local law apply where those terms differ. Applicable data protection law means the laws that apply to the relevant processing, which may include the Swiss Federal Act on Data Protection (FADP), the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, applicable United States state privacy laws, and applicable Canadian federal or provincial privacy laws. A law is not made applicable solely by being listed here. GDPR references describe the corresponding requirements where GDPR or UK GDPR applies and do not represent a universal legal-basis requirement for customers elsewhere. The contractual safeguards in this Agreement apply to the processing within its scope without reducing any mandatory protection under applicable law.

This Agreement takes precedence over conflicting provisions in other agreements. The Processor's ISO 27001-certified Information Security Management System supports its technical and organizational security measures. Version 5 applies to a new contract when accepted. Its application to an existing contract is governed by section 13.3; publication alone does not replace that customer's agreed version.

between

the Customer of the Software-as-a-Service solution absentify – hereinafter referred to as Controller –

and

absentify GmbH (formerly BrainCore Solutions GmbH) Rotachstrasse 4 8003 Zürich Switzerland (represented by Marc Hochleutner) – hereinafter referred to as Processor –

EU Representative (Art. 27 GDPR): Prighter EU Rep GmbH Schellinggasse 3, 1010 Vienna, Austria Contact: https://app.prighter.com/portal/absentify

UK Representative (Art. 27 UK GDPR): Prighter Ltd (UK) 20 Mortlake High Street, London SW14 8JN, United Kingdom Contact: https://app.prighter.com/portal/absentify

1.1 The subject matter of this Agreement is the processing of personal data in connection with the provision and hosting of the software application absentify for Microsoft 365 for vacation and absence management, as well as the associated processing of the Controller's personal data (including collection, storage, modification, deletion, and transfer).

1.2 The duration of the data processing is determined by the Software-as-a-Service agreement concluded between the parties.

1.3 This Agreement remains in effect as long as the Processor processes personal data of the Controller, including backups.

1.4 In the event of any conflict between this Data Processing Agreement and the provisions of the main contract or other related agreements, this Agreement shall take precedence.

2.1 The Processor shall process personal data exclusively to enable the Controller to use the absentify application, including the operation of an attendance system for Microsoft 365. This includes documentation assistance, AI assistance with permitted workspace data and user-requested actions, and support investigation carried out on the Controller's behalf, subject to the documented instructions and controls below.

2.2 Types of personal data processed:

• Contact, billing, and contractual master data
• Communication data (e.g., IP addresses, system logs)
• Microsoft account information (first name, last name, display name, email, phone number, profile picture, language, and display settings)
• User content data (e.g., absence, vacation, and substitute information), including absence types, dates, reasons, allowances, schedules, and approval information
• Assistant messages, relevant conversation history, workspace and member context, tool results, and generated answers
• Support messages, screenshots or other submitted content, and relevant workspace, member, and diagnostic context selected by authorized support staff for an investigation on the Controller's behalf

Absence reasons, attachments, and messages may include health information or other sensitive or special-category personal data. The Controller determines whether such processing is permitted and satisfies the requirements of applicable law, including an Article 6 legal basis and Article 9 condition where GDPR or UK GDPR applies. The service contract, default setting, and electronic acceptance of this Agreement do not constitute employee consent.

2.3 Categories of data subjects include the Controller's employees and individuals whose data are entered into absentify by the Controller (e.g., substitutes or external parties).

2.4 The product assistant and its workspace-data access are available across plans. Separate AI translation features retain their own plan requirements. For newly created workspaces, access to workspace data starts enabled. Existing workspaces retain their saved setting. A workspace administrator can turn this access off or on at any time in the application settings. When enabled and a user requests assistance, relevant workspace data may be retrieved within that user's permissions and transmitted to Microsoft Azure AI services.

2.5 Turning workspace data access off prevents automatic member context, live workspace-data tools, and reuse of earlier conversation content containing automatically retrieved workspace data in product-assistant requests. General documentation help remains available in the application and Teams. Messages and information a user enters into that help chat are still processed by Azure AI. The setting does not delete stored conversations and does not control separate administrator translation features, external MCP connections, or internal support AI processing.

2.6 AI-assisted support can include automatic classification and summarization of tickets and preparation of reply drafts. Authorized support staff may select relevant ticket, workspace, member, and diagnostic context for an investigation; this is independent of the product-assistant setting. Support staff review suggested replies before sending them to a customer. Where absentify determines its own purposes for support administration or customer relationship management, that processing is described in the Privacy Policy and is not treated as processing on the Controller's behalf merely by inclusion of support in this Agreement.

2.7 Configured Azure OpenAI deployments process model inference requests within Microsoft's EU Data Zone. This concerns model inference, not every processing activity of absentify or its providers. Microsoft does not use customer prompts or outputs to train or improve foundation models under its applicable terms. Provider security and abuse monitoring may involve retention and access by authorized personnel. In-app questions and answers are stored by absentify; storage is not limited to the model request and disabling workspace access does not delete existing chats. Deletion and return remain subject to section 10 and applicable instructions.

2.8 Users initiate assistant actions. Before an assistant performs a change, the user must review and confirm the proposed action and its content. The assistant's tools remain subject to application permissions and approval workflows. AI output may be incomplete or inaccurate; the Controller and its authorized users remain responsible for checking results and for decisions affecting employees. The assistant is not authorized to make autonomous employment decisions.

3.1 The Processor has implemented appropriate technical and organizational measures (TOMs) pursuant to Article 32 GDPR to ensure a level of security appropriate to the risk. These measures consider the state of the art, implementation costs, the nature, scope, context, and purposes of processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons. The measures are detailed in Annex 1 and made available to the Controller for review upon request. They are integrated into the Processor's ISO 27001-certified ISMS, which ensures regular audits and updates.

3.2 The measures shall be adapted to the state of the art, provided that the agreed security level is not compromised. Significant changes will be communicated to the Controller in a timely manner.

3.3 The Processor regularly reviews its internal processes and TOMs to ensure compliance with applicable data protection laws.

4.1 The Processor shall immediately inform the Controller of any requests from data subjects regarding access, rectification, erasure, restriction of processing, data portability, or objection, insofar as these relate to the Controller's area of responsibility.

4.2 The Processor shall not handle such requests independently but only upon documented instructions from the Controller. Taking into account the nature of the processing, the Processor shall assist the Controller in fulfilling its obligations under Articles 12 to 22 GDPR.

The Processor undertakes to:

• Process personal data solely on documented instructions from the Controller (Article 29 GDPR)
• Oblige its employees and authorized persons to maintain confidentiality (Article 28(3)(b) GDPR)
• Implement and document appropriate security measures (Article 32 GDPR)
• Assist the Controller in complying with its obligations under Articles 32 to 36 GDPR, including Data Protection Impact Assessments (DPIAs), breach notifications, and prior consultations
• Notify the Controller of personal data breaches without undue delay (within 48 hours) and support the Controller in notifying the supervisory authority and data subjects (Articles 33, 34 GDPR)
• Support the Controller in responding to inquiries or audits by the supervisory authority (Article 31 GDPR)
• Maintain a record of processing activities (Article 30(2) GDPR) and make it available to the Controller upon request
• Immediately address instructions that may violate GDPR and suspend them until clarified

The Processor shall only engage employees who are bound by confidentiality and have been familiarized with relevant data protection provisions.

6.1 By accepting this Agreement, the Controller expressly authorizes the sub-processors listed in Annex 2 for the stated purposes. Any further appointment requires the Controller's prior express written or documented authorization. Each sub-processor must be carefully selected and bound by the applicable data protection duties, including Article 28(4) GDPR where applicable. The notice procedure in section 6.2 does not dispense with any necessary authorization.

6.2 The Processor shall give the Controller written or text-form notice of additions, replacements, or removals at least 30 days in advance, with an opportunity to object on data protection grounds and to provide any necessary authorization before the change. Any longer notice period or additional approval right in an individually agreed contract remains applicable. The Processor shall address a timely objection before the proposed change takes effect.

6.3 The Processor shall conclude agreements with each sub-processor imposing the same data protection obligations as this Agreement. Upon request, the Processor shall provide the Controller with copies of such agreements (with confidential parts redacted if necessary).

6.4 The Processor remains fully responsible for the compliance of its sub-processors with data protection obligations and shall be liable to the Controller accordingly.

Processing shall generally take place in Switzerland, EU Member States, or the European Economic Area (EEA). Transfers to third countries shall only occur if the requirements of Articles 44 et seq. GDPR / UK GDPR are met (e.g., through EU Standard Contractual Clauses, the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU SCCs, adequacy decisions, Binding Corporate Rules, or other safeguards). Any transfer to a third country requires the prior consent of the Controller.

8.1 The Controller is entitled to verify the Processor's compliance with its obligations under Article 28 GDPR, including through spot checks or audits (to be announced in advance).

8.2 Compliance may be demonstrated by providing appropriate certificates (e.g., ISO 27001), audit reports, procedural documentation, or equivalent evidence. The Processor shall provide the Controller with all necessary information and documents upon request.

8.3 The Processor shall facilitate and support audits conducted by the Controller or an independent auditor appointed by the Controller.

The Processor shall process personal data exclusively based on documented instructions from the Controller, including transfers. Instructions include this Agreement, the agreed service configuration and workspace access setting, and actions requested and confirmed by the Controller's authorized users within their permissions. Instructions do not authorize use of workspace personal data for foundation-model training or unrelated purposes. If the Processor identifies unlawful instructions, it shall suspend them until clarification. Instructions must be given in writing or text form and shall be documented.

10.1 Upon termination of the main contract or at the Controller's request, the Processor shall delete or return all personal data (including copies and backups), unless legal retention obligations apply.

10.2 The Processor shall confirm the deletion or return in writing. No unauthorized copies shall be retained.

The Processor operates an ISO 27001-certified Information Security Management System. A copy of the valid certificate is attached to this Agreement as Annex 3. The Processor maintains a record of processing activities and makes it available to the Controller upon request. The ISO 27001 certification serves as additional evidence of compliance with technical and organizational measures under Article 32 GDPR, complementing the detailed description in Annex 1.

12.1 Liability

The liability provisions set out below apply exclusively as between the Controller and the Processor. Any mandatory statutory liability towards data subjects, in particular under Article 82 GDPR, shall remain unaffected.

The Processor shall be liable for damages resulting from breaches of its obligations, provided such breaches are due to gross negligence or intent. The Processor shall indemnify the Controller against third-party claims.

12.2 Confidentiality

The Processor shall maintain the confidentiality of all personal data and information accessed under this Agreement. This obligation shall continue beyond the termination of the Agreement.

13.1 This Agreement is an integral part of the usage contract between the Controller and the Processor.

13.2 No separate signature or postal submission is required. Acceptance shall occur electronically within the application by an authorized representative. The accepted version and evidence of acceptance are recorded. This is contractual acceptance on behalf of the Customer, not consent on behalf of employees.

13.3 Version 5 applies when accepted for a new contract. Existing customers remain subject to their agreed version until an amendment becomes effective under the applicable contract and law. Changes to existing contracts must be announced at least 30 days in advance; any longer agreed period, required form of notice, and required agreement or consent must also be respected. Online publication alone does not amend an existing contract or change an existing workspace setting. Section 6 notice, consent, and objection rights remain unchanged.

13.4 The place of jurisdiction and applicable law shall be governed by the main contract. Should any provision be invalid, the remaining provisions shall remain in effect (severability clause).

The measures include at least:

Pseudonymization and Encryption

• Encryption of data in transit (TLS 1.2 or higher)
• Encryption of data at rest (AES-256)

Confidentiality

• Access control through role-based authorization and multi-factor authentication
• Confidentiality obligations for all employees
• Training and awareness programs on data protection

Integrity

• Separation of development, testing, and production environments
• Logging and traceability of administrative access

Availability and Resilience

• Firewalls, intrusion detection, and monitoring systems
• Data backups with geo-redundant storage and regular restoration tests
• Disaster recovery and business continuity plans

Regular Review Procedures

• Periodic security and vulnerability assessments
• Internal audits

Additional Measures

• Pseudonymization where feasible
• Ensuring resilience against physical and technical incidents

These measures are part of the ISO 27001-certified ISMS and are subject to continuous review and adaptation.

An overview of our technical and organizational security measures is available at https://absentify.com/security.

Detailed internal documentation — including the Data Encryption and Security policy, the Data Classification Matrix, and the Security Incident Response Plan — forms part of the ISO 27001-certified ISMS. These documents can be requested and, where required, reviewed individually under a confidentiality agreement.

An up-to-date list is also available at: https://absentify.com/subprocessors

The Processor holds an ISO 27001 certification for its Information Security Management System. The valid certificate is attached to this Agreement and included in the PDF version.

4.1 This Annex applies only to personal information subject to applicable United States state privacy law and processed by absentify on the Customer's behalf. The Customer acts as the business or controller and absentify as its service provider, contractor, or processor, as those terms are defined by the applicable law. It supplements the Agreement where that law requires additional protections.

4.2 The limited purposes are hosting and operating the Customer's absence-management workspace; maintaining user, leave, allowance, schedule, and approval records; delivering the Customer's configured notifications and integrations; answering documentation questions; using authorized workspace context for requested AI assistance and confirmed changes; and investigating the Customer's support requests using selected relevant context. Personal information is disclosed for those specified purposes, not for unrestricted use.

4.3 absentify shall not sell or share that information as those terms are defined by applicable law, use it for cross-context behavioral advertising, or retain, use, or disclose it beyond the stated purposes or the direct business relationship with the Customer, except where the applicable law expressly permits otherwise. absentify shall not combine it with information from other customers, other sources, or its own separate interactions with an individual except as expressly permitted by applicable law. The specified processing purposes do not include creating independent profiles about Customer employees or reusing their absence or health details for unrelated marketing purposes. Separate processing of business contacts, account administration and operational usage indicators, and support communications or purchase and cancellation signals for absentify's own customer-relationship purposes is governed by the Privacy Policy. This distinction does not permit repurposing employee records received under this Agreement for those independent purposes.

4.4 absentify shall comply with the applicable statutory obligations, provide the same level of privacy protection as required of the Customer under applicable United States state privacy law, bind authorized personnel to confidentiality, and maintain reasonable security suited to the information. It shall assist the Customer with applicable individual-rights requests and, where required, risk assessments, cybersecurity audits, and automated decision-making technology obligations.

4.5 The Customer may take reasonable, proportionate steps to check compliance, including reviews, assessments, and audits under section 8. absentify shall notify the Customer if it determines that it cannot meet the applicable obligations. On notice, the Customer may require reasonable steps to stop and remedy unauthorized processing; absentify shall cooperate. Further processors must be bound in writing to the applicable restrictions and safeguards. To the extent absentify acts as a contractor under the CCPA, absentify certifies that it understands and will comply with these restrictions.

5.1 This Annex applies where Canadian federal or provincial privacy law governs processing on the Customer's behalf. The Customer remains accountable for the purposes and authority for processing, including meaningful consent where required. A transfer for processing does not itself require fresh consent in every case; the applicable law and original purposes govern.

5.2 absentify shall use the information only to provide the instructed services, preserve confidentiality, and provide comparable protection through this Agreement and its safeguards. Processing takes place outside Canada, including in the EU and Switzerland and through the providers identified in Annex 2. There is no commitment to Canadian data residency. Foreign legal requirements may permit access by courts or public authorities; contractual safeguards cannot override those laws. The Customer shall provide the transparency required by applicable law.

5.3 absentify shall provide reasonably necessary information and assistance for the Customer's applicable privacy and transfer assessments, including an assessment before communicating information or entrusting processing outside Québec where required. Required written transfer terms must be in place before that processing begins. This Agreement does not substitute for the Customer's assessment or legal authority.

5.4 For entrusted processing subject to Québec's private-sector privacy law, absentify shall protect confidentiality, restrict use to the instructed services, and not retain the information after the mandate ends, subject to applicable law and section 10. absentify shall promptly notify the Customer's privacy officer of an actual or attempted confidentiality breach and enable appropriate verification of its confidentiality duties. These obligations also apply through written commitments of further processors where applicable.

This Agreement is concluded electronically within the absentify application. With electronic acceptance, it shall be deemed mutually binding.