Data Processing Agreement

1. Parties and Scope

This Data Processing Agreement ("DPA") is entered into between Astrozombie LLC dba DeskPanther ("DeskPanther," "we," "us") and the business customer that subscribes to or uses the DeskPanther services ("Customer"). This DPA applies where DeskPanther processes personal data of Customer's owners, administrators, employees, or other authorized users ("Customer Personal Data") in the course of providing the DeskPanther services, and forms part of the DeskPanther Terms of Service.

2. Roles

Customer determines the purposes for which its employee and team data is entered into DeskPanther. DeskPanther processes Customer Personal Data in connection with providing the DeskPanther services. Where applicable data protection law classifies the parties, Customer generally acts in the role of the business or controller with respect to Customer Personal Data, and DeskPanther generally acts in the role of a service provider or processor. Nothing in this DPA is intended to override a classification that applicable law assigns to either party.

3. Customer Instructions

DeskPanther will process Customer Personal Data in accordance with Customer's documented instructions, which include Customer's and its users' use and configuration of the services, this DPA, and the agreements governing use of DeskPanther, except where DeskPanther is otherwise required or permitted to process the data by applicable law.

4. Types of Data

Customer Personal Data processed under this DPA may include:

• Names and employee or team member account information
• Business email addresses and account identifiers
• Phone numbers and mobile carrier information where provided for alerts
• Authentication and account information
• Time and break-related records, including meal and rest break records and attestations
• Time clock correction and change requests
• Cash drop records
• Inventory counts, supply orders, and low-stock reports
• Repair requests, including photos and videos uploaded for operational purposes
• Store and location information for Customer's business locations
• Communications and other operational records submitted by Customer or its users
• Technical and account metadata where applicable

DeskPanther does not collect GPS location data of Customer's employees.

5. Data Subjects

Data subjects may include Customer's owners, administrators, managers, employees and team members, and other authorized users of Customer's DeskPanther account.

6. Purpose of Processing

DeskPanther processes Customer Personal Data to provide, secure, maintain, and support the DeskPanther services and the functionality requested by Customer, including operational recordkeeping, notifications, and account administration.

7. Duration

DeskPanther processes Customer Personal Data for the duration of Customer's use of the services, plus any applicable retention or deletion period following termination. Following termination or cancellation, Customer Personal Data is retained for a limited wind-down period so returning Customers can pick up where they left off, and is then deleted in the ordinary course, including expiration from backups on their standard rotation. Specific published retention windows are being finalized and will be posted here once confirmed.

8. Confidentiality

DeskPanther will ensure that persons it authorizes to process Customer Personal Data are subject to appropriate obligations of confidentiality.

9. Security

DeskPanther will maintain reasonable technical and organizational safeguards designed to protect Customer Personal Data against unauthorized access, disclosure, alteration, or destruction, appropriate to the nature of the data processed. This DPA does not promise specific certifications or audit standards.

10. Security Incidents

DeskPanther will notify affected Customers of a personal data breach affecting Customer Personal Data as required by applicable law, and will provide information reasonably available to DeskPanther to assist Customer in meeting its own notification obligations.

11. Subprocessors

Customer authorizes DeskPanther to use subprocessors and service providers as necessary to provide the services. DeskPanther's current providers are listed on the DeskPanther Subprocessors page. DeskPanther will update that page when its providers change and will provide reasonable advance notice of material changes to Customers who request notification as described on that page. DeskPanther will provide at least 30 days advance notice of material changes to this list. Customers may subscribe to subprocessor change notices by emailing support@deskpanther.com.

12. Data Subject Requests

If Customer receives a request from an individual to exercise privacy rights regarding personal data that DeskPanther processes on Customer's behalf, DeskPanther will provide reasonable cooperation and assistance, taking into account the nature of the processing and the functionality of the services.

13. Return and Deletion of Data

Following termination of Customer's use of the services, DeskPanther will delete or return Customer Personal Data in accordance with its standard practices and applicable law, except where retention is required by law. DeskPanther's standard practices are:

• Customer Data remains available for a limited period after cancellation, so returning Customers can pick up where they left off. The specific window is being finalized and will be published here once confirmed.
• Customers may request an export of their data in a common format (CSV) by emailing support@deskpanther.com. Exports are provided within 30 days of a verified request.
• Upon a verified deletion request, data is deleted from active systems within 30 days. Backup copies expire on the standard backup rotation; the exact rotation window will be published here once confirmed.
• Billing records are retained by DeskPanther's payment processor as required by law.
• Durable records of consent and agreement acceptance are retained as needed to evidence acceptance.

14. Customer Responsibilities

Customer is responsible for: having an appropriate legal basis and authorization for the data it and its users enter into DeskPanther; providing any required notices to its employees and users; configuring and using DeskPanther appropriately for its business; determining its own employment recordkeeping obligations; and its own wage and hour, payroll, HR, and employment compliance. DeskPanther provides software and recordkeeping functionality. DeskPanther does not provide legal, payroll, HR, or tax advice, and does not determine what records Customer is legally required to maintain. Records stored in DeskPanther are records of information submitted through an account and are not necessarily proof of who physically performed an action, handled cash, worked, or was present at a particular time.

15. International Data Transfers

DeskPanther's services are currently offered to customers in the United States. DeskPanther currently offers the services to businesses in the United States only. If DeskPanther accepts customers outside the United States in the future, provisions addressing GDPR, UK GDPR, and international transfer mechanisms will be added with the advice of counsel before such processing begins.

16. California Privacy

To the extent the California Consumer Privacy Act as amended ("CCPA") applies, DeskPanther acts as a service provider with respect to Customer Personal Data. DeskPanther will not sell or share Customer Personal Data, will not retain, use, or disclose it for any purpose other than providing the services or as otherwise permitted by the CCPA, and will not combine it with personal information it receives from other sources except as permitted by the CCPA. This section is reviewed periodically and may be refined with the advice of counsel.

17. Conflict

This DPA forms part of, and is subject to, the DeskPanther Terms of Service. In the event of a conflict between this DPA and the Terms of Service with respect to the processing of Customer Personal Data, this DPA controls to the extent of the conflict.

18. Updates

DeskPanther may update this DPA from time to time, including to reflect changes in law, its services, or its providers. The current version will be posted at this page with its effective date. Continued use of the services after an update constitutes acceptance of the updated DPA to the extent permitted by applicable law.

Questions about this DPA: support@deskpanther.com