Buddy Punch Data Processing Addendum

Last Updated: November 12, 2026

This Data Processing Addendum (this “DPA”) is entered into between Buddy Punch Inc., a Delaware corporation (“Buddy Punch”), and the customer identified in the Agreement (“Customer”). This DPA is incorporated into and forms part of the Terms of Service / Terms of Use, order form, subscription agreement, or other agreement governing Customer’s access to and use of the Services, as applicable (collectively, the “Agreement”).

In providing the Services, Buddy Punch Processes Customer Personal Data on behalf of Customer and in accordance with Customer’s documented instructions. This DPA sets forth the terms applicable to Buddy Punch’s Processing of Customer Personal Data in connection with the Services.

1. Scope and Roles.

(a) Scope. This DPA applies to the Processing of Customer Personal Data by Buddy Punch in providing the Services. “Services” includes the time tracking, scheduling, payroll, workforce management, onboarding, offboarding, task management, document storage, and related features purchased or enabled by Customer under the Agreement. This DPA does not apply to Personal Data that Buddy Punch Processes as an independent Controller for account administration, billing, marketing, corporate operations, or other independent purposes, which is governed by Buddy Punch’s Privacy Policy and applicable law.

(b) Roles. Customer determines the purposes and means of Processing Customer Personal Data and acts as the Controller. Buddy Punch acts as Customer’s Processor. If Customer Processes Personal Data on behalf of another Controller, Customer acts as a Processor and Buddy Punch acts as Customer’s Subprocessor to the extent applicable. Where Data Protection Laws use terms such as “service provider” or “contractor,” Buddy Punch shall act in that capacity with respect to Customer Personal Data. The parties’ roles shall otherwise be interpreted consistently with the Processing relationship described in this Section.

2. Definitions.

(a) “Affiliate” means an entity that directly or indirectly controls, is controlled by, or is under common control with a party. For purposes of this definition, “control” means ownership of more than fifty percent (50%) of the voting interests of an entity or the power to direct its management and policies.

(b) “Authorized User” means an individual whom Customer authorizes to access or use the Services under the Agreement.

(c) “Controller” means the natural or legal person, public authority, agency, or other entity that, alone or jointly with others, determines the purposes and means of Processing Personal Data.

(d) “Customer Data” has the meaning given in the Agreement.

(e) “Customer Personal Data” means Personal Data contained in Customer Data that Buddy Punch Processes on behalf of Customer in connection with the Services.

(f) “Data Protection Laws” means all laws and regulations applicable to the Processing of Customer Personal Data under the Agreement, including applicable privacy, data protection, data security, and breach-notification laws and regulations, in each case as amended, replaced, or superseded from time to time.

(g) “Data Subject” means an identified or identifiable natural person to whom Customer Personal Data relates.

(h) “Personal Data” means any information relating to an identified or identifiable natural person or that is otherwise defined as “personal data,” “personal information,” or a similar term under applicable Data Protection Laws.

(i) “Personal Data Breach” means a breach of security resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data, or an event otherwise defined as a “personal data breach,” “security breach,” “breach of security,” or similar term under applicable Data Protection Laws.

(j) “Process” means to engage in Processing.

(k) “Processed” means subjected to Processing.

(l) “Processing” means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

(m) “Processor” means the natural or legal person, public authority, agency, or other entity that Processes Personal Data on behalf of a Controller.

(n) “Stored Documents” means files uploaded by Customer or its Authorized Users to document-storage functionality within the Services, including employment and human-resources records associated with an employee profile.

(o) “Subprocessor” means a third party engaged by Buddy Punch to Process Customer Personal Data on behalf of Customer in connection with the Services.

3. Processing of Customer Personal Data.

(a) Processing Details. The subject matter, duration, nature, purpose, categories of Customer Personal Data, categories of Data Subjects, and other details of Processing are set out in this DPA and Annex I.

(b) Categories of Personal Data. Depending on Customer’s configuration and use of the Services, Customer Personal Data may include the following:

(i) identification and contact information, including names, email addresses, postal addresses, telephone numbers, dates of birth, and employee or organizational identifiers;

(ii) employment information, including department, role, job status, compensation, schedules, hire dates, termination dates, certifications, and related workforce records;

(iii) time and attendance information, including punch-in and punch-out records, timestamps, precise or approximate location information where enabled, IP addresses, device identifiers, QR-code and kiosk usage records, and related activity logs;

(iv) photographs, including profile photographs and webcam-on-punch images where enabled by Customer;

(v) Stored Documents, which may include Forms I-9 and W-4, government-issued identification, citizenship or immigration information, signed agreements, certifications, and, where Customer uses functionality designated for restricted documents, medical, disability, genetic, leave-related, or other sensitive employment records; and

(vi) for payroll customers, payroll information, including compensation, tax-withholding information, Social Security and other government identification numbers, bank-account details, and related payroll records processed through Buddy Punch’s embedded payroll provider.

(c) Sensitive Data. Customer determines the Customer Personal Data submitted to the Services. Customer shall not submit categories of Personal Data that are subject to heightened restrictions under applicable Data Protection Laws except to the extent contemplated by the Services and through features designed or designated by Buddy Punch for Processing that type of data. Customer shall not upload payment-card data into workforce fields or Stored Documents. Customer is responsible for ensuring that it has a lawful basis for the Customer Personal Data it submits and for configuring access permissions appropriate to the nature and sensitivity of that data.

4. Instructions and Customer Responsibilities.

(a) Documented Instructions. Buddy Punch shall Process Customer Personal Data only on Customer’s documented instructions, unless applicable law requires otherwise. The Agreement, this DPA, Customer’s configuration and use of the Services, and written instructions consistent with the Agreement constitute Customer’s documented instructions. If applicable law requires Processing that is not based on Customer’s instructions, Buddy Punch shall inform Customer before the Processing unless the law prohibits notice on important grounds of public interest.

(b) Unlawful Instructions. Buddy Punch shall promptly inform Customer if, in Buddy Punch’s reasonable opinion, an instruction infringes applicable Data Protection Laws. Buddy Punch may suspend the affected Processing until the parties resolve the issue.

(c) Customer Responsibilities. Customer is responsible for the lawfulness, accuracy, quality, and means of collection of Customer Personal Data; for providing notices and obtaining authorizations or consents required by law; for determining and maintaining appropriate access permissions; and for complying with legal retention and recordkeeping obligations applicable to Customer. Buddy Punch’s retention and deletion features do not determine the period for which Customer may be required to maintain employment, tax, payroll, immigration, medical, or other records.

(d) Classification, Access, and Retention Controls. Customer is responsible for classifying Stored Documents, determining who may access them, and identifying the retention period applicable to each record. Restricted-document categories, employee-access settings, compliance flags, retention warnings, deletion confirmations, audit records, and similar features are administrative tools that support Customer’s decisions; they do not transfer those legal responsibilities to Buddy Punch or constitute a determination by Buddy Punch regarding the classification, accessibility, or required retention of a record.

5. Confidentiality and Stored Documents.

(a) Confidentiality. Buddy Punch shall ensure that personnel authorized to Process Customer Personal Data are subject to contractual or statutory confidentiality obligations and access Customer Personal Data only as necessary to perform their assigned functions.

(b) Stored Document Content. Buddy Punch does not monitor or review the substantive content of Stored Documents in the ordinary course of providing the Services. This does not restrict automated malware scanning, known-illegal-content hash matching, security and abuse detection, access reasonably necessary to provide Customer-requested support, or access, preservation, removal, disabling, or disclosure required or permitted by applicable law or the Agreement.

(c) Automated Security and Content-Safety Processing. Upon activation of Stored Document functionality, Buddy Punch will use Microsoft Defender for Storage within the Microsoft Azure environment to scan Stored Documents for malware. A Stored Document will not be made available for download unless the scan returns a clean result, and suspected malicious content may be quarantined, disabled, or deleted with an audit record, subject to applicable legal preservation obligations. Before enabling document-storage functionality for Forms I-9 and associated employment-verification records, Buddy Punch shall implement and test procedures under which a Stored Document subject to a documented legal hold that is subsequently flagged as potentially malicious is preserved in secure, inaccessible quarantine storage rather than destroyed solely as a result of the scan. Such quarantined content shall remain unavailable for ordinary access or download and shall be retained or deleted in accordance with the applicable preservation obligation. Where PhotoDNA matching is enabled, Buddy Punch will use PhotoDNA technology licensed by Microsoft at no cost. Under Buddy Punch’s Edge Hash architecture, hash generation occurs within Buddy Punch’s environment and only the generated irreversible hash is transmitted to Microsoft. Buddy Punch will not transmit the Stored Document or image, account or user identifiers, metadata, or other Customer Personal Data to Microsoft for PhotoDNA matching. If Buddy Punch materially changes this architecture so that Microsoft or another provider Processes Customer Personal Data on Customer’s behalf, Buddy Punch shall address that provider in accordance with Section 7 before deploying the change.

6. Security.

(a) Security Measures. Buddy Punch shall implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the state of the art, costs of implementation, and the nature, scope, context, and purposes of Processing and associated risks. The measures in effect as of the date of this DPA are summarized in Annex II.

(b) Updates. Buddy Punch may update the measures in Annex II from time to time, provided that the overall security of the Services is not materially decreased during the applicable subscription term.

7. Subprocessors.

(a) General Authorization. Customer grants Buddy Punch general written authorization to engage the Subprocessors listed in Annex III and other Subprocessors in accordance with this Section. Buddy Punch maintains its current Subprocessor list in the vendor-disclosure section of its Privacy Policy at https://buddypunch.com/privacy-policy/.

(b) Changes and Notice. Buddy Punch shall provide Customer at least fourteen (14) days’ advance notice of an intended addition or replacement of a Subprocessor by email or in-product notice directed to Customer’s administrative contact and shall update the applicable vendor-disclosure section. Customer may object during that notice period on reasonable data-protection grounds. The parties shall work in good faith to address a timely objection. If the parties cannot resolve the objection within sixty (60) days after Buddy Punch receives it, Customer may terminate the affected Services without penalty on thirty (30) days’ written notice.

(c) Subprocessor Terms. Before permitting a Subprocessor to Process Customer Personal Data, Buddy Punch shall enter into a written agreement with the Subprocessor that imposes data-protection obligations appropriate to the nature and scope of the Processing and sufficient to enable Buddy Punch to comply with this DPA and applicable Data Protection Laws. Those obligations shall address, as applicable, confidentiality, security measures appropriate to the sensitivity of the data, Personal Data Breach notification, assistance, return or deletion, and controls governing further subprocessors. Buddy Punch remains responsible for the performance of its Subprocessors to the extent required by applicable Data Protection Laws.

(d) Customer-Enabled Integrations. A third-party integration that Customer elects to activate is not a Buddy Punch Subprocessor to the extent the third party receives Customer Personal Data at Customer’s direction and Processes that data under Customer’s separate relationship or instructions. Customer is responsible for evaluating and authorizing those third-party integrations. This Section does not alter the status of a third party that Buddy Punch independently engages to Process Customer Personal Data on Customer’s behalf.

8. Data Subject and Consumer Rights; Compliance Assistance.

(a) Requests. During an active subscription, Customer may use the functionality then available through the Services to access, correct, manage, and export Customer Personal Data. Where a request cannot be fulfilled through available self-service functionality, Customer may request reasonable assistance from Buddy Punch, subject to applicable Data Protection Laws and the technical capabilities of the Services. If Buddy Punch receives a request directly from a Data Subject or consumer concerning Customer Personal Data, Buddy Punch shall, unless legally prohibited or required to respond directly, direct the requester to Customer or act in accordance with Customer’s documented instructions.

(b) Assistance. Taking into account the nature of the Processing and information available to Buddy Punch, Buddy Punch shall provide reasonable assistance to Customer with obligations relating to Data Subject or consumer requests, security, Personal Data Breach notification, data protection impact assessments, prior consultations, cybersecurity audits, risk assessments, and other compliance obligations to the extent required by applicable Data Protection Laws and relevant to Buddy Punch’s Processing. Buddy Punch may charge reasonable fees for assistance that materially exceeds functionality and information ordinarily provided with the Services, except to the extent prohibited by law.

9. Return and Deletion.

(a) Export During the Term. During an active subscription, Customer may export Customer Data through the functionality then available within the Services. Customer is responsible for maintaining copies of records needed to satisfy its legal and operational requirements. Following the effective date of cancellation, ordinary account access and self-service export functionality are restricted, although Customer may request reasonable assistance from Buddy Punch concerning available Customer Data.

(b) Post-Termination Retention. Unless Customer requests earlier deletion, Buddy Punch shall retain Customer Personal Data associated with a canceled account for up to twelve (12) months following the effective date of cancellation, generally corresponding to the end of the applicable paid subscription period. This retention period permits potential account reactivation and constitutes part of the Processing authorized under the Agreement and this DPA. For accounts canceled before the revised Agreement becomes applicable, the twelve (12)-month period shall commence on the effective date of the revised Agreement, except to the extent an earlier deletion or shorter retention period is required by a previously applicable commitment or Data Protection Laws.

(c) Deletion. Customer may request deletion of Customer Personal Data before expiration of the applicable retention period by contacting privacy@buddypunch.com. Buddy Punch shall process such requests in accordance with its obligations under this DPA and applicable Data Protection Laws. Upon expiration of the applicable retention period or completion of a valid earlier deletion request, Buddy Punch shall delete the relevant Customer Personal Data from active production systems, including associated internal data warehouse copies, subject to Section 9(f). Account-level deletion is currently performed through administrative procedures rather than an automated deletion process.

(d) Stored File Replication and Recovery. Where Stored Document functionality is provided, files may be replicated to a secondary storage region and may remain recoverable for up to thirty (30) days following the applicable deletion event. Such replication is maintained for availability and recovery purposes and does not constitute a separate independent file-backup system. Residual file copies shall be removed within the period specified in Section 9(e), subject to Section 9(f).

(e) Backups and Residual Copies. Customer Personal Data deleted from active production systems may remain in encrypted backup, replication, and recovery systems for up to ninety (90) days following the applicable deletion event. Residual copies shall remain protected by the technical and organizational measures in Annex II and shall not be restored or used for ordinary business purposes. If previously deleted Customer Personal Data is restored as part of disaster recovery or business continuity operations, Buddy Punch shall reapply the applicable deletion as part of the restoration process or promptly thereafter. The ninety (90)-day period applies to Buddy Punch-controlled backup and recovery copies and does not authorize continued active Processing of deleted Customer Personal Data. Residual information relating to deleted Customer Personal Data may also remain in system and security logs for up to one hundred eighty (180) days following the applicable deletion event.

(f) Legal Preservation. Deletion is subject to applicable legal holds, court orders, statutory recordkeeping requirements, regulatory obligations, and other lawful preservation requirements. Customer Personal Data retained solely for such purposes shall remain protected, shall not be Processed for unrelated purposes, and shall be deleted when the applicable preservation obligation ends. Where legally permitted, Buddy Punch shall inform Customer if a requested deletion is restricted by a preservation obligation.

(g) Subprocessor Retention. Buddy Punch shall address the return, deletion, and retention of Customer Personal Data by its Subprocessors in accordance with Section 7, applicable Subprocessor agreements, and Data Protection Laws. Certain Subprocessors may retain limited information in security logs, backups, or other systems for applicable contractual retention periods or as required by law. Any such retention shall remain subject to applicable confidentiality, security, permitted-use, and deletion restrictions. Nothing in this subsection permits retention that would violate an applicable legal or contractual deletion obligation.

10. Personal Data Breach.

(a) Notice. Buddy Punch shall notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notice will be provided to Customer’s administrative or security contact identified in the Agreement or through another reasonable communication channel.

(b) Information and Cooperation. Taking into account the information available to Buddy Punch, Buddy Punch shall provide information reasonably necessary for Customer to meet applicable notification obligations, including the nature of the Personal Data Breach, categories and approximate numbers of affected Data Subjects and records where reasonably ascertainable, likely consequences, and measures taken or proposed to address the Personal Data Breach. Buddy Punch shall reasonably cooperate with Customer’s investigation and response. Notice of a Personal Data Breach does not constitute an admission of fault or liability.

11. Audits and Demonstration of Compliance.

(a) Information. Buddy Punch shall make available to Customer information reasonably necessary to demonstrate compliance with this DPA and applicable Data Protection Laws, including relevant security documentation and, where available and appropriate, summaries of third-party audit or assurance reports relating to the hosting environment or Services.

(b) Audit Procedure. If the information made available under Section 11(a) is not reasonably sufficient for Customer to satisfy an audit obligation imposed by Data Protection Laws, Customer may conduct an audit through a mutually acceptable independent auditor bound by confidentiality. Audits shall be conducted at Customer’s expense, on reasonable prior notice, during normal business hours, and no more than once in any twelve (12)-month period, unless a competent regulatory authority requires otherwise, a Personal Data Breach or material security incident reasonably warrants an additional audit, or Customer has reasonable grounds to suspect material noncompliance. Audits shall be scoped to avoid unreasonable disruption, exposure of other customers’ information, or compromise of Buddy Punch security.

(c) Remediation Rights. To the extent required by applicable Data Protection Laws, Customer may take reasonable and appropriate steps to verify that Buddy Punch uses Customer Personal Data consistently with Customer’s legal obligations and, upon notice, to stop and remediate any unauthorized use of Customer Personal Data. The parties shall cooperate in good faith to implement any legally required remediation.

12. Additional Processing Restrictions.

(a) Application. To the extent applicable Data Protection Laws impose additional restrictions on a person that Processes Personal Data on behalf of another person or entity, Buddy Punch shall Process Customer Personal Data in accordance with this Section.

(b) Limited and Specified Purposes. Buddy Punch may Process Customer Personal Data only for the limited and specified purposes of providing and operating the Services selected by Customer, including account authentication and access control; time tracking and attendance; scheduling; payroll processing and payroll-related transmission; onboarding, offboarding, and task management; document hosting, storage, retrieval, transmission, and display; customer-directed communications; support and troubleshooting; security, fraud, abuse, malware, and unlawful-content detection; backup, disaster recovery, and service continuity; and internal maintenance and improvement of the quality, reliability, security, and functionality of the Services, in each case as permitted by applicable Data Protection Laws. Processing through internal AI-assisted, search, reporting, or other operational tools shall be limited to the purposes otherwise authorized under this Section and the Agreement. The use of such tools does not independently authorize the use of Customer Personal Data for unrelated marketing, sales, model training, or other purposes outside the permitted Processing relationship.

(c) Restrictions. Except as permitted or required by applicable Data Protection Laws, Buddy Punch shall not sell or share Customer Personal Data; retain, use, or disclose Customer Personal Data for purposes other than those specified in Section 12(b); retain, use, or disclose Customer Personal Data outside the direct business relationship between Buddy Punch and Customer; or combine Customer Personal Data with Personal Data received from another person or collected through Buddy Punch’s independent interactions with a Data Subject where such combination is prohibited by applicable Data Protection Laws. Buddy Punch shall not use the substantive content of Stored Documents for advertising, profiling, model training, or independent analytics, and shall not use Stored Document content for purposes unrelated to providing and securing the Services.

(d) Protection and Assistance. Buddy Punch shall provide the level of privacy protection required by applicable Data Protection Laws for Customer Personal Data Processed on Customer’s behalf and shall provide reasonable assistance to Customer in fulfilling its obligations under applicable Data Protection Laws to the extent relevant to Buddy Punch’s Processing.

(e) Inability to Comply; Remediation. Buddy Punch shall notify Customer if Buddy Punch determines that it can no longer comply with obligations applicable to its Processing of Customer Personal Data under this DPA or applicable Data Protection Laws. Customer may take reasonable and appropriate steps to verify compliance and, where required by applicable Data Protection Laws, to stop and remediate any unauthorized Processing of Customer Personal Data.

(f) Subprocessors. Buddy Punch shall engage Subprocessors in accordance with Section 7 and shall ensure that applicable contractual restrictions concerning Customer Personal Data are imposed on Subprocessors to the extent required by applicable Data Protection Laws.

13. General.

(a) Data Protection Contact. Buddy Punch’s contact for privacy and data-protection matters relating to this DPA is privacy@buddypunch.com.

(b) Deidentified and Aggregated Information. This DPA does not restrict Buddy Punch’s use of information that has been aggregated or deidentified in accordance with applicable Data Protection Laws such that it is no longer Customer Personal Data, subject to the Agreement and applicable law. Buddy Punch shall not use the substantive content of Stored Documents to create deidentified or aggregated information for independent analytics, advertising, profiling, or model training. Buddy Punch may use deidentified or aggregated service telemetry and technical information for security, reliability, capacity planning, and improvement of the Services.

(c) Order of Precedence. If there is a conflict between this DPA and the Agreement regarding the Processing of Customer Personal Data, this DPA controls. Except as modified by this DPA, the Agreement remains in full force and effect.

(d) Liability. The limitations and exclusions of liability in the Agreement apply to this DPA except to the extent they conflict with rights or liabilities that cannot lawfully be limited under applicable Data Protection Laws.

(e) Governing Law. This DPA is governed by the governing-law and forum provisions of the Agreement.

(f) Incorporation, Acceptance, and Survival. This DPA is incorporated into and forms part of the Agreement and becomes effective when Customer accepts the applicable Agreement through the electronic acceptance process provided by Buddy Punch. Acceptance by an individual authorized to bind Customer constitutes Customer’s acceptance of this DPA, and no separate signature is required. This DPA applies to the same Customer legal entity that accepted the Agreement unless an Affiliate separately accedes in writing. Provisions that by their nature should survive termination, including confidentiality, deletion, audit, and liability provisions, shall survive termination. Buddy Punch’s obligations concerning Customer Personal Data shall continue for so long as Buddy Punch retains such information.

ANNEX I – DESCRIPTION OF PROCESSING

A. Parties.

Customer. The Customer entity identified in the Agreement; address and contact details as stated in the Agreement or Customer’s account records. Role: Controller, or Processor where Customer Processes Personal Data on behalf of another Controller. Activities: use of the Services for Customer’s workforce and related business operations.

Buddy Punch. Buddy Punch Inc., 1835 E Edgewood Dr., Suite 105-441, Appleton, Wisconsin 54913, USA; privacy@buddypunch.com. Role: Processor, or Subprocessor where Customer acts as a Processor. Activities: provision, hosting, storage, support, security, and maintenance of the Services.

B. Processing Details.

Subject matter. Processing of Customer Personal Data to provide the Services under the Agreement.

Duration. The term of the Agreement plus the limited post-termination retention periods described in Section 9, subject to legal preservation obligations.

Nature and purpose. Collection where directed by Customer, hosting, storage, organization, transmission, retrieval, calculation, display, support, security, deletion, and other Processing necessary to provide the Services as configured by Customer.

Frequency. Continuous or recurring during Customer’s use of the Services and the post-termination period described in Section 9.

Categories of Data Subjects. Customer’s employees, contractors, consultants, applicants, or other workforce members whose records Customer manages in the Services, and Customer’s administrators and Authorized Users.

Categories of Personal Data. The categories described in Section 3(b), as determined by Customer’s configuration and use of the Services.

Sensitive data. As described in Section 3(c), including government identifiers, citizenship or immigration information, medical, disability, genetic, leave-related, tax, payroll, and bank-account information where Customer elects to use the applicable functionality.

Retention. As described in Section 9.

Transfers to Subprocessors. The Subprocessors in Annex III and any subsequent Subprocessors engaged under Section 7, for the purposes described in the applicable Subprocessor list.

ANNEX II – TECHNICAL AND ORGANIZATIONAL MEASURES

Buddy Punch maintains technical and organizational measures designed to protect Customer Personal Data. The following measures apply to the Services and functionality currently enabled, except where a measure is expressly identified as planned or applicable upon activation of particular functionality:

• Hosting and resilience. Microsoft Azure, North Central US (primary) and South Central US (backup), with geo-replication; application-tier traffic failover; managed database failover; Business Critical database tier with geo-redundant backups; approximately fourteen (14) days of point-in-time database recovery; weekly long-term database backups configured for twelve (12) weeks; and recovery objectives measured in hours for RTO and minutes for RPO.
• Backup governance and recovery. Encrypted backups and snapshots; reapplication of deletions when a backup is restored; documented retention controls for manual database exports, which are not retained indefinitely; and the layered deletion and recovery periods described in Section 9. Backup restoration testing is planned before the launch of Document Storage, with annual testing contemplated thereafter. As of the date of this DPA, an initial restoration test has not yet been completed.
• Encryption. TLS 1.2 or higher enforced in transit across application services, SQL servers, and storage accounts; encryption at rest using SQL Transparent Data Encryption and storage encryption; and passwords hashed and salted.
• Secrets management. Production secrets stored in Azure Key Vault and injected into configuration at deployment rather than stored in application source code.
• Access control. Least-privilege and role-based access controls; multi-factor authentication for privileged and administrative accounts; removal of access upon personnel separation; credential rotation; and unique accounts for accountability.
• Restricted Stored Documents. Upon activation of the applicable document-storage functionality, Buddy Punch will provide a restricted-document category with separate permissions and employer-controlled employee access; employee access will be disabled by default for Forms I-9, identity documents, and citizenship or immigration records unless Customer enables access; and access to and changes involving restricted records will be logged.
• Deletion controls. Upon activation of the applicable document-storage functionality, Buddy Punch will implement permissioned deletion actions; an optional compliance flag and retention warning; affirmative confirmation when an authorized user deletes a flagged document; audit records identifying the document, actor, timestamp, and action; protection against alteration or deletion of the audit record by the same user who performed the deletion; and up to thirty (30) days of internal file-recovery capability.
• Monitoring and testing. Recurring access reviews, Azure SQL vulnerability scanning, firewall reviews, and Microsoft Defender for Cloud coverage across relevant infrastructure components; and, upon activation of Stored Document functionality, Microsoft Defender for Storage for Stored Document malware scanning.
• Logging. Application audit logging for relevant data changes and database-level auditing with approximately 180-day retention.
• Stored Document upload pipeline. Upon activation of document-storage functionality, Buddy Punch will implement an upload pipeline consisting of private object storage; upload validation; automated malware scanning that fails closed so a document cannot be downloaded until a clean result is received; quarantine or deletion of suspected malicious content with an audit entry, subject to applicable legal preservation obligations; and PhotoDNA Edge Hash matching in which the hash is generated within Buddy Punch’s environment and only the generated hash, not the file, image, account or user identifiers, metadata, or other Customer Personal Data, is transmitted to Microsoft.
• Organizational safeguards. Information-security policies; security, privacy, and data-protection training; documented incident-response and crisis-management procedures; designated primary and backup internal security or privacy responders; and documented operational escalation procedures.
• Stored file replication and recovery. Punch photographs and profile images are replicated to a secondary storage region, with up to thirty (30) days of internal undelete capability. Upon activation of Stored Document functionality, Stored Documents will be subject to the same replication and recovery arrangements. This replication is distinct from the independent database backup arrangements described above and does not constitute a separate backup of stored file content.

Buddy Punch may modify these measures in accordance with Section 6(b).

ANNEX III – SUBPROCESSORS

Customer authorizes the Subprocessors below. Buddy Punch’s current list is maintained in the vendor-disclosure section of its Privacy Policy and may be updated in accordance with Section 7.

Customer-enabled integrations. Where Customer activates an integration that exports Customer Personal Data to a third party, including payroll or accounting systems, the third party is treated in accordance with Section 7(d).

PhotoDNA. Buddy Punch’s use of PhotoDNA is described in Section 5(c) and Annex II. Under the current Edge Hash architecture, Microsoft does not receive Customer Personal Data for PhotoDNA matching and PhotoDNA is not listed as a Subprocessor. If the architecture changes so that a provider Processes Customer Personal Data on Customer’s behalf, Section 7 will apply.