Data Processing Addendum

Last updated: September 24, 2026

This DPA is incorporated into the Terms of Service when Customer subscribes to WOSP. Draft text for counsel review.

This Data Processing Addendum ("DPA") forms part of the agreement between Honey House Tech ("Processor") and the organization that subscribes to WOSP ("Controller"). It applies when Processor processes personal data contained in Customer Data on Controller's behalf.

1. Subject matter and duration

Processor provides the hosted WOSP service described in the Terms. Processing continues for the subscription term and until Customer Data is deleted in accordance with this DPA and the Terms.

2. Nature and purpose

Processor processes personal data to host, operate, secure, back up, support, and improve WOSP; to execute Controller's configuration and administrative actions; and to comply with law. Processing includes storage, organization, retrieval, use, disclosure by transmission, and deletion.

3. Categories of data and subjects

Depending on Controller's use of WOSP, Customer Data may include:

• Identifiers and professional data (names, emails, job titles, org units).
• Google Workspace configuration, security findings, device inventory, licensing, and audit metadata.
• Credentials and tokens required to call Google APIs on Controller's behalf.

Data subjects may include Controller's employees, contractors, and end users in tenants Controller connects.

4. Controller instructions

Processor will process Customer Data only on documented instructions from Controller, including through Controller's use of the Products and Documentation, unless required by law. Controller instructs Processor to process Customer Data to provide WOSP as configured.

Controller is responsible for the lawfulness of instructions and for providing any required notices and consents to data subjects.

5. Confidentiality

Processor ensures that personnel authorized to process Customer Data are bound by confidentiality obligations.

6. Security

Processor implements appropriate technical and organizational measures as described in the Security page and the Privacy Policy. Controller is responsible for configuring roles, tenant scoping, and access within its instance.

7. Subprocessors

Controller authorizes Processor to use subprocessors needed to host and operate WOSP (for example, cloud infrastructure and payment processing). Processor will impose data protection obligations on subprocessors substantially similar to this DPA. Processor remains responsible for subprocessors' performance.

8. Assistance with rights and compliance

Processor will reasonably assist Controller in responding to data subject requests and in meeting Controller's obligations regarding security, breach notification, and data protection impact assessments, considering the nature of processing and information available to Processor.

9. Personal data breaches

Processor will notify Controller without undue delay after becoming aware of a confirmed personal data breach affecting Customer Data, and will provide information reasonably available to help Controller meet its obligations.

10. Deletion and return

On termination of the subscription, Processor will delete Customer Data within a reasonable period, except where retention is required by law or exists in encrypted backups that roll off on schedule. Controller may export data through product features before termination where available.

11. Audits

Upon reasonable written request no more than once per year, Processor will provide information needed to demonstrate compliance with this DPA, or make available a summary of third-party assessments if Processor maintains them. Onsite audits require mutual agreement, reasonable notice, and confidentiality, and may be subject to fees unless an uncured material breach is found.

12. International transfers

Where required, parties will execute standard contractual clauses or another approved transfer mechanism for transfers of personal data from the EEA, UK, or Switzerland.

13. Liability

Liability arising from this DPA is subject to the limitations in the Terms. Each party remains liable for its own violations of applicable data protection law to the extent such liability cannot be limited by contract.

14. Contact

Privacy and DPA inquiries: Honey House.