Introduction
This Data Processing Agreement ("DPA" or "Agreement") is an agreement between MKX Technologies ("Processor") and the business or organisation using myWorkMate ("Controller"). This DPA governs the processing of personal data by the Processor on behalf of the Controller when using the myWorkMate platform (the "Service").
This DPA supplements the myWorkMate Terms and Conditions and applies to the extent that the Processor processes personal data on behalf of the Controller. In the event of a conflict between this DPA and the Terms and Conditions, this DPA shall prevail with respect to the subject matter of data processing.
1. Definitions
In this DPA, the following terms mean:
- GDPR: the General Data Protection Regulation (EU 2016/679).
- Controller: the business or organisation that determines the purposes and means of processing.
- Processor: MKX Technologies, which processes personal data on behalf of the Controller.
- Subprocessor: a third party engaged by the Processor to carry out part of the processing.
- Personal Data: any information relating to an identified or identifiable natural person.
- Record of Processing: the record of processing activities referred to in Article 30 GDPR.
- Personal Data Breach: a breach of security leading to unlawful destruction, loss, alteration, or unauthorised disclosure of personal data.
2. Roles and scope
The Controller is responsible for the lawfulness of the processing, including establishing a valid legal basis, providing information to data subjects, and obtaining consent where required.
The Processor processes personal data only on documented instructions from the Controller, unless required by law. The Processor does not process the personal data for its own purposes, except where permitted by the GDPR.
The processing activities, categories of data, and data subjects are determined by the functional choices the Controller makes within the platform. An overview of possible data categories is included in the Privacy Policy.
3. Processing instructions
The Processor processes personal data only for the purpose configured by the Controller through the platform.
The Processor documents the Controller's instructions. The Controller may provide additional instructions through the available configuration and settings options within the platform.
If an instruction from the Controller is, in the Processor's opinion, in violation of the GDPR or other applicable law, the Processor shall promptly inform the Controller and may suspend execution of that instruction until it is brought into compliance.
4. Security measures
The Processor takes appropriate technical and organisational measures to secure personal data against loss or unlawful processing. These measures are tailored to the nature, scope, context, and risk of the processing.
The measures may include, among others:
- encryption of data transmission (TLS/HTTPS);
- access control and authentication;
- role-based access control;
- separation of data between organisations;
- logging and monitoring;
- regular security audits;
- incident detection and response.
The Processor regularly evaluates and updates these measures. Upon request, the Processor informs the Controller of the general nature of the measures taken, insofar as this does not disclose sensitive security information.
5. Confidentiality
The Processor ensures that persons acting under its authority who have access to personal data process them only on the Controller's instructions and are bound by a confidentiality obligation.
6. Subprocessors
The Processor may engage subprocessors for supporting processing activities. A current list of subprocessors is maintained and available via the Subprocessor List.
When engaging a subprocessor, the Processor ensures appropriate contractual arrangements that guarantee an equivalent level of protection as in this DPA.
The Processor remains fully liable for the fulfilment of the obligations passed on to the subprocessor.
7. Data subject rights
The Processor supports the Controller, insofar as reasonably possible, in handling requests from data subjects regarding their rights under the GDPR (access, rectification, erasure, restriction, portability, and objection).
The Processor shall promptly inform the Controller of a request received directly from a data subject, unless the Processor is legally required to respond itself.
8. Notification of personal data breaches
The Processor shall promptly notify the Controller, and in any case within 72 hours of becoming aware, of a personal data breach that may affect the Controller.
The notification shall include, to the extent available, the nature of the breach, the categories and approximate numbers involved, the likely consequences, and the measures taken or proposed.
The Processor shall cooperate in assessing the severity and any notification to the supervisory authority and data subjects, insofar as this is the Controller's responsibility.
9. Audits and inspections
The Processor shall make available all information necessary to demonstrate compliance with the obligations under this DPA and shall allow audits to be carried out by the Controller or a third party designated by the Controller, provided this is reasonable and subject to confidentiality.
Audits shall be conducted with reasonable prior notice and in a manner that does not unduly disrupt the Processor's operations. The costs of an audit shall be borne by the Controller, unless the audit demonstrates a failure by the Processor.
10. Return and deletion of data
Upon termination of the agreement, the Processor shall provide the personal data to the Controller and delete existing copies, unless legal retention obligations require longer retention.
The Controller may request a data export prior to termination through the available functionality within the platform.
11. International transfers
Where personal data is processed outside the European Economic Area, the Processor shall ensure a valid transfer mechanism, such as an adequacy decision or Standard Contractual Clauses.
12. Liability
The liability provisions of the Terms and Conditions shall apply mutatis mutandis, to the extent permitted by law. The Processor is only liable for damages that are the direct result of an attributable failure by the Processor to comply with this DPA.
13. Duration and termination
This DPA applies for the duration of the agreement between the parties and terminates once the Processor no longer processes personal data on behalf of the Controller.
Provisions that by their nature are intended to survive (such as confidentiality and liability) shall remain in effect after termination.
14. Contact
For questions about this Data Processing Agreement, please contact:
MKX Technologies — myWorkMate – Privacy & Data Protection · Chamber of Commerce number: 88447995 · Netherlands
E-mail: privacy@myworkmate.com
Questions about the DPA?
Contact us with any questions about the Data Processing Agreement or data processing via myWorkMate.
privacy@myworkmate.com© 2026 MKX Technologies — myWorkMate. All rights reserved.