Data Processing Addendum

Effective date: 2026-11-10

This Data Processing Addendum ("DPA") is part of the Terms of Service between Qortiva LLC ("Processor", "we") and the Customer ("Controller", "you").

1. Roles and scope

You are the controller (or "business") for personal information about your users and Workers that you put into Workslip or that Workslip receives from your Jobber account ("Customer Personal Data"). We process it as your processor (or "service provider" under the California Consumer Privacy Act) only to provide Workslip.

2. Instructions

We process Customer Personal Data only on your documented instructions. These Terms, your configuration of Workslip, and your use of its features are your instructions. We will tell you if we believe an instruction violates law.

3. Restrictions (CCPA/CPRA)

We will not: sell or share Customer Personal Data; retain, use, or disclose it for any purpose other than providing Workslip (including any commercial purpose other than the services); use it outside our direct business relationship with you; or combine it with personal information from other sources, except as the law permits for service providers. We will comply with applicable obligations and give the same level of privacy protection the law requires. You may take reasonable steps to stop unauthorized use.

4. Confidentiality and personnel

Anyone we authorize to process Customer Personal Data is bound by confidentiality obligations and accesses it only as needed to provide or support the service.

5. Security

We maintain appropriate technical and organizational measures, including: TLS encryption in transit; AES-256-GCM encryption of Jobber credentials at rest; hashing of session and sign-in tokens; logical separation of each Customer's data with access checks on every request; content-type verification of uploads; rate limiting; least-privilege access; backups; and audit logging of pay-affecting actions.

6. Subprocessors

You authorize us to use the subprocessors listed below. We will give at least 15 days' notice of new subprocessors (by updating this page and notifying you in the app or by email), and you may object on reasonable data-protection grounds; if we can't resolve the objection, you may terminate. We impose data-protection terms on subprocessors at least as protective as this DPA and remain responsible for them.

7. Assistance and data subject requests

We will promptly forward requests we receive from individuals about Customer Personal Data and, taking into account the nature of processing, help you respond (for example by export or deletion). We will reasonably assist with data protection assessments where required.

8. Security incidents

We will notify you without undue delay, and in any case within 72 hours after confirming a breach of security that leads to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. We will provide available information to help you meet your notification obligations and take reasonable steps to contain it.

9. Deletion and return

On disconnection or termination, we delete Jobber tokens immediately and delete remaining Customer Personal Data within 90 days, unless law requires us to keep it. You can export statements before then.

10. Audits

On reasonable written request (no more than once a year), we will provide information necessary to demonstrate compliance with this DPA, such as security documentation or third-party assessments if available.

11. International transfers

Customer Personal Data is processed in the United States. If you are subject to laws restricting transfers (for example the EU/UK GDPR), contact us before using Workslip so we can put appropriate safeguards (such as Standard Contractual Clauses) in place.

12. Order of precedence

If this DPA conflicts with the Terms on data protection, this DPA controls.