Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the SiteSync Terms of Service and governs the processing of personal data (including worker personal data) that SiteSync ("Processor") carries out on behalf of the Customer ("Controller") through the SiteSync Service.

1. Roles and scope

• The Customer is the data controller and determines the purposes and means of processing personal data entered into the Service.
• The Processor processes personal data only on documented instructions from the Controller, unless required to do otherwise by law.

2. Categories of data and data subjects

• Data subjects: workers, employees, contractors, and other individuals whose data is entered by the Customer.
• Categories of data: identity data (name, passport/Emirates ID, nationality), employment data (role, trade, salary components, leave, attendance, gratuity), visa and mobilization data, and related records.

3. Processing purposes

The Processor processes personal data to provide the Service, including:

• Worker records and lifecycle management (visa, labor card, leave)
• Payroll calculation and WPS (Wage Protection System) salary file generation
• Productivity and attendance tracking
• Gratuity (EOSB) calculation
• Compliance and reporting
• Support, maintenance, and security of the Service

4. Processor obligations

• Process personal data only on documented instructions, except where law requires otherwise (in which case the Processor will inform the Controller, unless prohibited).
• Ensure persons authorized to process personal data are bound by confidentiality.
• Implement appropriate technical and organisational measures to protect personal data (see the Security Statement).
• Not engage a subprocessor without prior notice and an opportunity to object. The current subprocessor list is available at/subprocessors/.
• Assist the Controller in responding to data-subject requests and in complying with data-protection obligations, taking into account the nature of processing.
• Make available information necessary to demonstrate compliance with this DPA, subject to confidentiality.

5. Controller obligations

• The Controller is responsible for establishing the legal basis for processing, including obtaining any required consents from workers.
• The Controller will provide clear instructions and will not instruct the Processor to process data in a way that violates law.

6. Subprocessors

The Controller generally authorizes the use of subprocessors listed at/subprocessors/ to support the Service. The Processor will update that list at least 14 days before engaging a new subprocessor that processes personal data.

7. Data transfers

Where personal data is transferred outside the UAE, the Processor will rely on appropriate safeguards, including standard contractual protections and (where required) supplementary measures, to ensure an adequate level of protection.

8. Security

The Processor will maintain security measures as described in theSecurity & Data Protection Statement, including encryption, access controls, and incident response.

9. Data subject rights assistance

The Processor will, to the extent legally permissible, assist the Controller in fulfilling its obligations to respond to data-subject requests, including access, rectification, erasure, restriction, and portability, using appropriate technical and organisational measures.

10. Breach notification

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting Customer Data, providing reasonable details to allow the Controller to meet its obligations.

11. Deletion and return

On termination of the Service, the Processor will, at the Controller's option, return or delete Customer Data within 30 days, except where law requires retention.

12. Liability

The liability of the parties under this DPA is subject to the limitation of liability in the Terms of Service.

13. Governing law

This DPA is governed by the laws of the United Arab Emirates, and the courts of Dubai have exclusive jurisdiction.