Data Processing Agreement pursuant to Art. 28 GDPR

Last updated: October 2026 · Version 2026-10-29

between

the respective WorkLogx customer company
– hereinafter “Controller” or “Customer” –

and

Monadion GmbH
Schönbrunner Straße 181/1
1120 Vienna
Austria

Commercial register court: Commercial Court of Vienna
Company register number: FN 667594g
VAT number: ATU82735426

represented by the Managing Director
Ing. Arapsih Güngör, MSc

Email: [email protected]
Support: [email protected]

– hereinafter “Processor” or “Monadion” –

together the “Parties”.

1. Subject matter

1.1. This agreement governs the processing of personal data by Monadion on behalf of the Customer in connection with the provision and use of the software-as-a-service platform WorkLogx.

1.2. WorkLogx serves in particular the digital support of operational processes, including:

• form creation and form use,
• mobile data capture,
• work and performance documentation,
• employee management,
• customer and project management,
• absence management,
• assignment and task planning,
• review and release of submissions,
• file and document management,
• creation of PDF and export documents,
• optional AI features, and
• further contractually agreed WorkLogx features.

1.3. This DPA supplements the WorkLogx Terms, orders, offers or other main agreements between the Parties.

1.4. In the event of a conflict between this DPA and the main agreement, the provisions of this DPA prevail with respect to data protection processing on behalf.

2. Roles of the Parties

2.1. With respect to personal data that the Customer or its users process within the Customer’s own WorkLogx tenant, the Customer is generally the controller within the meaning of the GDPR.

2.2. Monadion processes such personal data solely on behalf of and according to documented instructions of the Customer, unless a legal obligation requires processing that differs from those instructions.

2.3. For processing for which Monadion pursues its own purposes, in particular its own contract administration, billing, platform and information security or its own legal obligations, Monadion may itself be a controller. Such processing is not covered by this DPA.

3. Duration of processing

3.1. Processing on behalf begins with provision of the WorkLogx customer account or when processing of personal customer data begins.

3.2. It generally lasts for the term of the WorkLogx contract.

3.3. After the contract ends, the Customer is generally granted a transitional period of 30 days during which available and exportable customer data may be retrieved.

3.4. After that period, personal data processed on behalf are deleted or anonymised in accordance with this DPA and the technically provided deletion processes, unless a legal obligation requires further storage.

4. Nature and purpose of processing

Within WorkLogx, Monadion may in particular carry out the following processing operations:

• collection,
• recording,
• organisation,
• structuring,
• storage,
• adaptation,
• retrieval,
• consultation,
• use,
• disclosure by transmission,
• making available,
• alignment,
• generation of documents,
• temporary processing by AI features,
• restriction,
• erasure, and
• destruction.

The purpose of processing is solely the provision of the WorkLogx features commissioned by the Customer and the technical administration, security, storage and processing necessary for that purpose.

5. Categories of data subjects

Depending on use of WorkLogx, personal data of the following groups of persons may in particular be processed:

• employees of the Customer,
• field and service staff,
• users and administrators of the Customer,
• invited users,
• customers of the Customer,
• contacts at customers or business partners,
• project participants,
• suppliers and other business partners,
• persons named in forms or work documentation,
• persons whose signatures, photos or other data are documented.

6. Categories of personal data

Depending on configuration and use of WorkLogx, the following data may in particular be processed:

6.1 Master and contact data

• first and last name,
• email address,
• telephone number,
• address,
• company affiliation,
• user identifier,
• role and permissions.

6.2 Employee data

• employee master data,
• department,
• user status,
• tasks and assignments,
• work and project information,
• absences,
• operational notes.

6.3 Customer and project data

• customer names,
• project data,
• order information,
• assignment locations,
• addresses,
• contacts.

6.4 Form and documentation data

• form fields,
• free text,
• measured values,
• checklists,
• working times,
• mileage information,
• comments,
• photos,
• videos,
• documents,
• PDF files,
• Word files,
• signatures,
• attachments,
• generated documents.

6.5 Planning data

• tasks,
• assignments,
• allocations,
• employee availability,
• project and location information,
• qualifications or skills where captured by the Customer.

6.6 Technical data

• user and tenant identifiers,
• timestamps,
• technical status information,
• security-related audit information,
• technical error and system information.

7. Special categories of personal data

7.1. WorkLogx may include features through which special categories of personal data within the meaning of Art. 9 GDPR can be processed.

This concerns in particular:

• sickness-related absences,
• medical or health-related documents uploaded by the Customer,
• free-text or form content with health relevance.

7.2. In addition, customers may themselves store special categories of personal data in freely configurable forms or files.

7.3. As controller, the Customer is responsible for ensuring that there is a sufficient legal basis for processing such data and that processing is limited to what is necessary.

7.4. Monadion processes such data solely in the course of WorkLogx use initiated by the Customer.

8. Instructions

8.1. Monadion processes personal data on behalf solely on documented instructions of the Customer.

8.2. Use and configuration of WorkLogx as well as instructions arising from the main agreement, orders or support requests count as documented instructions.

8.3. If Monadion is obliged under Union or Austrian law to process data other than on the Customer’s instructions, Monadion will inform the Customer before processing, unless such information is legally prohibited.

8.4. If Monadion considers an instruction of the Customer to be unlawful under data protection law, Monadion will notify the Customer.

9. Confidentiality

9.1. Monadion ensures that persons who obtain access to personal customer data are bound to confidentiality or are subject to an appropriate statutory duty of secrecy.

9.2. Access is limited to persons who need it for operation, maintenance, support, security or other contractually required tasks.

9.3. The confidentiality obligation continues after the end of the activity.

10. Technical and organisational measures

10.1. Monadion implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

10.2. These include in particular, where applicable to WorkLogx:

Access and authentication

• authentication via Firebase Authentication,
• role- and permission-based access control,
• multi-factor authentication for especially privileged roles,
• separate platform administrator permissions,
• restricted administrative access.

Tenant isolation

• organisation-scoped access checks,
• logical separation of customer data,
• organisation-scoped file paths and storage assignment,
• deny-by-default permission checks.

Transmission and communication

• encrypted transmission via HTTPS/TLS,
• security requirements for webhooks and external communication.

Data and secrets

• protection of credentials and secrets,
• encryption of sensitive integration tokens,
• separate configuration of production and test environments.

Logging and traceability

• security-related audit logging,
• logging of relevant administrative actions,
• monitoring and error analysis.

Storage

• organisation-scoped storage quotas,
• access restrictions,
• deletion and retention mechanisms,
• regular consistency checks between database and object storage.

10.3. A more detailed description of the technical and organisational measures is set out in Annex 2.

10.4. Monadion may further develop technical and organisational measures provided the agreed security level is not reduced.

11. Sub-processors

11.1. The Customer grants Monadion a general authorisation to engage further processors where required to provide WorkLogx.

11.2. The sub-processors used from time to time are documented in the current public list at /subprocessors.

11.3. Monadion informs customers of the planned addition or replacement of a material sub-processor.

11.4. The Customer may object to such a change on legitimate data protection grounds within a reasonable period.

11.5. Monadion contractually obliges sub-processors to data protection duties that ensure an appropriate level of protection for the relevant processing.

11.6. Monadion remains responsible to the Customer for fulfilment of the data protection obligations of sub-processors engaged by Monadion, to the extent provided by law.

12. Sub-processor register

12.1. The then-current sub-processors for WorkLogx processing on behalf are maintained in the public list at /subprocessors (or the localized marketing URL).

12.2. That public list, in its then-current version, is the maintained register under this DPA and forms part of this DPA.

12.3. The list distinguishes in particular between:

• sub-processors under Art. 28 GDPR,
• other recipients or partly independent controllers (e.g. payment providers, certain maps/address services), and
• website/marketing providers that are not part of SaaS tenant processing merely because they are used on the public marketing website.

12.4. Payment providers such as Stripe and services such as Google Places / Google Maps Platform may act wholly or partly as independent controllers depending on purpose and are therefore not listed wholesale as sub-processors under this DPA.

12.5. Marketing tracking providers (e.g. tag manager / analytics on the marketing website) are not part of the WorkLogx tenant DPA processing chain merely because they are used on the public website.

13. International data transfers

13.1. Where sub-processors or their group companies process personal data outside the European Economic Area, Monadion ensures that the requirements of Chapter V GDPR are met.

13.2. For this purpose the following may in particular be used:

• adequacy decisions of the European Commission,
• appropriate safeguards,
• standard contractual clauses of the European Commission, or
• other transfer instruments provided by law.

13.3. On request, Monadion provides the Customer with appropriate information about the transfer mechanisms used.

14. Assistance with data subject rights

14.1. Monadion assists the Customer, within technical possibilities and taking into account the nature of processing, in fulfilling requests from data subjects.

This concerns in particular requests for:

• access,
• rectification,
• erasure,
• restriction,
• data portability,
• objection.

14.2. If Monadion receives a request from a data subject that recognisably concerns data of a customer tenant, Monadion will generally refer or forward the request to the relevant customer where permitted and necessary.

14.3. Monadion does not respond to such requests independently on behalf of the Customer unless corresponding instructions exist.

15. Assistance with data protection obligations

Taking into account the nature of processing and the information available, Monadion assists the Customer in particular with:

• security of processing,
• notification of personal data breaches,
• communication to data subjects,
• data protection impact assessments, and
• consultations with supervisory authorities,

insofar as the relevant matters concern processing on behalf via WorkLogx.

16. Personal data breaches

16.1. Monadion informs the Customer without undue delay after Monadion becomes aware of a personal data breach affecting customer data.

16.2. The notice contains, where available and required for the Customer, in particular information about:

• nature of the incident,
• affected data or systems,
• affected categories of persons,
• identifiable or possible effects,
• measures already taken or planned.

16.3. Information may be provided in stages where it is not yet complete at the time of the first notice.

16.4. The Customer’s statutory notification duties as controller remain unaffected.

17. Deletion and return of data

17.1. After the main agreement ends, the Customer may export its available data within the agreed transitional period of generally 30 days.

17.2. After that period, Monadion will delete or anonymise personal data processed on behalf in accordance with the technically provided deletion processes, unless other documented instructions exist.

17.3. Deleted files may remain in object storage for a limited period due to technical deletion and retention processes.

17.4. Technically deleted storage objects are currently generally permanently removed within a retention period of up to 30 days.

17.5. Temporary export files are generally scheduled for deletion after 7 days.

17.6. Data that Monadion is legally obliged to retain or that Monadion must store for its own legal purposes may be exempt from deletion. Such data are blocked for other purposes or processed only to the extent permitted by law.

17.7. Data in backups are deleted or overwritten in accordance with the backup retention documented for the production environment.

Note (CURRENT): A production backup retention is not evidenced as configured in the repository / this audit. See TOM §10 and docs/legal/BACKUP_CURRENT_VS_RECOMMENDED.md. Concrete backup retention remains open until documented enablement.

18. Data export

18.1. WorkLogx provides export functions for certain data.

18.2. The Customer is responsible for carrying out required exports in good time before the end of the contract.

18.3. Monadion assists the Customer to a reasonable extent with any technically required return of data where this is necessary and reasonable beyond the standard functions.

19. Audit and evidence rights

19.1. Monadion makes available to the Customer all information reasonably required to demonstrate compliance with the obligations under Art. 28 GDPR.

19.2. Evidence may in particular be provided by:

• technical documentation,
• security information,
• TOM descriptions,
• audit reports,
• certificates, or
• comparable documents.

19.3. If the evidence provided is insufficient for legitimate reasons, the Customer may, after reasonable advance notice, request a further review.

19.4. Reviews must be conducted so that:

• ongoing operations are disrupted as little as possible,
• confidentiality and security of other customers are preserved,
• no data of other tenants are disclosed, and
• no disproportionate burden arises.

19.5. Costs of extraordinary or customer-initiated on-site audits may be charged to the Customer to a reasonable extent, unless the audit reveals a material breach by Monadion.

20. Customer obligations

20.1. The Customer is responsible for the lawfulness of processing personal data within its WorkLogx tenant.

20.2. The Customer in particular ensures:

• existence of a suitable legal basis,
• fulfilment of required information duties,
• lawful processing of employee data,
• lawful processing of special categories of personal data,
• appropriate configuration of user permissions,
• limitation of data collection to necessary content.

20.3. The Customer must not instruct Monadion to carry out processing that clearly violates applicable data protection law.

21. Processing by AI features

21.1. Where the Customer uses WorkLogx AI features, selected customer data may be transmitted to the AI provider used for processing.

21.2. Depending on the feature, this may in particular concern:

• form descriptions,
• form fields,
• documents,
• audio recordings,
• field values,
• project information,
• customer names,
• employee information,
• planning information.

21.3. AI features are generally used only if activated or invoked by the Customer or an authorised user and the feature is available in the WorkLogx plan.

21.4. Monadion configures AI interfaces in a privacy-oriented manner where technically supported and limits transmission to the data required for the respective feature.

21.5. Processing by an external AI provider is shown in the sub-processor list.

22. Instructions and contacts

22.1. Customer instructions may be given via:

• WorkLogx configuration,
• the user interface,
• documented support requests, or
• other agreed communication channels.

22.2. Monadion’s data protection contact address:

[email protected]

22.3. General support requests:

[email protected]

23. Changes to this DPA

23.1. Monadion may adapt this DPA where required due to:

• legal changes,
• regulatory requirements,
• technical changes,
• changes to sub-processors, or
• further development of WorkLogx.

23.2. Material changes will be communicated to customers in good time.

23.3. Changes must not unreasonably reduce the level of protection required by the GDPR.

24. Liability

Liability of the Parties is governed by statutory rules and the liability provisions agreed in the main agreement or the WorkLogx Terms, insofar as those are permissible under data protection law.

25. Final provisions

25.1. This DPA forms part of the WorkLogx contract.

25.2. To the extent permitted by law, Austrian law applies.

25.3. Amendments and supplements to this DPA may be agreed electronically.

25.4. If any provision of this DPA is or becomes invalid, the remaining provisions remain unaffected.

Annex 1 – Description of processing

A. Subject matter

Provision and operation of the B2B SaaS platform WorkLogx including web application, mobile app, backend, database, file storage and optional additional services.

B. Duration

For the term of the WorkLogx contract plus agreed transitional, export, deletion and statutory retention periods.

C. Nature of processing

Capture, storage, organisation, display, modification, transmission, document generation, analysis, optional AI processing, export and deletion.

D. Purposes

• provision of digital forms,
• work documentation,
• employee and assignment management,
• customer and project management,
• absence management,
• planning,
• document management,
• review and release,
• reporting,
• optional AI support,
• secure storage and provision.

E. Categories of data subjects

• employees,
• users,
• administrators,
• customers and contacts of the Customer,
• project participants,
• suppliers,
• other persons whose data the Customer processes in WorkLogx.

F. Types of data

• master and contact data,
• user and permission data,
• employment and organisation data,
• work and project data,
• form and submission data,
• customer and project data,
• planning data,
• files, images, videos and documents,
• signatures,
• absence data,
• health data where applicable,
• technical and security-related data.

Annex 2 – Technical and organisational measures

The detailed, maintained description of the technical and organisational measures for WorkLogx is published in the document Technical and Organisational Measures (TOM) – WorkLogx at /tom.

That document, in its then-current version, constitutes Annex 2 to this DPA. A shortened duplicate description is not maintained here, to avoid divergence.

In summary the measures include in particular (details and evidence status see /tom):

• authentication via Firebase and MFA for especially privileged roles / Platform Admin,
• role- and permission-based access control with deny-by-default,
• tenant isolation including organisation-scoped storage paths,
• transport encryption for public endpoints (HTTPS),
• protection of secrets via environment variables and encryption of sensitive integration tokens,
• audit and error logging,
• storage quotas, soft-delete/purge, export expiry and storage reconciliation,
• privacy-oriented optional AI use,
• separation of TEST and production environments.

Backup / recovery: The current backup status and recommended policy are documented in TOM §10 and in docs/legal/BACKUP_CURRENT_VS_RECOMMENDED.md. Concrete backup retention must only be stated as current state after production enablement.

Annex 3 – Sub-processors

The current list of sub-processors and other service providers is published at /subprocessors and forms part of this DPA in its then-current version.

The public list includes in particular:

• Art. 28 sub-processors for SaaS tenant processing,
• separately identified recipients / independent controllers, and
• website/marketing providers where relevant in production.

The version published at /subprocessors from time to time is decisive. A static provider copy is not maintained in this annex, to avoid conflicts with the maintained public list.

Last updated: October 2026 · Version 2026-10-29