Data processing agreement

This agreement governs the processing of personal data that ZimaWork (processor) performs on behalf of the customer company (controller), pursuant to Article 28 of the GDPR.

The processor processes, on behalf of the controller, the employee data collected through the agent, solely to provide the work activity monitoring and analytics service, for the duration of the service contract.

Process data only on documented instructions from the controller; ensure confidentiality; apply appropriate security measures; assist the controller in handling data subject rights; and delete or return the data at the end of the service.

The processor keeps a record of processing categories and only uses sub-processors that offer sufficient guarantees, informing the controller of any changes.

Inform its staff of the monitoring in advance, have a valid legal basis, and respect the principle of proportionality when configuring the service.

The controller authorises the processor to use infrastructure and storage providers in the European Union and the AI model provider, with the safeguards required by the GDPR.