Data Processing Addendum

This DPA is between you ("Customer", "you") and SlashHub Limited ("SlashHub", "Processor", "we"), and forms part of, and is subject to, the SlashHub Terms of Service and any product-specific addendum (together, the "Agreement"). Capitalised terms not defined here have the meaning given in the Agreement.

The Customer is the data user (within the meaning of the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO")) — and, where the EU/UK GDPR applies, the controller — in respect of all personal data of its employees, applicants, contractors, and other individuals (together, "Data Subjects") that the Customer (or any person acting for it, including an employee with a TimePlate login) submits, uploads, generates, or stores in, or transmits through, TimePlate (the "Processed Data").

SlashHub is a data processor (and, where the EU/UK GDPR applies, a processor) that processes the Processed Data only on the Customer's documented instructions and only to provide and secure TimePlate. SlashHub does not determine the purposes or means of the processing, does not process the Processed Data for its own purposes, and is not a data user in respect of it. This DPA applies in addition to, and does not limit, the Allocation of responsibility in clause 28 of the Terms of Service.

"Applicable Data Protection Law" means, as applicable, the PDPO (Cap. 486), the EU General Data Protection Regulation 2016/679, the UK GDPR and Data Protection Act 2018, and any other data-protection law that applies to the processing under this DPA. "Biometric Data" means personal data resulting from face, fingerprint, or similar processing that uniquely identifies an individual, including the face-descriptor and face-image data that TimePlate may store when the Customer enables face recognition. "Sub-processor" means any third party engaged by SlashHub to process the Processed Data. "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, the Processed Data.

The Customer's documented instructions include: (a) the configuration of TimePlate (including attendance methods, scheduling rules, payroll settings, and retention options) that the Customer selects; and (b) any lawful written instruction the Customer issues to SlashHub through the Services or by email to privacy@slashhub.hk or support@slashhub.hk.

The Customer is solely responsible for the lawfulness of the Processed Data and of the processing. Without limiting that, the Customer shall: (a) comply with all Applicable Data Protection Law, including the six Data Protection Principles in the PDPO, in respect of the Processed Data; (b) give each Data Subject a Personal Information Collection Statement that is clear and lawful, stating the purposes of collection, the classes of transferees (including SlashHub and its Sub-processors), the consequences of failing to supply the data, and the Data Subject's rights of access and correction (DPP1); (c) ensure the Processed Data is adequate, relevant, and not excessive, and is collected for a lawful purpose directly related to its functions (DPP1); (d) obtain and maintain all consents, notices, permissions, and authorisations required for the processing, and ensure that the Customer has a lawful basis for any transfer of the Processed Data to SlashHub; and (e) ensure its employees' use of TimePlate complies with the Customer's internal policies and all applicable employment, tax, and social-security law.

Where the Customer enables location data (GPS), biometric attendance (face recognition or fingerprint), or any other sensitive feature, the Customer shall: (a) give the Data Subject the required Personal Information Collection Statement and obtain the Data Subject's EXPLICIT consent (and, where the PDPO or other law requires, written consent) before enabling the feature for that Data Subject; (b) make the feature genuinely optional and offer a reasonable alternative attendance method (for example QR, PIN, or kiosk without biometrics); (c) conduct any privacy impact assessment or necessity/proportionality assessment required by law; and (d) retain the evidence of consent for as long as the feature is enabled and thereafter as required by law.

The Customer represents and warrants that: (a) it has the right to collect and disclose the Processed Data to SlashHub for the purposes of the Agreement; (b) its instructions to SlashHub are lawful; (c) it will not instruct SlashHub to process the Processed Data in a manner that would breach Applicable Data Protection Law; and (d) it will respond to Data Subject requests, complaints, and regulatory enquiries relating to the Processed Data in its capacity as data user. The Customer is responsible for all notices, consents, and authorisations relating to minors or any Data Subject lacking capacity.

SlashHub shall: (a) process the Processed Data only on the Customer's documented instructions (and as necessary to provide TimePlate and comply with law), and only for the purposes set out in the Agreement; (b) not sell the Processed Data, not use it for its own marketing or profiling, and not use it to train any AI model of its own; (c) ensure that personnel authorised to process the Processed Data are bound by appropriate confidentiality obligations; (d) implement and maintain the technical and organisational security measures in clause 6 (DPP4); (e) assist the Customer, to the extent reasonable, in responding to Data Subject requests and in meeting the Customer's security, breach-notification, and impact-assessment obligations; and (f) notify the Customer promptly if, in SlashHub's opinion, an instruction would breach Applicable Data Protection Law.

SlashHub does not collect, use, or disclose the Processed Data for any purpose of its own. SlashHub may create and use anonymised and aggregated data that cannot reasonably be linked back to any individual (for example, platform-wide reliability metrics) to operate, secure, and improve the Services, and may use such anonymised data indefinitely. SlashHub may also process the Processed Data to comply with law, to respond to a lawful request from a public authority, and to enforce the Agreement.

SlashHub is not responsible for the accuracy, completeness, or lawfulness of the Processed Data (which the Customer supplies), for the Customer's configuration of TimePlate, or for any decision the Customer makes in reliance on an output of TimePlate.

The Customer provides a general authorisation for SlashHub to engage Sub-processors to process the Processed Data. SlashHub maintains a current list of Sub-processors and the processing they carry out (for example hosting, storage, identity, payment, messaging, and AI-provider services) and makes it available on request and at a page we nominate. SlashHub will notify the Customer of any intended change to the Sub-processors as required by Applicable Data Protection Law (and, where the GDPR applies, at least the period required by Art. 28) so that the Customer may object; if the Customer objects on reasonable data-protection grounds and the parties cannot resolve it, the Customer may terminate the affected part of the Services.

Before any Sub-processor processes the Processed Data, SlashHub shall impose on it, by written contract, data-protection obligations that are no less protective than those in this DPA (including confidentiality, security, retention, and no-own-purpose/no-training terms). SlashHub remains liable to the Customer for the performance of its Sub-processors' data-protection obligations to the same extent SlashHub is liable for its own.

SlashHub shall implement and maintain appropriate technical and organisational measures to protect the Processed Data against unauthorised or accidental access, processing, erasure, loss, or use, having regard to the nature of the data and the harm that could result from a breach. These measures are expected to include, at a minimum: encryption of data in transit; encryption of data at rest; hashed credentials and tokens; least-privilege access control and role-based permissions; per-tenant logical segregation; logging and monitoring; secure software development practices; personnel confidentiality obligations; and an incident-response process.

SlashHub may update the security measures from time to time to reflect advances in technology and changes in risk, provided that the overall level of protection does not materially decrease during the term. SlashHub describes its current measures in general terms (without naming specific vendors) so that it can improve them without amending this DPA.

TimePlate is used to record attendance and location, schedule shifts, and compute hours, overtime, leave, pay, MPF, and related figures for the Customer's employees. The Customer determines what data is collected, how long it is needed for its own employment, tax, and record-keeping purposes, and which features are enabled. SlashHub retains the Processed Data only for as long as necessary to provide TimePlate on the Customer's instructions and otherwise as required by law, and deletes or returns it in accordance with clause 12.

Where the Customer enables face recognition, the face descriptor is used only to verify or identify the Data Subject for attendance. The Customer shall treat biometric data as sensitive and obtain explicit consent as required by clause 3. SlashHub stores biometric data as a processor and, where the Customer enables it, may create a limited number of additional reference captures (a "self-evolving gallery") to improve recognition reliability under changing lighting; the Customer may disable this, reset the gallery, or request deletion at any time.

Data Subjects are the Customer's employees and contractors. The Customer, as data user, is responsible for receiving and responding to their Data Access Requests, correction requests, and other rights requests under the PDPO (and, where applicable, the GDPR). SlashHub will provide the Customer with the functionality (and, on reasonable request, assistance) needed for the Customer to locate, export, correct, or delete the relevant Processed Data so the Customer can meet its obligations within the statutory time limits.

If SlashHub receives a request directly from a Data Subject, it will, unless legally required to act otherwise, direct the request to the Customer and not respond to it substantively, and will notify the Customer without undue delay. The Customer shall not instruct SlashHub to provide false or misleading information in response to a data-subject request.

The Customer acknowledges that SlashHub and its Sub-processors may process and store the Processed Data in Hong Kong and in other jurisdictions where they or their service providers operate, including jurisdictions that may not have data-protection laws identical to the PDPO. Section 33 of the PDPO (restrictions on transferring personal data outside Hong Kong) is not currently in operation, but the Customer remains responsible under DPP3 for ensuring that any transfer is for a purpose same as or directly related to the original purpose of collection, or is otherwise lawful.

To the extent the GDPR/UK GDPR applies, SlashHub will implement an appropriate transfer mechanism (such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum) for transfers of Processed Data out of the EEA/UK, and will process the Processed Data in accordance with clause 4. SlashHub will, on request, make the appropriate transfer documentation available to the Customer.

SlashHub shall notify the Customer without undue delay after becoming aware of a Security Incident affecting the Processed Data and shall provide the information the Customer reasonably needs to meet its own notification obligations (for example, to the PCPD, to a supervisory authority, or to Data Subjects). SlashHub's notification is not, and shall not be construed as, an acknowledgement of fault or liability.

SlashHub shall take reasonable steps to mitigate the Security Incident and to remedy its cause. The Customer, as data user, is responsible for deciding whether, and how, to notify Data Subjects and regulators and for the content of any such notification, and shall not do so in a way that misstates SlashHub's role or that names SlashHub other than as the Customer's processor where that is accurate.

SlashHub shall make available to the Customer information reasonably necessary to demonstrate compliance with this DPA, and shall allow for and contribute to audits, including inspections, by the Customer (or an auditor it mandates) that is not a competitor of SlashHub, subject to: (a) reasonable prior written notice; (b) the auditor entering a confidentiality agreement with SlashHub on terms acceptable to SlashHub; (c) the audit being conducted during business hours and in a manner that does not disrupt the Services or breach other customers' confidentiality; and (d) the Customer bearing its own costs and any reasonable costs SlashHub incurs.

Where SlashHub holds a current independent security certification or audit report, the Customer may rely on it as evidence of the relevant controls instead of conducting its own inspection.

On termination or expiry of the Agreement, on the Customer's written request, SlashHub shall delete or return the Processed Data in SlashHub's possession or control, at the Customer's choice, except to the extent SlashHub is required by law to retain it (for example, under Hong Kong tax and record-keeping law) or needs it to establish, exercise, or defend legal claims. SlashHub may retain the Processed Data for the retention period described in the Privacy Policy and this DPA, after which it will be deleted or anonymised. Backup copies are overwritten or destroyed in the ordinary course.

Until deletion, SlashHub shall continue to protect the Processed Data in accordance with this DPA. The Customer acknowledges that it should export and retain its own copy of any data it is required to keep (for example for the Inland Revenue Ordinance (Cap. 112), the Employment Ordinance (Cap. 57), or MPF purposes) before termination.

Each party's liability under this DPA is subject to the exclusions, limitations, and liability cap in the Terms of Service (including clause 19 and clause 20), and nothing in this DPA increases or extends SlashHub's liability beyond that cap or those exclusions. To the maximum extent permitted by law, the Customer shall indemnify SlashHub against all claims, fines, penalties, losses, and costs arising from: (a) the Customer's failure to give the required Personal Information Collection Statement or to obtain the required consent (including explicit consent for biometric or location data); (b) the Customer's unlawful or inaccurate instructions; (c) the Customer's breach of this DPA or Applicable Data Protection Law; and (d) any claim by a Data Subject, works council, union, or regulator relating to the Customer's processing of the Processed Data.

Nothing in this DPA excludes or limits any liability that cannot lawfully be excluded or limited under Hong Kong law, including under the Control of Exemption Clauses Ordinance (Cap. 71) (for example, liability for death or personal injury caused by negligence). Where a conflict exists between this DPA and the Terms of Service on a data-protection matter, this DPA prevails; on all other matters, the Terms of Service prevail.

This DPA is governed by the laws of the Hong Kong Special Administrative Region of the People's Republic of China and is subject to the dispute-resolution clause (HKIAC arbitration, seat in Hong Kong) in the Terms of Service.

Data-protection enquiries and notices: privacy@slashhub.hk.

Data Protection Officer: SlashHub Data Protection Officer, dpo@slashhub.hk.