1. Scope and Roles
This Data Processing Addendum forms part of the MSA between DTS Services Ltd (the "Provider" or "Processor") and the Client (the "Controller") to the extent the Provider processes personal data on behalf of the Client through CyPay. It is intended to address the processor obligations under Article 28 GDPR and applicable Cyprus data-protection law.
This DPA does not govern personal data for which the Provider independently determines the purposes and means of processing as controller; such processing is described in the Privacy Policy.
2. Processing Details
| Element | Description |
|---|---|
| Subject matter | Hosting, storage and software processing of payroll, employee and authorised-user data to provide CyPay and related support/security functions. |
| Duration | For the term of the Agreement, including the relevant Licence Year(s), and any agreed return, restricted archive, backup and deletion period. |
| Nature and purpose | Payroll calculations; reports/payslips/exports; account access; hosting/storage; support/troubleshooting; logging; security monitoring; backup; disaster recovery; service maintenance. |
| Data subjects | Client employees, directors, workers or contractors; employees/workers of the Client's customers where the Client provides payroll services; authorised Users and administrators to the extent their data is processed on Client instructions. |
| Personal data | Identification/contact/employment information; salary, benefits, deductions, tax, social insurance, leave, overtime, commission and payroll history; account roles and access logs; other personal data lawfully entered by the Client. |
3. Documented Instructions
The Provider shall process personal data only on documented instructions from the Client, including instructions contained in the MSA, this DPA and normal authorised use of the Platform, unless processing is required by Union or Member State law. Where legally permitted, the Provider shall inform the Client before such legally required processing.
If the Provider considers a Client instruction to infringe applicable data-protection law, it shall inform the Client and may suspend the affected processing until the instruction is clarified or lawfully revised.
4. Confidentiality and Personnel
The Provider shall ensure that persons authorised to process Client personal data are subject to appropriate confidentiality obligations and receive access only as necessary for their functions.
5. Security of Processing
The Provider shall implement and maintain appropriate technical and organisational measures taking account of the nature, scope, context and purposes of processing and the risks to individuals. The current measures are described in the Security Measures, which form part of the contractual security framework. Measures may evolve provided the overall level of protection is not materially reduced.
6. Sub-Processors
The Client gives general authorisation for the Provider to appoint sub-processors required for hosting, infrastructure, email/communications, security, backup, support and related service functions. The Provider shall impose written data-protection obligations on each sub-processor that are appropriate to the services provided and consistent with applicable GDPR requirements.
The Provider shall maintain a current list of material sub-processors and make it available to the Client on request. Where reasonably practicable, the Provider shall give advance notice of a material new or replacement sub-processor. The Client may raise a reasonable, documented data-protection objection within fifteen (15) days of notice. The parties shall work in good faith to address the concern; if no reasonable solution is available, either party may terminate the materially affected service in accordance with the MSA.
7. International Transfers
The Provider shall not transfer Client personal data outside the EEA unless a lawful transfer mechanism is available where required, such as an adequacy decision or Standard Contractual Clauses, together with supplementary safeguards where appropriate. Production hosting arrangements described in the Security Measures are intended to remain within the EEA.
8. Data Subject Requests
Taking into account the nature of processing, the Provider shall assist the Client by appropriate technical and organisational measures, insofar as reasonably possible, to respond to requests by data subjects exercising their rights. The Provider shall not independently respond to a request concerning Client-controlled payroll data except on the Client's instructions or where required by law.
9. Security Incidents and Personal Data Breaches
The Provider shall notify the Client without undue delay after becoming aware of a personal data breach affecting Client personal data and shall provide information reasonably available to assist the Client with its legal obligations. The Client remains responsible for notifications to supervisory authorities or data subjects unless applicable law requires otherwise. The Provider's notification of an incident is not an admission of fault or liability.
10. Assistance with Compliance
Taking into account the nature of processing and information available to it, the Provider shall provide reasonable assistance with the Client's obligations concerning security of processing, breach assessment/notification, data-protection impact assessments and prior consultation where required. Reasonable additional work outside ordinary service operation may be charged if agreed in advance, except where caused by the Provider's breach of this DPA.
11. Return, Restricted Archive and Deletion
On expiry or termination, the Provider shall, at the Client's choice where technically and legally feasible, return/export or delete Client personal data in accordance with the MSA. Unless otherwise agreed, the MSA permits a restricted archive for up to fifteen (15) months for limited retrieval/continuity purposes. Archived data shall not be used for unrelated purposes and ordinary access may be disabled.
After the applicable archive period or earlier lawful deletion instruction, Client personal data shall be deleted from active systems, subject to legal-retention requirements and normal backup cycles. Residual backups may remain until overwritten or expired, shall remain protected and shall not be restored for ordinary use except where necessary for disaster recovery, security or legal compliance.
12. Information and Audits
The Provider shall make available information reasonably necessary to demonstrate compliance with this DPA. Where the Client reasonably requires an audit, the parties shall first use available documentation, security information and remote evidence. Any on-site audit shall be subject to reasonable prior notice, confidentiality, security restrictions, normal business hours and measures to protect other Clients. The Client shall bear reasonable audit costs unless the audit identifies a material breach by the Provider or law requires otherwise.
13. Controller Responsibilities
- ensure a lawful basis and appropriate transparency for the personal data supplied to the Provider;
- ensure Client Data and instructions are accurate, lawful and within the agreed purposes;
- limit access to authorised Users and maintain appropriate account security;
- not instruct the Provider to process personal data unlawfully;
- notify the Provider promptly of relevant security incidents, unlawful access or requests requiring assistance.
14. Liability and Precedence
Liability under this DPA is subject to the liability framework in the MSA to the extent permitted by applicable law. If this DPA conflicts with another contractual document concerning processing of personal data, this DPA prevails.
15. Changes and Version Control
Version 1.1. Revision date: 3 September 2026. Effective date: 3 September 2026. The Provider may make non-material administrative or security updates and changes required by law, provided they do not materially reduce data-protection safeguards. Other material amendments affecting existing Clients shall be agreed or implemented in accordance with the MSA and applicable law.