legal
data processing agreement
Effective date: October 21, 2026
This Data Processing Agreement ("DPA") is part of the Harvexstack Terms of Service between the customer ("Customer", the data controller) and HarvexStack Company ("Harvexstack", "Processor"). It applies whenever Harvexstack processes personal data on the Customer's behalf through the Services, including employee time, attendance and wage data in HarvexTime and customer data in HarvexPOS. It is written to meet applicable data protection laws, including those of Cambodia and the United States.
1. Scope of processing
| Item | Details |
|---|---|
| Purpose | Providing, securing and supporting the Services the Customer subscribes to |
| Data subjects | Customer's employees and team members; Customer's own customers |
| Personal data | Names, contact details, employee IDs, shifts, clock-in and clock-out times, hours, wage rates, pay totals, sales and purchase records, device and login data |
| Sensitive data | Not intended. The Customer should not enter health, biometric, religious or other sensitive data unless a feature is designed for it and the Customer has a legal basis |
| Duration | The subscription term plus the deletion period in section 8 |
2. Customer's responsibilities
The Customer decides what data is entered and why, and is responsible for having a lawful basis, giving its employees and customers a privacy notice, handling their rights requests, and keeping records the law requires (for example wage and time records under labour law). Harvexstack will help as described below.
3. Processor's obligations
Harvexstack will:
- Process personal data only on the Customer's documented instructions, which are these Terms, this DPA and the Customer's use of the Services, and tell the Customer if an instruction seems to break the law.
- Not sell the data or use it for its own purposes, such as advertising.
- Ensure anyone authorised to access the data is bound by confidentiality.
- Keep the security measures in section 5.
- Help the Customer respond to data-subject requests (access, correction, deletion, export) through the Services' tools or on request.
- Help the Customer with breach notifications and any data protection assessments, as reasonably needed.
- Make available the information needed to show compliance with this DPA.
4. Sub-processors
The Customer authorises Harvexstack to use these sub-processors:
| Sub-processor | Service | Location |
|---|---|---|
| Hosting provider | Hosting, storage, backups | United States or other countries with appropriate safeguards |
| Payment provider | Billing (account owner data only) | United States or other countries with appropriate safeguards |
| Email provider | Service emails | United States or other countries with appropriate safeguards |
Harvexstack will bind each sub-processor to data protection terms at least as protective as this DPA, remains responsible for them, and will give at least 30 days' notice before adding or replacing one. The Customer may object on reasonable data protection grounds and, if no solution is found, cancel and receive a refund of any prepaid unused period. We will list our sub-processors by name on request.
5. Security measures
- Encryption in transit (TLS) and at rest
- Logical separation of each Customer's workspace
- Role-based access, least privilege and strong authentication for administrative access
- Access and audit logs, including who viewed or changed wage data, kept for at least 90 days
- Regular backups and tested restore procedures
- Prompt security patching and dependency updates
6. Personal data breaches
Harvexstack will notify the Customer without undue delay, and in any case within 48 hours of becoming aware of a breach affecting Customer data, with what is known about its nature, the data and people affected, likely consequences and measures taken, so the Customer can meet its own legal obligations.
7. International transfers
Customer data may be stored or processed outside the Customer's country by Harvexstack or its sub-processors. Harvexstack will only do so where the destination provides adequate protection or appropriate safeguards are in place, such as contractual clauses, as required by applicable law.
8. Return and deletion
When the subscription ends, the Customer may export its data for 30 days. Harvexstack will then delete the Customer's personal data within 60 days, and from backups within 90 days, unless the law requires it to keep some data longer, in which case it will keep it protected and use it only for that purpose.
9. Audits
On reasonable written request, not more than once a year, Harvexstack will answer the Customer's security questionnaire and provide relevant documentation. On-site audits require 30 days' notice, are at the Customer's cost, and must not access other customers' data.
10. Liability and order of precedence
The liability limits in the Terms apply to this DPA, except where the law does not allow them to. If this DPA conflicts with the Terms on data protection, this DPA prevails.
11. Contact
Data protection questions: [email protected]