Data Processing Addendum

Roles

For employee and workspace data, the customer is the controller and DijiPeople is the processor. The customer decides what is collected and why.

For enquiry, account and billing data, DijiPeople is the controller.

Scope of processing

DijiPeople processes customer data only to provide the service: storing it, making it available to the customer's authorised users, and performing the functions the customer invokes. It is not used for any other purpose, and it is not sold.

Sub-processors

Listed on the Subprocessors page with purpose and status. That page is the authoritative list.

Security

The controls in place are described in the Security document. That list is deliberately limited to what exists.

Assistance

DijiPeople assists the customer in responding to data-subject requests. Because the customer controls workspace data, such requests are directed to them.

Deletion

On termination, the retention window and holds described in the Data Retention Policy apply, after which data is erased.

International transfers

Where a subprocessor or hosting provider processes data outside the customer's country, DijiPeople will use the contractual and organisational measures available through that provider and any additional transfer mechanism required by applicable law. The current Subprocessors document identifies the providers used by the service.

Security incidents

DijiPeople will notify the customer without undue delay after becoming aware of a confirmed personal-data breach affecting customer data and will provide the information reasonably available to support the customer's regulatory or data-subject obligations.

Audit and information rights

On reasonable written request, DijiPeople will provide information reasonably necessary to demonstrate the processing and security commitments in this DPA. Any broader audit request must protect other customers' confidentiality and the security of the platform and may be subject to reasonable scope, timing and cost controls.

Liability

Liability under this DPA is subject to the liability provisions of the agreement or Terms of Service governing the customer's use of DijiPeople, except where applicable law requires otherwise.

The operator

This service is provided by DijiPeople (SMC-PRIVATE) LIMITED, a company incorporated in Pakistan under SECP registration number 38252358, with its registered office at Hasan Lodge, Block 7, F.B. Area, Karachi, Pakistan and National Tax Number 748234783.

These terms are governed by the laws of Pakistan.