OpenPlex Data Processing Agreement

Version 1.0, effective [DD Month 2026] Published at: https://openplex.io/dpa

This Data Processing Agreement (the "DPA") forms part of the OpenPlex Terms of Service (the "Terms") between Odren Ltd, a private limited company incorporated in England and Wales under company number 15944303, with registered office at 7 Manchester Square, London, W1U 3PQ, United Kingdom ("Odren" or the "Processor"), and the organisation that has accepted the Terms (the "Customer" or the "Controller").

The DPA is accepted together with the Terms and requires no separate signature. A Customer that requires a countersigned copy may request one from legal@openplex.io.

1. Definitions

1.1 Capitalised terms not defined in this DPA have the meaning given in the Terms.

1.2 In this DPA:

• "Applicable Data Protection Law" means all laws on the protection of personal data applicable to the processing under this DPA, including the UK GDPR and the Data Protection Act 2018 (the "UK Data Protection Law"), Regulation (EU) 2016/679 (the "EU GDPR"), and the Swiss Federal Act on Data Protection of 25 September 2020 and its ordinances (the "FADP"), in each case as amended or replaced.
• "Customer Personal Data" means personal data contained in Customer Data that Odren processes on behalf of the Customer in providing the Service.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data processed by Odren or its Subprocessors.
• "Subprocessor" means any third party engaged by Odren that processes Customer Personal Data.
• "Restricted Transfer" means a transfer of Customer Personal Data to a country that is not recognised under Applicable Data Protection Law as providing an adequate level of protection, where that transfer would be prohibited without additional safeguards.
• "EU SCCs" means the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914.
• "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
• The terms "controller", "processor", "data subject", "personal data", "processing", "special categories of personal data" and "supervisory authority" have the meanings given in Applicable Data Protection Law. Under the FADP, "controller" and "processor" have the meaning of "controller" (Verantwortlicher) and "processor" (Auftragsbearbeiter), and "special categories" includes "sensitive personal data".

2. Scope and roles

2.1 Scope. This DPA applies to the processing of Customer Personal Data by Odren on behalf of the Customer in providing the Service. It does not apply to personal data for which Odren is controller, such as user account, authentication, security, billing and support data, which is described in the OpenPlex Privacy Policy.

2.2 Roles. The Customer is the controller of Customer Personal Data and Odren is its processor. Where the Customer acts as processor on behalf of another controller, for example within a group of companies, Odren acts as its subprocessor, and the Customer warrants that its instructions and engagement of Odren have been authorised by that controller.

2.3 Details of processing. The subject matter, duration, nature and purpose of the processing, and the types of personal data and categories of data subjects, are described in Annex I.

3. Customer obligations

3.1 The Customer is responsible for:

• (a) the lawfulness of the processing, including having a valid legal basis and, for special categories of personal data, any additional condition required;
• (b) providing data subjects with the information required by Applicable Data Protection Law, including its employee privacy notice;
• (c) the accuracy, quality and minimisation of the Customer Personal Data it uploads;
• (d) configuring roles and permissions in the Service so that Users only access the data they need;
• (e) determining and applying its own retention periods, including through the retention and deletion functions available in the Service;
• (f) ensuring that its instructions comply with Applicable Data Protection Law.

3.2 The Customer acknowledges that the Service is not designed to process personal data relating to criminal convictions and offences, and will not upload such data unless permitted by law and strictly necessary for employment purposes.

4. Odren obligations

4.1 Instructions

Odren processes Customer Personal Data only on the documented instructions of the Customer, including with regard to international transfers, unless required to do otherwise by law to which Odren is subject. In that case, Odren informs the Customer of the legal requirement before processing, unless the law prohibits this on important grounds of public interest.

The Customer's complete instructions are this DPA, the Terms and the Customer's configuration and use of the Service by its authorised Users. Additional instructions must be agreed in writing and may be subject to reasonable charges where they require work outside the standard Service.

Odren informs the Customer without delay if, in its opinion, an instruction infringes Applicable Data Protection Law. Odren is not required to carry out legal assessments of the Customer's processing.

4.2 Purpose limitation

Odren does not process Customer Personal Data for its own purposes. In particular, Odren does not sell Customer Personal Data, use it for advertising, or use it to train general-purpose artificial intelligence models. Odren may create aggregated and anonymised statistics that do not identify the Customer, Users or data subjects, solely to operate, secure and improve the Service.

4.3 Confidentiality

Odren ensures that personnel authorised to process Customer Personal Data are bound by appropriate obligations of confidentiality, have received training on data protection appropriate to their role, and access Customer Personal Data only to the extent necessary to provide the Service, support requested by the Customer, address a security incident or comply with law.

4.4 Operator access

Odren's internal operator tools display company-level administrative metadata, such as plan, billing state and module configuration. They do not give routine access to employee records. Any exceptional access by Odren personnel to Customer Personal Data is restricted to named personnel, limited to the purpose and logged.

4.5 Security

Odren implements and maintains the technical and organisational measures described in Annex II. Odren may update those measures, provided that the overall level of protection is not reduced.

5. Subprocessors

5.1 General authorisation. The Customer grants Odren a general authorisation to engage Subprocessors. The Subprocessors engaged at the effective date are listed in Annex III and are approved by the Customer.

5.2 Subprocessor obligations. Odren engages each Subprocessor under a written contract imposing data protection obligations that offer at least the same level of protection as this DPA, to the extent applicable to the service provided. Odren remains responsible to the Customer for the performance of its Subprocessors' obligations.

5.3 Changes. Odren notifies the Customer of any intended addition or replacement of a Subprocessor at least 30 days in advance, by email to the Customer's workspace administrators and by updating the subprocessor list. In case of an urgent replacement needed to maintain the security or continuity of the Service, Odren gives notice as soon as practicable.

5.4 Objection. The Customer may object to a new Subprocessor on reasonable grounds relating to data protection by writing to privacy@openplex.io within the notice period. The parties will discuss the objection in good faith. If Odren cannot offer a reasonable alternative, the Customer may terminate the affected subscription with effect before the new Subprocessor is used for its data, and Odren will refund prepaid fees for the unused period.

6. International transfers

6.1 Odren location. Odren is established in the United Kingdom. Transfers from the EEA to Odren rely on the European Commission's adequacy decision for the United Kingdom under the EU GDPR, renewed on 19 December 2025 and valid until 27 December 2031. Transfers from Switzerland to Odren rely on the recognition of the United Kingdom as providing adequate protection under Annex 1 of the Swiss Data Protection Ordinance.

6.2 Onward transfers. Odren will make a Restricted Transfer to a Subprocessor only where one of the following safeguards applies:

• (a) the destination benefits from an adequacy decision or recognition under Applicable Data Protection Law, including certification of the recipient under the EU-U.S. Data Privacy Framework, its UK Extension or the Swiss-U.S. Data Privacy Framework, as applicable; or
• (b) Odren and the Subprocessor have entered into the EU SCCs (Module 3, processor to processor), supplemented by the UK Addendum for UK transfers and with the adaptations required by the FDPIC for Swiss transfers; or
• (c) another transfer mechanism permitted by Applicable Data Protection Law.

6.3 Fallback. If a transfer mechanism relied upon is invalidated or ceases to apply, including on expiry of the UK adequacy decision without renewal, the parties will cooperate in good faith to implement an alternative lawful mechanism. Where required, the EU SCCs (Module 2, controller to processor) with the Customer as data exporter and Odren as data importer are incorporated by reference into this DPA, with the options set out in Annex IV.

6.4 Transfer assessments. Odren will provide reasonable information to enable the Customer to carry out any transfer impact assessment required by Applicable Data Protection Law.

7. Assistance to the Customer

7.1 Data subject requests. Taking into account the nature of the processing, Odren assists the Customer through appropriate technical and organisational measures, including the export, correction and deletion functions of the Service, to respond to requests from data subjects exercising their rights. If Odren receives a request directly from a data subject relating to Customer Personal Data, it will forward the request to the Customer without undue delay, and in any event within 5 business days, and will not respond except to direct the data subject to the Customer, unless the Customer authorises otherwise.

7.2 Other assistance. Odren provides reasonable assistance to the Customer, taking into account the nature of the processing and the information available to Odren, with:

• (a) the security of processing;
• (b) notification of Personal Data Breaches to supervisory authorities and data subjects;
• (c) data protection impact assessments and prior consultations with supervisory authorities.

7.3 Costs. Assistance through the standard functions of the Service is provided free of charge. Odren may charge reasonable fees, agreed in advance, for assistance that goes beyond those functions, except where the assistance is needed because of Odren's breach of this DPA.

8. Personal Data Breaches

8.1 Odren notifies the Customer of a Personal Data Breach without undue delay, and in any event within 48 hours after becoming aware of it, by email to the Customer's workspace administrators.

8.2 The notification describes, to the extent known: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; and a contact point for further information. Where not all information is available at once, Odren provides it in phases without undue further delay.

8.3 Odren promptly takes reasonable steps to contain, investigate and mitigate the breach, and keeps a record of it. Notification by Odren is not an acknowledgement of fault or liability.

8.4 The Customer is responsible for any notification to supervisory authorities and data subjects required of a controller. Odren will not notify supervisory authorities or data subjects of a breach affecting Customer Personal Data on the Customer's behalf unless instructed by the Customer or required by law.

9. Return and deletion

9.1 During the subscription, the Customer can export, correct and delete Customer Personal Data through the Service.

9.2 After the end of the Customer's last subscription or closure of a workspace, the Customer has 30 days to export Customer Personal Data, during which the workspace remains accessible in read-only mode.

9.3 Odren deletes Customer Personal Data from its live systems within 60 days after the end of that export period, unless the Customer instructs earlier deletion, a documented legal hold applies, or law to which Odren is subject requires retention. In that case Odren continues to protect the data under this DPA and processes it only for the purpose requiring its retention.

9.4 Encrypted backups expire on a rolling cycle of approximately 35 days, with at least the last three verified copies retained. Where a backup fails verification or a documented legal hold applies, retention may be extended, but backups are not retained beyond 90 days except under a documented legal hold. Data in backups awaiting expiry is not used for any purpose. If a backup is restored, Odren re-applies prior deletion instructions before restored data is put back into use.

9.5 On written request, Odren confirms deletion in writing.

10. Audits and information

10.1 Odren makes available to the Customer the information reasonably necessary to demonstrate compliance with this DPA and Article 28 of the UK GDPR and EU GDPR and Article 9 of the FADP.

10.2 The Customer agrees to exercise its audit rights first by reviewing the documentation that Odren provides on request, including this DPA, Annex II, the subprocessor list, written responses to reasonable security questionnaires and, where available, third-party certifications or audit reports of Odren or its Subprocessors.

10.3 If that information is insufficient to demonstrate compliance, or where required by a supervisory authority or following a Personal Data Breach, the Customer may carry out an audit, including an inspection, subject to the following conditions:

• (a) at least 30 days' written notice, except where required by a supervisory authority or following a Personal Data Breach;
• (b) no more than once in any 12-month period, except in the cases stated in paragraph (a);
• (c) during business hours, without unreasonable disruption to Odren's operations, and without access to other customers' data or to Odren's confidential information unrelated to the Customer;
• (d) by the Customer or an independent auditor bound by confidentiality and not a competitor of Odren;
• (e) at the Customer's expense, unless the audit reveals a material breach of this DPA by Odren.

10.4 Audits of Subprocessors are carried out through the audit reports and documentation they make available, as their contracts permit.

11. Liability

Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Terms, including section 13.4 of the Terms. Nothing in this DPA limits either party's liability to data subjects or supervisory authorities where Applicable Data Protection Law does not permit limitation.

12. Duration and precedence

12.1 This DPA remains in force for as long as Odren processes Customer Personal Data, including after termination of the Terms until deletion under section 9.

12.2 In case of conflict, the order of precedence is: (a) the EU SCCs and UK Addendum, where incorporated; (b) this DPA; (c) the Terms. On matters of personal data processing, this DPA prevails over the Terms and any order form.

12.3 Odren may update this DPA to reflect changes in Applicable Data Protection Law, Subprocessors or the Service, under the notice procedure in section 14 of the Terms. No update may reduce the overall level of protection of Customer Personal Data without the Customer's agreement.

13. Governing law

This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction, as set out in the Terms, except where the EU SCCs, the UK Addendum or Applicable Data Protection Law require otherwise.

Annex I: Details of processing

Parties

Categories of data subjects

• current, former and prospective employees, workers, trainees and apprentices of the Customer;
• contractors and consultants managed in the Service;
• managers, HR staff and other Users of the Customer;
• emergency contacts, family members or dependants, where entered by the Customer.

Categories of personal data

• identification and contact details: name, work and personal email, telephone, address;
• employment details: employee number, job title, team, manager, location, jurisdiction, employment type, start and end dates;
• onboarding and offboarding: checklist tasks, owners, deadlines and completion records;
• absences: leave requests, approvals, balances and reports;
• development and performance: goals, progress, evidence, review contributions and follow-up actions;
• documents uploaded by the Customer or Users, such as contracts, certificates and policy acknowledgements;
• HR support requests and their follow-up;
• audit trail of actions performed in the Service relating to the above.

Special categories of personal data

The Customer may enter health information, for example reasons for sickness absence or medical certificates, and other special categories of personal data in documents or free-text fields. Odren applies to all Customer Personal Data the measures in Annex II, including role-based access restrictions configurable by the Customer. The Customer is responsible for limiting special categories of personal data to what is strictly necessary.

Nature of processing

Hosting, storage, organisation, structuring, retrieval, display, transmission to authorised Users, notification by email, export, backup, restoration and deletion.

Purpose of processing

Providing the OpenPlex Service to the Customer under the Terms, including support requested by the Customer and maintaining the security of the Service.

Duration

For the duration of the Customer's use of the Service and until deletion under section 9 of this DPA.

Frequency of transfer

Continuous, for the duration of the Service.

Annex II: Technical and organisational measures

Access control and separation

• logical separation of each company workspace, with authorisation enforced both server-side and through database-level access policies;
• role-based access permissions configured by the Customer, applied to all views, aggregates and drill-downs;
• operator tools limited to company-level metadata, with server-side and database-level authorisation, revocation of operator access and audit records of operator actions;
• access to production systems limited to named personnel, protected by multi-factor authentication where supported by the provider.

Authentication

• sign-in by email or through Google or Apple identity providers, managed by Supabase Auth;
• session cookies restricted to authentication and security purposes;
• invitation-based registration controlled by the Customer.

Encryption

• encryption in transit using TLS for all connections to the Service;
• encryption at rest of the database and file storage provided by the hosting provider;
• encryption of backups.

Integrity and audit

• audit trail of relevant actions in the Service, including corrections and history of goals and evidence;
• protection against concurrent stale updates for administrative settings.

Availability and resilience

• daily backups retained on a rolling cycle of approximately 35 days, with at least the last three verified copies retained;
• periodic verification of backups and documented restoration procedure that re-applies prior deletion instructions.

Secure development

• version-controlled source code with peer review of changes;
• automated build, type checking and test suites before deployment;
• separate preview and production environments, with use of synthetic data for testing and demonstrations;
• secrets and keys stored outside the source code.

Organisation

• confidentiality obligations and data protection training for personnel;
• incident response procedure, including notification to Customers within 48 hours;
• due diligence and written data protection terms for Subprocessors.

Annex III: Authorised Subprocessors

Stripe, Google and Apple are not Subprocessors for Customer Personal Data. They process data only for payments or sign-in, as described in the OpenPlex Privacy Policy.

The current list is maintained at [https://openplex.io/subprocessors] and is available on request from privacy@openplex.io.

Annex IV: Transfer mechanism options

Where the EU SCCs are incorporated under section 6.3:

• Module: Module 2 (controller to processor), or Module 3 (processor to processor) where the Customer acts as processor.
• Clause 7 (docking clause): does not apply.
• Clause 9 (subprocessors): Option 2, general written authorisation, with the notice period in section 5.3 of this DPA.
• Clause 11 (redress): the optional language does not apply.
• Clause 13 (supervision): the supervisory authority competent for the Customer under Article 13 of the EU SCCs.
• Clause 17 (governing law): the law of Ireland.
• Clause 18 (forum): the courts of Ireland.
• Annexes I to III of the EU SCCs: completed by Annexes I to III of this DPA.

UK Addendum: Table 1 is completed with the parties' details in Annex I; Table 2 refers to the EU SCCs as incorporated above; Table 3 is completed by Annexes I to III of this DPA; in Table 4, either party may end the UK Addendum as provided in its Section 19.

Switzerland: for transfers subject to the FADP, references to the GDPR are read as references to the FADP, the competent supervisory authority is the Federal Data Protection and Information Commissioner, the term "member state" does not exclude data subjects in Switzerland from bringing claims in their place of habitual residence, and the EU SCCs protect the data of legal entities only to the extent the FADP so requires.

Odren Ltd, 7 Manchester Square, London, W1U 3PQ, United Kingdom, company number 15944303 (England and Wales). Privacy contact: privacy@openplex.io.