Data Processing Addendum (DPA)

This Data Processing Addendum (“DPA”) forms part of the End User License Agreement (“Agreement”) between Cubic Logics (“Cubic Logics”, “Processor”, “We”, “Apps365”, “HR365”) and the customer identified in the applicable Agreement (“Customer”, “Controller”, “You”).

This DPA applies where Cubic Logics processes Personal Data on behalf of the Customer in connection with the Application.

1. Definitions

Capitalized terms not defined in this DPA have the meanings given in the Agreement or GDPR.

Applicable Data Protection Laws means GDPR, UK GDPR, CCPA/CPRA (where applicable), and other applicable privacy laws. Personal Data means any information relating to an identified or identifiable natural person. Processing has the meaning given in Article 4 of GDPR. Sub-processor means any third party engaged by Cubic Logics to process Personal Data.

2. Roles Of The Parties

Customer acts as the Data Controller (or Business under CCPA).
Cubic Logics acts as the Data Processor (or Service Provider). Cubic Logics shall process Personal Data only on documented instructions from the Customer.

3. Details Of Processing Subject Matter

Provision of the Application Duration: For the term of the Agreement Nature & Purpose: Hosting, processing, support, maintenance, analytics, and security Categories of Data Subjects: Customer employees, contractors, end users Types of Personal Data: identifiers, account data, usage data, customer-provided content.

4. Microsoft 365 Data Architecture

Most Applications are designed to operate within the Customer’s Microsoft 365 environment. Customer content and core application data processed by the Application remain within the Customer’s Microsoft 365 tenant and are not stored on Cubic Logics’ infrastructure. Cubic Logics does not independently host, persist, or retain Customer production data generated through normal use of the Application.

This DPA applies only to Personal Data, if any, that the Customer voluntarily provides to Cubic Logics outside of the Customer’s tenant environment, including for purposes such as application development, licensing, renewal, support, troubleshooting, diagnostics, or similar services.

5. Processor Obligations

Cubic Logics shall;

Process Personal Data only on documented instructions;

Ensure confidentiality of authorized personnel;

Implement appropriate technical and organizational measures;

Assist with data subject requests;

Notify the Customer of any Personal Data Breach without undue delay, taking into account the nature of the breach and information reasonably available;

Assist, where reasonably required and technically feasible, with data protection impact assessments (DPIAs);

Delete or return Personal Data upon termination unless required by law.

6. Cubic Logics Shall

Process Personal Data only on documented instructions; Ensure confidentiality of authorized personnel; Implement appropriate technical and organizational measures; Assist with data subject requests; Notify the Customer of any Personal Data Breach without undue delay, taking into account the nature of the breach and the information reasonably available to Cubic Logics; Assist, where reasonably required and technically feasible, with data protection impact assessments (DPIAs);
Delete or return Personal Data upon termination unless required by law.

7. Security Measures

Cubic Logics implements reasonable safeguards including access controls, encryption, logging, monitoring, and secure development practices.

8. Sub-processing

Customer authorizes Sub-processors. Cubic Logics shall impose equivalent obligations and remain responsible for Sub-processor performance.

9. International Data Transfers

Appropriate safeguards, including Standard Contractual Clauses (SCCs), shall apply where required.

10. Government Access Requests

If Cubic Logics receives a legally binding request from a public authority for disclosure of Personal Data, Cubic Logics shall notify the Customer unless prohibited by law.

11. Data Subject Rights

Cubic Logics shall assist Customer in fulfilling applicable data subject rights requests.

12. Audit Rights

Audit rights under this DPA shall apply only where expressly granted in advance in a written agreement executed by Cubic Logics and an enterprise Customer, and solely to the extent required by applicable data protection laws.

Absent such express written agreement, no audit rights are granted, and Cubic Logics may satisfy its compliance obligations under this DPA through the provision of independent third-party audit reports or certifications. Customer may audit Cubic Logics’ compliance with this DPA no more than once per year, upon reasonable written notice.

13. CCPA / CPRA

Cubic Logics acts as a Service Provider and does not sell or share Personal Data.

14. Liability

Liability under this DPA is subject to the limitations set forth in the Agreement.

15. Termination

This DPA terminates automatically upon termination of the Agreement.

16. Order Of Precedence

This DPA prevails over the Agreement with respect to data protection matters.

17. Governing Law

This DPA follows the governing law of the Agreement.

18. Eu Standard Contractual Clauses (Module Two)

EU Standard Contractual Clauses (Controller to Processor) are incorporated by reference. Customer is the Data Exporter;

Cubic Logics is the Data Importer.
Docking Clause applies; Sub-processor authorization Option 2 applies. Governing Law: Ireland. Jurisdiction: Courts of Ireland.

ANNEX I – TECHNICAL AND ORGANIZATIONAL MEASURES
Organizational measures include security policies, employee training, access controls, and incident response procedures. Technical measures include encryption (where applicable), authentication, monitoring, logging, and patch management.
These measures are aligned with industry-recognized standards such as ISO/IEC 27001.

ANNEX II – AI DATA PROCESSING ADDENDUM
AI Data may include Customer-provided inputs and AI-generated outputs. AI Data constitutes Customer Data. Aggregated and anonymized AI Data may be used for service improvement.

Cubic Logics does not use Customer Personal Data to train generalized AI models for third parties.
For purposes of the EU Artificial Intelligence Act, Cubic Logics acts as the provider of AI Features and the Customer acts as the deployer.