Data Processing Agreement (DPA)

Version 2026-10-19, in force from 19 October 2026

Annex 4 — Personal Data Processing Agreement, under art. 28 of Regulation (EU) 2016/679 (GDPR) — part of the PayWise Terms of Use or an annex to the service agreement, as applicable.

1. The parties and their roles

1.1. The Client is the controller, and the Provider (DO IT WISE NOT TWICE S.R.L.) is the processor acting on behalf of the controller for the personal data that the Client and its Users upload, import or generate in the Platform.

1.2. The terms used have the meaning given in the GDPR (personal data, processing, data subject, personal data breach etc.) and in the agreement.

1.3. In the event of a conflict between this agreement and the service agreement, this agreement prevails for everything relating to personal data (art. 3.2 of the agreement).

1.4. Where the Client has not signed a service agreement, “the agreement” means the PayWise Terms of Use published on paywise.ro, and references to articles of the agreement apply to the corresponding provisions of those terms.

2. Description of the processing

Categories of data:

a) identification: surname, first name, payroll number or internal identifier, the unique code calculated from the personal numeric code (CNP) (the CNP itself is not kept — point 2.2);

b) employment data: job, COR (Romanian occupation classification) code, department, direct manager, hiring date and length of service, working time, type of contract, executive or management position;

c) gender, necessary for calculating the pay gap;

d) pay: gross monthly income from the D112 tax return and its components (base salary, allowances, bonuses, other complementary or variable components), the salary on the employee record, hours paid;

e) contact data: work e-mail address;

f) job data provided by employees: answers to the job questionnaire, the manager's validation;

g) evaluation and decision data: job scores, reasons, comments and opinions, information requests and answers;

h) User data: name, e-mail, role, password (kept only as an irreversible derived value — hash), the audit log of actions, technical session data (IP address, time), used for security.

2.2. The CNP. On import, the CNP is used only to calculate a unique and stable code (HMAC, with a secret key kept only on the server and calculated from company + CNP), and is then discarded. The CNP is not saved in the database, in logs, in temporary files or in error messages.

2.3. Special categories of data. The Platform does not request and does not intentionally process special categories of data (art. 9 of the GDPR). The Client does not enter such data in the free-text fields. From the D112 tax return, the Platform uses only the amounts; the type of absence (for example, sick leave) is not imported and not displayed.

3. The Provider's obligations

The Provider:

a) processes the data only on the documented instructions of the Client: the agreement, this agreement and the Users' actions in the Platform constitute the complete instructions; a new instruction is given in writing. If, in the Provider's opinion, an instruction infringes the GDPR or another law, the Provider informs the Client immediately;

b) does not use the data for any other purpose, does not sell it and does not use it to train artificial intelligence models;

c) ensures that the persons authorised to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality, and grants them access only as far as necessary;

d) applies the technical and organisational measures in Annex 5 (art. 32 of the GDPR) and does not reduce them during the term of the agreement;

e) respects the conditions for engaging sub-processors (point 5);

f) assists the Client, through appropriate technical and organisational measures, in responding to data subjects' requests (point 7);

g) assists the Client in meeting its obligations under art. 32–36 of the GDPR (security, breach notification, impact assessment, prior consultation), taking into account the nature of the processing and the information available to it;

h) on termination of the agreement, returns and deletes the data in accordance with point 9;

i) makes available to the Client the information necessary to demonstrate compliance with art. 28 of the GDPR and allows audits in accordance with point 8;

j) keeps a record of the processing activities carried out on behalf of the Client (art. 30(2) of the GDPR).

4. The Client's obligations

The Client:

a) has a legal basis for the processing (mainly art. 6(1)(c) of the GDPR — the legal obligation under Directive (EU) 2023/970 and the transposing law) and for transferring the data to the Provider;

b) informs its employees and Users about the processing (art. 13–14 of the GDPR), including about the use of the Platform;

c) uploads only the data necessary for the purpose (data minimisation);

d) manages the Users' accounts and their access rights;

e) decides whether to activate the AI Module (point 5.4).

5. Sub-processors

5.1. The Client gives its general authorisation for the Provider to use the sub-processors below:

The encrypted backup copies are kept on the production server. An external storage provider for the encrypted copies (without access to the decryption key) will be added following the procedure in point 5.3.

5.2. The following are not sub-processors for the Client's Data, because they do not receive it:

• SmartBill (issuing invoices; it processes the Client's billing data, for which the Provider is the controller — art. 12.3 of the agreement);
• the availability monitoring service (it receives only technical signals, no personal data);
• the source code repository (code, no client data).

5.3. Changes to the list. The Provider notifies the Client by e-mail at least 30 days before adding or replacing a sub-processor. The Client may object, with reasons, within this period. If the Parties do not find a solution, the Client may terminate the agreement before the change applies to its data, with a pro-rata refund of the price paid for the remaining period. In an emergency (for example, the sudden discontinuation of a provider's service), the period may be shorter, with immediate notice to the Client.

5.4. The AI Module. Data reaches Anthropic only if the HR Administrator activates the AI Module. The module writes narrative texts based on figures already calculated and, if COR code suggestions are activated at the Client's request, proposes COR codes based on the job title, the department and the job profile; it does not score jobs, does not propose levels and does not make pay decisions. Under Anthropic's commercial terms for the API, inputs and outputs are deleted after the retention period set out in Anthropic's terms (currently, at most 30 days), except for longer retention for usage policy violations or legal obligations, and are not used to train models.

5.5. The Provider imposes on each sub-processor, by contract, data protection obligations at least equivalent to those in this agreement and is liable to the Client for it.

6. Place of processing and transfers

6.1. The data is stored and processed in the European Union.

6.2. The only possible transfer outside the EEA is the one to Anthropic, only if the AI Module is activated, with the safeguards in art. 44–46 of the GDPR: the standard contractual clauses included in Anthropic's data processing agreement and, where applicable, the EU–US Data Privacy Framework.

6.3. The Provider's development tools, including AI coding assistants, have no access to the production environment or to the Client's Data; development and testing are done on a separate server, with test data only.

7. Data subjects' rights

7.1. If it receives a request directly from a data subject, the Provider forwards it to the Client within 5 working days and does not reply directly to the person, other than to acknowledge receipt, except on the Client's instruction.

7.2. The Platform allows the Client to: consult and export a person's data, rectify imported data by re-uploading or editing, deactivate a User's account, delete the data on termination. For what cannot be done from the Platform, the Provider helps on request, within 10 working days.

7.3. The data in approved decisions and in the evidence file is not changed retroactively, because it serves as evidence (art. 18 of Directive (EU) 2023/970); the Client decides, as controller, how to respond to a request for erasure or rectification concerning it.

8. Information and audit

8.1. On request, no more than once a year, the Provider answers within 30 days a reasonable security questionnaire from the Client and makes the relevant documentation available to it.

8.2. The Client, or an independent auditor mandated by it, bound by confidentiality and not a competitor of the Provider, may carry out an audit, with 30 days' notice, no more than once a year, on working days, without disrupting the Services and without access to other clients' data. The costs of the audit are borne by the Client.

8.3. The once-a-year limit does not apply after a personal data breach concerning the Client or at the request of a supervisory authority.

8.4. Technical security tests (scans, penetration tests) are carried out only with the Provider's prior written consent (art. 7.2(d) of the agreement).

9. Personal data breach

9.1. The Provider notifies the Client without undue delay, and at the latest within 48 hours of becoming aware of a personal data breach concerning it, at the contact persons in the Order.

9.2. The notification includes, as far as known: the nature of the breach, the categories and approximate number of persons and records, the likely consequences, the measures taken or proposed and the contact person. Information that is not immediately available is provided in stages, without undue delay.

9.3. The Provider immediately takes the measures necessary to limit the effects, preserves the evidence and cooperates with the Client on notifying the authority (art. 33) and, where applicable, the data subjects (art. 34). The notification to the authority and to the data subjects is made by the Client, as controller.

10. Duration, return and deletion

10.1. This agreement applies for the term of the service agreement and for as long as the Provider still holds Client Data.

10.2. On termination, art. 13 of the agreement applies: 30 days of read-only access and full export on request, then deletion within 30 days at most, with backup copies overwritten within 14 days at most of the deletion. On request, the Provider confirms the deletion in writing.

10.3. The Provider keeps the data only if Union or Romanian law requires it to be kept, and only for that purpose.

11. Anonymised data

11.1. The Client authorises the Provider to anonymise the Client's Data and to use the result only in the form of aggregated statistics, to improve the Platform and for general benchmarks (for example, the distribution of pay gaps by sector), subject to the following conditions:

a) the statistics combine data from at least 5 clients and do not allow the identification of the Client, of an employee or of a User;

b) identifiable Client data is never published (art. 17.4 of the agreement).

11.2. Anonymised data is no longer personal data.

12. Liability

The Parties' liability for this agreement is determined in accordance with art. 82 of the GDPR and art. 10 of the agreement, including the special limit in art. 10.4.

13. Acceptance

13.1. This agreement is accepted electronically by the HR Administrator, on behalf of the Client, when the account is created or at the first login after a new version is published. PayWise keeps the accepted version, the date, the user and the company.

13.2. Clients with a signed service agreement may also sign this agreement as an annex to the service agreement; in that case, the signed version prevails.