Data Processing Addendum

1. When this addendum applies

1.1 This Data Processing Addendum ("DPA") applies whenever Worcia processes personal data on behalf of a client in the course of an engagement, for example when a system we build or run handles your customers' calls, messages, bookings or CRM records.

1.2 It forms part of the Engagement Agreement between you and Worcia and of our Terms of Service. It takes effect when you accept an Engagement Agreement that involves processing personal data for you, and it lasts for as long as we process that data.

1.3 Worcia is a trading name of Hashim, its founder, who runs it as an individual. It is not a registered company. "Worcia", "we" and "us" mean Hashim trading as Worcia. "You" means the client.

1.4 This DPA does not cover personal data we control ourselves, such as inquiries sent through our website or Worcia Console accounts. That data is covered by our Privacy Policy.

2. Definitions

• Client Personal Data: personal data we process on your behalf under the Engagement Agreement.
• Data Protection Laws: all laws on privacy and personal data that apply to the processing, including the EU General Data Protection Regulation (GDPR), the UK GDPR and the UK Data Protection Act 2018, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), and other US state privacy laws.
• Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Client Personal Data.
• Subprocessor: a third party we engage to process Client Personal Data.
• Restricted Transfer: a transfer of Client Personal Data from the European Economic Area (EEA), the UK or Switzerland to a country those laws do not recognize as giving adequate protection.
• SCCs: the standard contractual clauses adopted by the European Commission in Decision (EU) 2021/914, and, for UK data, the UK International Data Transfer Addendum to them.

Terms such as "controller", "processor", "data subject", "personal data" and "processing" have the meanings given in the GDPR. "Business", "service provider", "contractor", "sell" and "share" have the meanings given in the CCPA.

3. Roles

3.1 You are the controller of Client Personal Data, and we are your processor. Where you act as a processor for another controller, we are your subprocessor, and you confirm that the other controller has authorized our appointment.

3.2 Under the CCPA and similar US state laws, you are the business (or controller) and we are your service provider, contractor or processor.

3.3 The details of the processing are in Annex 1. An Engagement Agreement may add details specific to that engagement.

4. Your instructions

4.1 We process Client Personal Data only on your documented instructions. Your instructions are this DPA, the Engagement Agreement, and any further instructions you give us in writing, including through Worcia Console.

4.2 If the law requires us to process Client Personal Data in another way, we will tell you before we do, unless the law forbids it.

4.3 We will tell you immediately if we believe an instruction breaks Data Protection Laws. We may pause the affected work until you confirm or change the instruction.

5. Your responsibilities

5.1 You are responsible for having a lawful basis for the processing, giving the notices and obtaining the consents Data Protection Laws require, and making sure the data you give us is accurate and limited to what the work needs.

5.2 Where a system we build contacts people, records conversations, or uses AI agents, you are responsible for the consents, recording notices and AI disclosures the law requires in your markets. Our Acceptable Use Policy sets out the rules every agent we build follows.

5.3 You will not send us special categories of personal data (such as health data), data about criminal convictions, payment card numbers or government identifiers unless the Engagement Agreement says we will handle them, and states the extra measures that apply.

6. Confidentiality

Everyone who processes Client Personal Data for Worcia is bound by a duty of confidentiality, and has access only to the data they need for the work.

7. Security

7.1 We apply the technical and organizational measures in Annex 2, which match our Security page. They are designed to protect Client Personal Data against Personal Data Breaches, taking into account the nature of the data and the risks involved.

7.2 We may update these measures over time, but we will not reduce the overall level of protection during an engagement.

7.3 Much of the processing happens in systems and accounts that you own, such as your CRM, telephony, messaging and AI provider accounts. The security of those accounts, including who in your organization can access them, is your responsibility. We follow your access rules when we work in them.

8. Subprocessors

8.1 General authorization. You authorize us to use the Subprocessors listed on our Subprocessors page, plus any engagement-specific providers named in your Engagement Agreement.

8.2 Our obligations. Before a Subprocessor processes Client Personal Data, we put a written contract in place that requires it to protect the data to the same standard as this DPA. We remain responsible to you for its performance.

8.3 Notice of new Subprocessors. We will tell you at least 30 days before a new Subprocessor starts processing Client Personal Data, by email to your named contact and by updating the Subprocessors page. If we must replace a Subprocessor urgently, for example because of an outage or security issue, we will tell you as soon as we can.

8.4 Objections. You may object to a new Subprocessor on reasonable data protection grounds by writing to hello@worcia.com (opens in a new tab) within the notice period. We will discuss your concern in good faith and look for an alternative. If we cannot resolve it, you may end the affected part of the services, and we will refund any fees you have prepaid for services not yet performed.

8.5 Accounts in your name. Where a provider is contracted directly by you, in your own name, it is your processor, not our Subprocessor.

9. Helping you meet your obligations

9.1 Data subject requests. If we receive a request from a data subject about Client Personal Data, we will pass it to you promptly and will not respond to it ourselves unless you ask us to. Taking into account the nature of the processing, we will help you respond to requests to exercise rights under Data Protection Laws.

9.2 Other assistance. We will give you reasonable help with data protection impact assessments, consultations with supervisory authorities, and your security obligations, using the information available to us.

9.3 Time involved. Where help takes significant time beyond the engagement, we will agree a fee with you in writing before we start.

10. Personal Data Breaches

10.1 We will notify you without undue delay after becoming aware of a Personal Data Breach affecting Client Personal Data. We aim to do so within 48 hours.

10.2 Our notice will describe, as far as we know them at the time: the nature of the breach; the categories and approximate number of data subjects and records concerned; its likely consequences; the measures taken or proposed to address it and reduce its effects; and a contact for more information. Where we do not have all the information at once, we will provide it in stages, without undue delay.

10.3 We will take reasonable steps to contain the breach and reduce its effects, and cooperate with you in investigating it and in any notices you must give.

10.4 Notifying you of a breach is not an admission of fault or liability.

11. Deletion and return

11.1 When the services end, we will, at your choice, return Client Personal Data to you in a commonly used format or delete it. Unless you tell us your choice within 30 days, we will delete it.

11.2 We delete Client Personal Data from our live systems within 30 days of the services ending, or of your instruction if later. Copies in our encrypted backups are deleted as the backups expire, within 90 days.

11.3 We may keep Client Personal Data where the law requires it. If we do, this DPA continues to protect it, and we use it only for the purpose the law requires.

11.4 On request, we will confirm in writing that deletion is complete.

12. Information and audits

12.1 We will make available the information you reasonably need to show that we meet our obligations under this DPA, including written answers to reasonable security questionnaires and descriptions of the measures in Annex 2.

12.2 Worcia does not currently hold third-party security certifications. If the information we provide is not enough to show compliance, or a supervisory authority requires it, you or an independent auditor bound by confidentiality may audit our compliance. Audits need at least 30 days' written notice, take place during business hours, must not disrupt our other clients or compromise their data, happen no more than once in any 12 months (unless a Personal Data Breach or an authority requires more), and are at your cost.

13. International transfers

13.1 Where processing happens. Worcia's servers are in the European Union (France). Worcia's team works from Pakistan and accesses Client Personal Data remotely. Client Personal Data held in your own systems stays wherever those systems are.

13.2 Restricted Transfers. Where processing under an engagement involves a Restricted Transfer, including access from Pakistan to data from the EEA, the UK or Switzerland, the parties will use the SCCs as the transfer mechanism: Module Two (controller to processor) or Module Three (processor to processor), as applicable, and the UK addendum for UK data. The parties will complete and sign them as part of the Engagement Agreement before the Restricted Transfer begins. For Subprocessors, we use a transfer mechanism recognized under Data Protection Laws, such as an adequacy decision or the SCCs.

13.3 Assessments. We will give you the information you reasonably need to assess any Restricted Transfer, including the laws and practices of the destination country that may affect the protection of the data.

13.4 If the SCCs conflict with this DPA, the SCCs prevail.

14. CCPA and US state privacy law terms

Where Client Personal Data includes personal information under the CCPA or similar US state laws, we:

• 14.1 process it only for the business purposes in the Engagement Agreement and Annex 1;
• 14.2 do not sell or share it;
• 14.3 do not keep, use or disclose it for any purpose other than those business purposes, including any commercial purpose of our own, or outside our direct business relationship with you;
• 14.4 do not combine it with personal information we receive from anyone else, or collect ourselves, except as the CCPA allows;
• 14.5 comply with the CCPA and give it the level of privacy protection the CCPA requires;
• 14.6 tell you if we can no longer meet these obligations;
• 14.7 allow you to take reasonable and appropriate steps to stop and remedy any unauthorized use of it;
• 14.8 do not use it to train AI models, ours or anyone else's.

We understand and will comply with these restrictions. Sections 6, 8, 11 and 12 also meet the processor contract requirements of other US state privacy laws, such as those of Colorado, Connecticut and Virginia.

15. Liability and priority

15.1 Each party's liability under this DPA is subject to the limits in the Terms of Service and the Engagement Agreement, except where Data Protection Laws do not allow those limits to apply.

15.2 If documents conflict on data protection matters, this order applies: the SCCs (where they apply), then this DPA, then the Engagement Agreement, then the Terms of Service.

16. Changes

We may update this DPA to reflect changes in law or in how we work. We will tell clients with an active engagement before a change takes effect, and no change will reduce the protection of Client Personal Data during an engagement without your agreement.

Annex 1: Details of processing

Annex 2: Security measures

• In transit. Everything we host is served over HTTPS with HSTS. Internal services listen only on the server's loopback interface.
• Files. Files uploaded to Worcia Console are encrypted with AES-256-GCM before they are written to disk, and served only through signed, access-checked links.
• Backups. Database and file backups are encrypted with GPG (AES-256) before they leave the server, and kept for up to 90 days.
• At rest. We do not claim that every record is encrypted at rest. Data in our database is protected by access controls, network isolation and encrypted backups rather than disk-level encryption. Where an engagement needs encryption at rest for all data, the Engagement Agreement sets out how it will be provided.
• Team access. Every Worcia HQ account requires a password and a time-based one-time code (TOTP). Sessions expire after two hours idle and twelve hours in total. Passwords are hashed with Argon2id; two-factor secrets are stored encrypted.
• Client separation. Worcia Console accounts are separate from our team's accounts, and each client sees only its own projects and files.
• Least privilege. The application's database account can read and write data but cannot change the database structure. Repeated failed sign-ins lock an account for 15 minutes. Access to client systems is limited to the people doing the work and removed when the work ends.
• Audit trail. Sign-ins, changes to records, content and settings, and file access are written to an audit log.
• AI providers. We use AI providers under terms that do not allow them to train their models on Client Personal Data, and we tell you if a provider's terms change that.
• Data minimization. IP addresses used for rate limiting are stored only as hashes.

Annex 3: Subprocessors

The current list of Subprocessors, with what each does, where, and its status, is on our Subprocessors page. Engagement-specific providers are named in your Engagement Agreement.