Data Processing Addendum

1. Scope and roles

1.1 This DPA applies when MambaHR processes Customer Personal Data on behalf of Customer. Customer is the controller or business and MambaHR is the processor or service provider. If Customer is itself a processor, MambaHR acts as Customer’s subprocessor.

1.2 Customer Personal Data means personal data or personal information contained in Customer Data that MambaHR processes on Customer’s behalf. Data Protection Law means applicable privacy and data-protection law, including the California Consumer Privacy Act as amended and similar United States state privacy laws, and, where applicable to a transfer described in Section 8, the GDPR, UK GDPR, and Swiss data-protection law.

1.3 MambaHR is a separate controller or business for account, billing, relationship, security, and business-operation data it processes for its own purposes under the Privacy Policy. This DPA does not apply to that independent processing.

2. Customer instructions and obligations

2.1 MambaHR will process Customer Personal Data only to provide, secure, support, and improve the Services for Customer; follow Customer’s documented instructions; comply with the Agreement; and comply with law. The Agreement, Customer configurations, Authorized User actions, and support requests are Customer’s documented instructions.

2.2 If MambaHR believes an instruction violates Data Protection Law, MambaHR will notify Customer unless law prohibits notice and may suspend the affected processing until the parties resolve the issue.

2.3 Customer is responsible for the lawfulness, fairness, transparency, accuracy, and scope of its instructions and Customer Personal Data. Customer will provide required notices, establish a legal basis, respond to individuals, configure retention and access appropriately, and avoid submitting data prohibited by the Agreement.

2.4 Customer is responsible for laws regulating employers, employment decisions, workplace monitoring, automated decision systems, biometrics, health data, payroll, benefits, and communications. MambaHR does not determine Customer’s legal basis or whether Customer’s use is lawful.

3. Confidentiality and personnel

MambaHR will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and receive access only as needed for their duties. MambaHR is responsible for its personnel’s compliance with this DPA.

4. Security

MambaHR will maintain the technical and organizational measures in Schedule 2. Those measures are designed to provide a level of security appropriate to the risk, taking into account the state of the art, implementation cost, processing context, and nature of the data. MambaHR may update measures without materially reducing overall protection.

Customer is responsible for secure administration of its accounts, endpoints, credentials, access approvals, integrations, and configurations. Customer will promptly notify MambaHR of suspected compromise involving Customer accounts.

5. Security incidents

MambaHR will notify Customer without undue delay after confirming a breach of security that results in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data in MambaHR’s control (Security Incident). Notification is not an admission of fault or liability.

MambaHR will provide information reasonably available about the nature of the Security Incident, affected data and individuals, likely consequences, mitigation, and a contact for follow-up. Information may be provided in phases. MambaHR will take reasonable steps to contain, investigate, and remediate the Security Incident.

Unsuccessful attempts, pings, scans, blocked attacks, and events that do not compromise Customer Personal Data are not Security Incidents. Customer is responsible for legally required notices to individuals and regulators, except to the extent law assigns that duty directly to MambaHR. The parties will coordinate notices when practicable.

6. Assistance

Considering the nature of processing and information available, MambaHR will reasonably assist Customer with data-subject requests, security obligations, breach notifications, data-protection impact assessments, and regulator consultations required by Data Protection Law. Customer will first use available self-service tools. MambaHR may charge reasonable fees for assistance that is unusually burdensome or unrelated to MambaHR’s breach.

MambaHR will not respond directly to a request concerning Customer-controlled data unless Customer instructs MambaHR, law requires a response, or the response directs the requester to Customer.

7. Subprocessors

7.1 Customer gives general authorization for MambaHR to use the subprocessors in Schedule 3 and replacement or additional subprocessors needed to provide the Services. MambaHR will bind each subprocessor to data-protection obligations that provide materially equivalent protection for the processing it performs.

7.2 MambaHR will provide notice of a new subprocessor at least 15 days before that subprocessor processes Customer Personal Data when reasonably practicable. Customer may object during that period on reasonable data-protection grounds. The parties will work in good faith on a commercially reasonable alternative. If no alternative is available, either party may terminate only the affected Service, and MambaHR will refund prepaid fees for the unused affected period.

7.3 MambaHR remains responsible for a subprocessor’s performance of its data-protection obligations to the same extent MambaHR would be responsible if it performed the processing itself.

7.4 A Third-Party Service that Customer contracts with directly is not MambaHR’s subprocessor merely because MambaHR enables an integration. Customer’s direct agreement with that provider governs the provider’s processing and payment obligations. This includes Deel under the customer-funded model, Customer’s messaging workspace, Customer’s identity provider and device management, Customer’s benefits providers, and the HRIS or ATS systems Customer authorizes MambaHR to import from.

8. International transfers

8.1 MambaHR commits to United States storage for Customer Personal Data unless an Order states otherwise. MambaHR sells to United States employers, and the Services are not offered for the establishment of employment in the European Economic Area, the United Kingdom, or Switzerland. The remainder of this Section applies only if Customer Personal Data is nonetheless transferred from one of those regions to a country not recognized as providing adequate protection.

8.2 EEA transfers. The controller-to-processor clauses in Module Two of the European Commission Standard Contractual Clauses adopted by Implementing Decision (EU) 2021/914 are incorporated when Customer is a controller. Module Three applies when Customer is a processor. Clause 7 applies. Option 2 in Clause 9 applies with the notice period in Section 7. The optional language in Clause 11 does not apply. For Clause 17, the law of Ireland applies. For Clause 18, the courts of Ireland have jurisdiction. Schedules 1 through 3 of this DPA complete the relevant annexes.

8.3 UK transfers. The UK International Data Transfer Addendum issued by the UK Information Commissioner, version B1.0, is incorporated and completed using this DPA and the applicable Standard Contractual Clauses. If the Addendum conflicts with the Agreement, the Addendum controls for the restricted transfer.

8.4 Swiss transfers. The Standard Contractual Clauses apply with references adapted to the Swiss Federal Act on Data Protection, the competent Swiss authority, and Swiss data subjects, while preserving GDPR references when both laws apply.

8.5 Supplementary measures. MambaHR will provide information reasonably needed for transfer assessments and will apply the security measures in Schedule 2. If a valid successor transfer mechanism becomes available, MambaHR may rely on it after notice.

9. Return and deletion

During the subscription and for 30 days after termination, Customer may request a standard export of Customer Personal Data, subject to product capability and payment of undisputed fees. After that period, MambaHR will delete or de-identify Customer Personal Data within 60 days unless law requires retention. Backups and immutable security records may remain until deleted on their normal cycle, protected and not used for other purposes.

MambaHR may retain limited evidence of deletion, billing, security, and contractual records as an independent controller where lawful. Upon written request, MambaHR will confirm completion of deletion required by this Section.

10. Audits and information

MambaHR will make available information reasonably necessary to demonstrate compliance, such as relevant policies, summaries, questionnaires, certifications, or independent reports when available. Customer may request this information no more than once annually unless a Security Incident or regulator requires more frequent review.

If documentation is insufficient and Data Protection Law requires an audit, Customer may conduct a remote audit during normal business hours with at least 30 days’ notice, subject to confidentiality and reasonable scope. An on-site audit is permitted only when legally required or following a material Security Incident and must avoid disruption and exposure of other customers’ data. Customer pays audit costs unless the audit identifies MambaHR’s material breach.

11. United States state privacy terms

To the extent MambaHR processes Personal Information as a service provider, contractor, or processor under United States state privacy law, MambaHR will:

• Process Personal Information only for the business purposes in the Agreement and Customer’s documented instructions.
• Not sell Personal Information or share it for cross-context behavioral advertising.
• Not retain, use, or disclose Personal Information outside the direct business relationship with Customer or for an unrelated commercial purpose, except as permitted by law.
• Not combine Personal Information with information received from another customer or collected from MambaHR’s own interactions with an individual except as permitted by law to provide the Services.
• Provide the same level of privacy protection required of Customer for the processing delegated to MambaHR, notify Customer if MambaHR can no longer meet an applicable obligation, and allow reasonable steps to stop and remediate unauthorized use.
• Require subprocessors to comply with applicable service-provider, contractor, or processor restrictions.

12. AI processing

Customer instructs MambaHR to process Customer Personal Data through authorized AI features to provide the Services. MambaHR will not use Customer Personal Data or identifiable inputs or outputs to train or improve a model offered to other customers or the public unless Customer expressly authorizes it in writing. MambaHR may process de-identified and aggregated operational data that cannot reasonably identify Customer or an individual.

Customer is responsible for deciding whether an AI feature is appropriate for its purpose, completing required impact assessments, and maintaining legally required human oversight. MambaHR will provide reasonably available information about its AI subprocessors and relevant safeguards.

13. Liability, order of precedence, and term

The liability limitations in the Agreement apply to this DPA. If this DPA conflicts with the Agreement about data protection, this DPA controls. The Standard Contractual Clauses control for a restricted transfer to the extent they conflict. This DPA lasts as long as MambaHR processes Customer Personal Data.

Schedule 1. Processing details

Schedule 2. Technical and organizational measures

MambaHR will maintain measures appropriate to the Services, including:

• Access governance based on role, least privilege, unique accounts, and periodic review of privileged access.
• Authentication controls, secure session management, and multi-factor authentication for administrative or privileged access where supported.
• Encryption of Customer Personal Data in transit and at rest using industry-standard mechanisms, with protected management of credentials, tokens, keys, and secrets. Specially regulated fields are additionally encrypted at the field level under separately managed keys.
• Logical tenant separation enforced in the database layer, designed to prevent cross-customer access.
• Logging and audit records for material access, administrative actions, and workflow changes, with protection against unauthorized modification.
• Secure development and change-management practices, code review, dependency management, and testing proportionate to risk.
• Vulnerability identification, prioritization, and remediation processes appropriate to the severity and exposure of a finding.
• Malware protection, network and application protections, monitoring, and alerting appropriate to the hosted environment.
• Backup, recovery, and continuity measures designed to restore availability and access after an incident, with backups protected from unauthorized access.
• Incident-response procedures for identification, containment, investigation, remediation, communication, and lessons learned.
• Vendor diligence and written data-protection and confidentiality obligations for subprocessors.
• Personnel confidentiality, access termination, security awareness, and disciplinary processes.
• Data minimization, retention, export, deletion, and de-identification controls aligned with Customer instructions and legal requirements.
• AI-provider configuration and data-minimization measures designed to prevent generalized model training on Customer Personal Data.

MambaHR does not represent that it holds a certification, audit report, or security feature unless MambaHR has confirmed that status in writing.

Schedule 3. Current subprocessors

MambaHR lists only providers actually used in production. Primary processing location is the United States unless Customer agrees otherwise in an Order or product-specific addendum.