Sign in Sign up

Data Processing Addendum

Current Version: 1.0.0

Last Updated: October 30, 2026

Effective Date: October 30, 2026 for new customers and users. For existing customers and users, this version applies after any required direct notice period and acceptance or consent.

1. Scope and Relationship to the MSA

This Data Processing Addendum ("DPA") forms part of the Master Services Agreement between Heyday Ops LLC ("Heyday", "we", "us", or "our") and Customer. It governs our processing of Customer Personal Data on Customer's behalf, including through Early Access Offerings. Capitalized terms not defined here have the meanings given in the MSA.

"Customer Personal Data" means personal information or personal data contained in Customer Data that we process on Customer's behalf. "Applicable Data Protection Law" means United States federal, state, or local privacy, data protection, and security laws that apply to the processing at issue. A reference to a particular law does not mean that every Customer, individual, or processing activity is covered by that law.

This DPA controls over conflicting provisions of the MSA, Orders, program terms, and the Privacy Policy concerning the processing of Customer Personal Data. A separately signed data processing addendum controls to the extent it expressly replaces or modifies this DPA. No document may authorize processing prohibited by Applicable Data Protection Law.

2. Roles and Customer Responsibilities

Customer determines the purposes for which its workforce information is collected and used and the instructions for processing it through Heyday. Where Applicable Data Protection Law uses those terms, Customer acts as the controller or business and Heyday acts as its processor or service provider for Customer Personal Data. The parties' legal roles also depend on their actual processing activities.

Customer is responsible for lawful instructions, the accuracy and appropriateness of information it submits, required notices and permissions, workspace access decisions, and responding to individuals concerning Customer's processing. Customer must submit only information it is entitled to process and only for uses permitted by the MSA. Customer must not submit personal information about anyone under 18, whether or not that person has a Heyday account.

This DPA does not govern information that Heyday processes independently for its own account administration, billing, security, support, and website operations, as described in the Privacy Policy, to the extent that processing is lawful outside our role as Customer's processor or service provider. This distinction does not permit us to reclassify Customer's workforce records as our own data or to use them for an independent purpose contrary to this DPA.

3. Processing Instructions and Description

Customer discloses Customer Personal Data to Heyday only for the limited purposes specified below. The MSA, this DPA, the applicable Order, Customer's use of the Services and configuration of available features, and other documented instructions accepted by Heyday constitute Customer's instructions. Additional instructions must be lawful and within the agreed scope of the Services or separately agreed in writing.

The processing covered by this DPA is described as follows:

This description does not expand the types of data or uses permitted under the MSA. Customer must comply with the prohibited-data restrictions in MSA Section 9.3, including in free-text fields and attachments. Ordinary availability and leave information must not include medical details or other prohibited information. We will notify Customer if we determine that an instruction violates Applicable Data Protection Law and may suspend the affected processing while the parties address that instruction.

4. Restrictions on Use and Disclosure

We will process Customer Personal Data only for the purposes specified in Section 3, Customer's lawful documented instructions, and other purposes expressly permitted for our role by Applicable Data Protection Law, including compliance with a binding legal obligation. We will not retain, use, or disclose it outside our direct business relationship with Customer except as expressly permitted for our role by that law.

We will not sell Customer Personal Data, share it for cross-context behavioral advertising, or use it for targeted advertising or our own advertising campaigns. We will not combine identifiable Customer Personal Data with personal data received from another customer or source, or from our own interactions with individuals, except where expressly permitted for our role by Applicable Data Protection Law and necessary for a purpose specified in Section 3. We will not use identifiable workforce records to build profiles for another customer or to perform unrelated analysis across customers.

We may create and use aggregated or de-identified information to analyze and improve the Services only where the resulting information does not identify Customer or any individual and meets applicable legal requirements. We will take reasonable measures to prevent identification, maintain and use de-identified information in de-identified form, and not attempt to re-identify it except as permitted by law to assess the effectiveness of de-identification safeguards. If we disclose de-identified information, we will require recipients by contract to maintain those protections. Information that remains identifiable continues to be subject to this DPA.

Where the California Consumer Privacy Act, as amended, and its regulations ("CCPA") apply, we will comply with their applicable provisions, provide the same level of privacy protection required of a business for Customer Personal Data, and comply with the restrictions applicable to a service provider or contractor. We understand and will comply with the restrictions in this DPA. Customer retains its rights to direct and oversee processing and to stop and remediate unauthorized use as described below.

5. Confidentiality and Security

We will ensure that people authorized to process Customer Personal Data are subject to confidentiality obligations and have access appropriate to their responsibilities. We will maintain reasonable administrative, technical, and organizational safeguards appropriate to the nature of Customer Personal Data and the risks of processing it, designed to protect it against unauthorized access, use, disclosure, alteration, loss, or destruction.

Customer remains responsible for its devices, credentials, account permissions, authorized instructions, and secure use of the Services. Neither party's responsibilities excuse the other party from its own obligations under this DPA or Applicable Data Protection Law.

6. Subprocessors and Customer-Selected Services

Customer generally authorizes Heyday to engage service providers to process Customer Personal Data on our behalf for the purposes specified in Section 3 ("Subprocessors"). We will provide information about the Subprocessors we use and their processing functions on Customer's reasonable request. Where Applicable Data Protection Law requires notice of a new or replacement Subprocessor or an opportunity to object, we will provide that notice and opportunity before the affected processing begins as required by that law. The parties will cooperate to address objections in accordance with the applicable requirements.

We will enter into written contracts with Subprocessors requiring protections appropriate to their processing and no less protective than the applicable obligations in this DPA, including purpose limitations, confidentiality, security, assistance, and return or deletion. Where the CCPA applies, those contracts will satisfy its applicable service-provider or contractor requirements. We remain responsible to Customer for our Subprocessors' performance of their delegated obligations, subject to the MSA's limitations of liability and Applicable Data Protection Law.

A service that Customer independently selects and engages is not our Subprocessor merely because Customer connects it to Heyday. Customer's instructions govern the information transferred to that service through Heyday, and Customer is responsible for its independent relationship with that service. This distinction does not reduce our obligations for processing performed by us or our Subprocessors.

7. Individual Requests and Compliance Assistance

Taking account of the nature of the processing and the information available to us, we will provide reasonable assistance and appropriate technical and organizational measures to help Customer fulfill its obligations concerning Customer Personal Data under Applicable Data Protection Law. This includes assistance with requests to access, correct, delete, or obtain a copy of personal information and with other rights that apply to the processing.

Customer will identify requests that require our assistance and provide the information reasonably necessary for us to act on its lawful instructions. We will carry out required actions within the time required by Applicable Data Protection Law and coordinate with Customer so it can meet its applicable deadlines. We will transmit relevant instructions to our Subprocessors where required.

If an individual contacts us directly about Customer Personal Data, we may refer the individual to Customer or act on Customer's instructions, unless law requires us to respond otherwise. We will not treat Customer's authorization as a prerequisite to requests concerning information we lawfully process independently for our own purposes.

We will also provide information and assistance required by Applicable Data Protection Law for Customer's data protection assessments, applicable cybersecurity audits, security and breach-notification duties, and any applicable requirements concerning automated decisionmaking. These obligations apply only to requirements relevant to the processing we perform and do not represent that every Customer is subject to each requirement or that Heyday offers a particular regulated feature.

8. Security Incidents

A "Security Incident" is unauthorized access to, acquisition, use, disclosure, alteration, destruction, or loss of Customer Personal Data in our possession or control, including through our Subprocessors. Unsuccessful attempts that do not compromise Customer Personal Data, such as blocked scans or failed login attempts, are not Security Incidents under this definition.

We will notify Customer of a Security Incident as required by Applicable Data Protection Law. We will reasonably cooperate with Customer's investigation, mitigation, and required notifications and provide information available to us about the nature of the incident, affected data, and steps taken or proposed in response. We may provide information in stages as the investigation develops and will provide relevant updates. Customer must keep its administrative and security contact information current.

Each party remains responsible for notifications and other actions the law assigns to it. The parties will coordinate communications where legally permitted. Neither coordination, an incomplete investigation, nor any other term of this DPA permits delaying a notice or action beyond the time allowed by law. Providing notice does not by itself constitute an admission of fault or liability.

9. Return, Deletion, and Retained Copies

At the end of the Services, we will, at Customer's direction, return Customer Personal Data or delete it, subject to Applicable Data Protection Law. Following return, we will delete remaining copies except to the extent retention is legally required or otherwise expressly permitted for our role by Applicable Data Protection Law. Customer may request return or deletion through support and should arrange any needed export before ending its use of the Services. This DPA does not establish a guaranteed period of continued account access after termination.

During the Services, we will follow Customer's lawful deletion instructions and assist with legally required deletion requests as described in Section 7. Where we are legally permitted to delay deletion of backup copies, we will protect those copies, limit access and use to permitted retention or recovery purposes, and delete them through backup maintenance without retaining them longer than reasonably necessary for those purposes. If a backup is restored, applicable deletion instructions will continue to apply to the restored data.

We will limit any legally required or permitted retention to the data and period necessary for its lawful purpose and continue to apply this DPA's confidentiality, security, and use restrictions. This may include minimum consent or suppression records needed to honor messaging choices or demonstrate compliance, to the extent permitted by law. We will explain the basis for retaining Customer Personal Data on Customer's reasonable request unless law prohibits doing so. Retention for general operational convenience does not override a required deletion or authorize unrelated use.

This DPA does not extend any deletion, return, or retention deadline imposed by Applicable Data Protection Law or a separately agreed written commitment. We will provide reasonable confirmation of completed return or deletion on Customer's request.

10. Oversight, Compliance Notices, and Remediation

Customer may take reasonable and appropriate steps to verify that we process Customer Personal Data consistently with this DPA and Customer's applicable legal obligations. We will make available information in our possession reasonably necessary to demonstrate compliance, including relevant descriptions of our practices and available assessment materials.

We will allow and cooperate with reasonable assessments by Customer or its designated assessor. Where permitted by Applicable Data Protection Law, an assessment by a qualified independent assessor using an appropriate accepted standard, with a relevant report made available to Customer, may be used instead. If existing materials do not reasonably address the required assessment, the parties will arrange an appropriate additional review.

Reviews will use reasonable notice, confidentiality, and security arrangements and protect other customers' data and legally protected information. These arrangements will not prevent Customer from exercising oversight rights or receiving information required by Applicable Data Protection Law. They do not authorize uncoordinated penetration testing or access to another customer's data.

We will notify Customer if we determine that we can no longer meet our obligations under this DPA or Applicable Data Protection Law. Upon notice, Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data, including directing suspension of the affected processing and requesting evidence of remediation. We will cooperate in addressing the issue, and Customer may stop further disclosures affected by it. No provision of this DPA limits a regulator's lawful powers.

11. General Terms and Contact

This DPA does not create an additional indemnity, service level agreement, or separate liability cap. Liability between Customer and Heyday remains subject to the MSA's exclusions and limitations, except to the extent Applicable Data Protection Law does not permit those limits. Nothing here waives an individual's nonwaivable statutory rights or either party's obligations to a regulator.

The provisions of this DPA continue to apply for as long as we or our Subprocessors retain Customer Personal Data. Changes to this DPA are subject to the MSA's requirements for changes and notices and cannot authorize processing that Applicable Data Protection Law prohibits.

Questions or instructions concerning this DPA may be sent to privacy@heydayops.com. Legal notices may also be sent to legal@heydayops.com or to 30 S 15th St Ste 1550 PMB 148814, Philadelphia, Pennsylvania 19102-4806 US.