Data Processing Agreement (DPA)

Last updated: August 2026

This Data Processing Agreement ("DPA") forms an integral part of the agreement between the employer entity subscribing to FunPayroll.com ("Controller") and FunPayroll.com ("Processor"). It governs the processing of personal data submitted to the Service on behalf of the Controller. This DPA supplements and is incorporated into the FunPayroll.com Terms of Service.

1. Roles, Responsibilities, and Definitions

Controller: The employer entity that creates a FunPayroll.com account, dictates the configuration of the platform, and determines the purposes and means of processing its employees' personal data.

Processor: FunPayroll.com, which processes personal data solely on the documented instructions of the Controller and for no other overarching purpose.

Sub-processor: Any third-party data processor engaged by FunPayroll.com to assist in fulfilling its obligations with respect to providing the Service.

2. Scope and Nature of Processing

FunPayroll.com processes personal data strictly to provide the features of the Service, which include:

• Workforce scheduling, shift management, and access controls.
• Time and attendance tracking, including geolocation verification at the time of clock-in/out.
• Payroll calculation, timecard generation, and data formatting for export to third-party financial platforms.
• Management of paid time off (PTO), sick leave accruals, and reimbursements.

3. Controller Obligations

The Controller represents and warrants that it:

• Has established a lawful basis for processing its employees' personal data and has provided all necessary notices to its personnel.
• Will only submit personal data to FunPayroll.com that is strictly necessary for the stated processing purposes.
• Will not submit highly sensitive special categories of data (e.g., protected health information, unmasked financial account numbers, government identifiers) unless expressly required by a specific platform feature designed for that data.
• Maintains compliance with all applicable local, state, and federal labor and privacy laws in the jurisdictions where it operates.

4. Processor Obligations

FunPayroll.com, as the Processor, agrees to:

• Process personal data only in accordance with the Controller's documented instructions (which include the configuration and use of the Service).
• Ensure that all FunPayroll.com personnel with access to personal data are bound by strict contractual confidentiality obligations.
• Implement and maintain appropriate technical and organizational security measures to protect against unauthorized access, alteration, or destruction of data.
• Assist the Controller, through technical means, in fulfilling its obligations to respond to data subject rights requests (e.g., access, deletion). FunPayroll.com will not respond directly to an employee's data request without the Controller's prior authorization.

5. Sub-processors

The Controller provides general authorization for FunPayroll.com to engage Sub-processors (such as cloud infrastructure providers) to deliver the Service. FunPayroll.com will enter into written agreements with all Sub-processors imposing data protection terms no less protective than those in this DPA. FunPayroll.com remains fully liable for the acts and omissions of its Sub-processors.

6. Security Incidents and Breach Notification

Upon becoming aware of a confirmed personal data breach affecting the Controller's data, FunPayroll.com will notify the Controller without undue delay, and in no event later than 48 hours after confirmation. FunPayroll.com will provide sufficient information to allow the Controller to meet any regulatory reporting obligations. The Controller retains sole responsibility for notifying its employees or regulatory authorities.

7. California Privacy Rights Act (CPRA) Certification

For the purposes of the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), FunPayroll.com acts strictly as a "Service Provider." FunPayroll.com certifies that it will not sell or share personal information, nor will it retain, use, or disclose personal information for any purpose other than providing the Service specified in the Terms of Service.

8. Data Deletion and Return

Upon the termination or expiration of the Controller's subscription to the Service, FunPayroll.com will, at the Controller's election, either delete or return all personal data. If no election is made, FunPayroll.com will automatically initiate the permanent deletion of the Controller's data from its active systems within thirty (30) days of account termination, excluding data retained on secure, encrypted backups, which will be destroyed according to our standard backup retention schedule.

9. Contact for DPA Inquiries

Employers requiring a countersigned copy of this DPA for their internal compliance records, or with questions regarding our data processing practices, should contact payroll@funpayroll.com.