Data Processing Agreement

1. Parties & Roles

This Data Processing Agreement ("DPA") forms part of the Terms of Service between LVL Up Performance ("Processor") and the customer organization that subscribes to the Service ("Controller" or "Customer"). For personal data of the Customer's employees and team members processed through the Service, the Customer is the data controller and LVL Up Performance is the data processor.

2. Subject Matter & Duration

LVL Up Performance processes personal data on the Customer's behalf only to provide the Service (performance management, feedback, goals, recognition, reviews, and — where enabled — HR/PTO features), for the duration of the subscription plus any retention period described in the Privacy Policy.

3. Nature & Purpose of Processing

Processing is limited to the documented instructions of the Controller, which are: storing, organizing, displaying, and analyzing employee performance data to deliver the Service's features. LVL Up Performance will not process the data for any other purpose, and will not sell customer personal data.

4. Categories of Data & Data Subjects

Data subjects:the Customer's employees, managers, and administrators.

Categories:identity & contact data (name, work email), employment data (role, department, manager), and performance content (goals, feedback, recognition, reviews, and, where the HR module is enabled, PTO and related HR records). The Service is not intended for special-category data.

5. Sub-processors

The Customer authorizes LVL Up Performance to engage the sub-processors below. We will give notice of any intended addition or replacement, giving the Customer the opportunity to object.

6. Security Measures

LVL Up Performance maintains technical and organizational measures appropriate to the risk, including encryption in transit (TLS/HSTS), tenant data isolation, access controls, a Content Security Policy, audit logging, and monitored error tracking. See the Security page for details.

7. Assistance to the Controller

LVL Up Performance will assist the Controller, taking into account the nature of processing, in responding to data-subject rights requests (access, rectification, erasure, portability) and in meeting the Controller's security, breach-notification, and data-protection-impact-assessment obligations.

8. Breach Notification

LVL Up Performance will notify the Controller without undue delay after becoming aware of a personal-data breach affecting the Customer's data, with information reasonably available to support the Controller's own notification obligations.

9. Return & Deletion

On termination, the Customer may export its data, after which LVL Up Performance will delete or anonymize customer personal data within the period described in the Privacy Policy, except where retention is required by law.

10. International Transfers

Where personal data is transferred outside its country of origin, the transfer relies on an appropriate safeguard (e.g. Standard Contractual Clauses). The specific transfer mechanism must be confirmed by counsel.

11. Audit

On reasonable written request (no more than annually, absent a regulator requirement), LVL Up Performance will make available information necessary to demonstrate compliance with this DPA.

12. Contact

Data protection enquiries: privacy@lvlupperformance.com.