Loading
Effective date: 24 July 2026 · Last updated: 24 July 2026
This Data Processing Addendum (“DPA”) is entered into between the customer identified in the applicable agreement (“Customer” or “Controller”) and Xanivar Labs Pte. Ltd. (“Xanivar” or “Processor”), and forms part of the Terms of Service or other agreement between them (the “Agreement”). It governs Xanivar’s processing of personal data on the Customer’s behalf. Where the Services are operated by a local Licensee, this DPA applies to the Licensee as processor or sub-processor as applicable.
“Applicable Data Protection Law” means all data protection and privacy laws applicable to the processing, including Indonesia’s Personal Data Protection Law (Law No. 27/2022), Singapore’s Personal Data Protection Act 2012, and, where applicable, the EU/UK GDPR and US state privacy laws. “Controller”, “Processor”, “Personal Data”, “Processing”, “Data Subject”, and “Personal Data Breach” have the meanings given in Applicable Data Protection Law (or the closest equivalent). “Customer Personal Data” means Personal Data Xanivar processes on the Customer’s behalf under the Agreement.
The Customer is the Controller and Xanivar is the Processor of the Customer Personal Data. Each party will comply with its obligations under Applicable Data Protection Law. Annex 1 describes the subject matter, duration, nature, purpose, types of Personal Data, and categories of Data Subjects.
The Services are operated with access by both Xanivar (as global processor, from Singapore) and, in Licensee markets, the local Licensee (as processor or sub-processor for its territory). Each may access Customer Personal Data only to provide, support, and secure the Services and to comply with legal or regulatory obligations and lawful authority requests in its territory. In particular, a locally-registered Licensee (for example in Indonesia) will hold access to the Customer Personal Data of its region so that it can operate the Services locally and respond to lawful requests from local authorities within the timeframes required by local law.
Xanivar will process Customer Personal Data only on the Customer’s documented instructions (including as set out in the Agreement and through use of the Services), except where required by law, in which case Xanivar will inform the Customer unless legally prohibited. Xanivar will promptly inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.
Lawful access requests. If Xanivar or a Licensee receives a legally binding request from a public authority (including a regulator or law-enforcement body) to access Customer Personal Data, it will, unless legally prohibited, inform the Customer and will disclose only the minimum reasonably required. Where local law requires a locally-registered operator to provide authorities with access to data within short statutory timeframes (as may apply in Indonesia), the local Licensee will handle such requests for its territory in accordance with local law, and will inform Xanivar and, where permitted, the Customer.
Xanivar will ensure that personnel authorised to process Customer Personal Data are bound by confidentiality and are trained appropriately, and will limit access on a need-to-know basis.
Xanivar will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data, as described in Annex 2, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and risks of the processing.
The Customer authorises Xanivar to engage the sub-processors listed in Annex 3, and to appoint new sub-processors, provided Xanivar: (a) gives the Customer prior notice of additions or replacements (allowing the Customer to object on reasonable data-protection grounds); and (b) imposes data-protection obligations on each sub-processor that are materially equivalent to those in this DPA. Xanivar remains responsible for its sub-processors’ performance.
Taking into account the nature of the processing, Xanivar will assist the Customer, by appropriate technical and organisational measures and insofar as possible, to respond to requests from Data Subjects exercising their rights. If Xanivar receives such a request directly, it will (unless prohibited) direct the Data Subject to the Customer.
Xanivar will provide the Customer reasonable assistance with data protection impact assessments, prior consultations with authorities, and its security and breach-notification obligations, taking into account the information available to Xanivar.
Xanivar will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and will provide information reasonably available to help the Customer meet its notification obligations to authorities and Data Subjects.
The Customer authorises Xanivar to transfer and process Customer Personal Data in the locations described in Annex 4. Where a transfer is subject to Applicable Data Protection Law transfer rules, the parties will implement an appropriate transfer mechanism (such as standard contractual clauses or ensuring a comparable standard of protection), as described in Annex 4.
Xanivar will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Customer or its mandated auditor on reasonable prior notice, no more than once per year (unless required by an authority or following a breach), subject to confidentiality and to not compromising other customers’ security. Xanivar may satisfy audit requests by providing third-party audit reports or certifications where available.
On termination or expiry of the Agreement, Xanivar will, at the Customer’s choice, delete or return Customer Personal Data within a reasonable period, and delete existing copies, except to the extent retention is required by law. The Services may allow the Customer to export data before deletion.
Each party’s liability under this DPA is subject to the limitations and exclusions in the Agreement. If there is a conflict between this DPA and the Agreement on the processing of Personal Data, this DPA prevails. This DPA is governed by the law and dispute-resolution terms of the Agreement, unless Applicable Data Protection Law requires otherwise.
| Item | Detail |
|---|---|
| Subject matter | Provision of the Services (Field and related products) to the Customer |
| Duration | The term of the Agreement, plus any legally required retention |
| Nature & purpose | Hosting, storing, and processing data to provide field management, scheduling, time & attendance, job, messaging, and payment-related features |
| Types of Personal Data | Identity & contact details; employment & role data; shift, time, and location (GPS) records; job and customer records; credentials; messages; and, where the Customer uses relevant features, health/care and other sensitive data |
| Categories of Data Subjects | The Customer’s workers/staff and its own customers/clients; the Customer’s authorised users |
Xanivar reviews and updates these measures periodically and may substitute equivalent or stronger controls, provided the overall level of protection is not reduced.
Xanivar engages sub-processors in the following categories to provide the Services, each under contract to protect Customer Personal Data and process it only on documented instructions:
Payments are handled by the licensee’s or customer’s own regulated payment providers, which they set up directly; Xanivar does not engage them as its sub-processors. The current list is available on request and will be updated as sub-processors change, with notice as described in Section 6.
The primary database is hosted and processed in Singapore; file and media uploads are stored in the Asia-Pacific region via our object-storage provider. Customer Personal Data may also be processed, via the sub-processors above, in the EU and US. For transfers subject to transfer rules under Applicable Data Protection Law (including from Indonesia and the EU/UK), the parties rely on standard contractual clauses or another comparable-protection mechanism, as applicable. Additional market-specific terms:
© 2026 Xanivar Labs Pte. Ltd. All rights reserved.
