Data Processing Agreement

This document is a draft for review. It does not add obligations to an existing service contract unless approved and agreed in writing. The proposed service provider is Fullness Smart Business Management System Ltd. (company no. 517195863) (Fullness); the customer is the business operating the workspace.

The customer determines why and how information about its clients, employees and other individuals is processed. Fullness processes workspace data on its behalf to deliver the service. Information Fullness manages for its own purposes, such as account administration, billing and website enquiries, is addressed separately in the privacy policy.

Processing covers information the customer and its authorised users enter or connect to enabled modules: identification and contact details, customer and employee records, communications, tasks, documents and business or financial data. Sensitive information, including insurance, pension or health information, is included only when the customer is entitled to process it and uses the relevant capability.

Proposed operations include collection, storage, organisation, display, search, updates, export and deletion, and customer-initiated sending or synchronisation. Their purposes are to operate selected capabilities, support and maintain the service, in accordance with customer instructions and applicable law.

Workspace settings, actions by authorised users and documented support requests form processing instructions. The customer is responsible for a lawful basis to collect and use information, required notices to individuals, data accuracy and its choice of users, permissions and integrations.

Before connecting an external service or enabling an AI capability, the customer must assess its suitability for the data and its requirements. Unusual instructions, a change of purpose or access beyond what the service needs must be addressed expressly in writing. This addendum does not transfer the rights of the customer or individuals in their data to Fullness.

The proposed addendum requires organisational and technical measures appropriate to the data and risks: access limited by role and need, separation between customer workspaces, protection of data in transit, permission management and records, and incident and backup procedures. Fullness personnel with access must use it only for service purposes and be subject to confidentiality obligations.

The precise controls, systems that may be accessed and access boundaries must be recorded in the agreed operational schedule. This draft does not assert a certification, standard, completed security assessment or service level that has not been confirmed in the contract documents.

Infrastructure, email, monitoring providers and customer-enabled integrations may participate in processing. Relevant providers, their roles, processing locations and arrangements for list updates must be verified and documented before approval. The website-form providers described in the privacy policy are not a complete list of processors for every business module.

Fullness must arrange appropriate use restrictions, confidentiality and security with providers acting on its behalf. Each transfer outside Israel must be assessed against applicable law and the relevant transfer arrangement. This draft does not approve every destination or promise that all data remains in Israel.

For an incident affecting customer data, the proposed agreement requires notifying the customer without undue delay after becoming aware of it, providing available information about its scope and response, and cooperating to reduce harm. Notification channels, contact details and legally required timelines must be recorded in the final agreement.

Requests to access, correct or delete business data are handled with the customer, which determines the processing purposes. Fullness must assist under documented customer instructions and applicable law, and pass relevant requests it receives to the customer. Requests concerning information Fullness is responsible for in its own right follow the privacy policy.

Processing continues while the relevant services are provided and to the extent needed to complete agreed or legally required duties. At termination, return or deletion of information must be arranged under customer instructions, subject to legal retention duties.

The export format, access period after termination, deletion times for active systems and backups, and how deletion is confirmed must be specified in the final agreement. This draft does not promise immediate backup erasure or restoration at any time. Information that must be retained must remain protected and limited to the relevant purpose and period.

Before approval, the parties must record the data and individual categories, enabled modules and accessible systems, processing operations, security measures, subprocessors and locations, incident procedures, retention and deletion periods, and reporting and oversight. Periodic reporting requirements, including annual reporting where required, and reasonable audit arrangements must account for applicable law and risks.

Reviews must be coordinated, confidential and protective of other customers’ information. Applicable Israeli law, including the Privacy Protection Law and data-security regulations, and any additional requirements applicable to the customer must be considered on approval. Contact [email protected] to discuss and complete these details.