Skip to content
Umajani

Data Processing Agreement

This agreement applies when a business customer uses Umajani for Work. The customer acts as the data fiduciary for work data, and we act as the data processor.

Scope

We process employee and workspace data only to provide team rituals, SOP routines, onboarding, wellbeing programs and analytics as instructed by the customer.

Personal space exclusion

Data in an employee's personal space is controlled by the employee, not the customer, and is not processed on the customer's behalf or shared with the customer.

Security measures

  • Encryption in transit and at rest.
  • Role-based access with least privilege.
  • Audit logging of administrative access.
  • Minimum group size of five for wellbeing analytics.

Sub-processors

We maintain a list of sub-processors and notify customers before adding new ones. Customers may object on reasonable data protection grounds.

Breach notification

We notify affected customers without undue delay after becoming aware of a personal data breach, with the information needed to meet their obligations.

Return and deletion

At the end of the agreement, customers can export their data. We delete remaining customer data within 30 days unless law requires otherwise.

Signed copies

Business and Enterprise customers can request a signed copy through the contact page.