Data Processing

Data Processing Addendum (DPA)

MMALI Financial Services LLC dba WagePress

Effective Date: 01/01/2025 • Last Updated: 12/12/2025

This Data Processing Addendum (“DPA”) forms part of the Terms and Conditions (the “Agreement”) between MMALI Financial Services LLC, doing business as WagePress (“WagePress,” “Processor,” or “Service Provider”) and the customer entity (“Customer,” “Controller,” or “Business”) that uses WagePress Services.

This DPA applies to the extent WagePress processes Personal Data on behalf of Customer in the course of providing the Services.

1. DEFINITIONS

For purposes of this DPA:

“Personal Data” means any information that identifies or relates to an identified or identifiable individual and is protected under applicable data protection laws.
“Processing” means any operation performed on Personal Data, including collection, storage, use, disclosure, transmission, or deletion.
“Data Protection Laws” means all applicable privacy and data protection laws, including but not limited to the California Consumer Privacy Act and California Privacy Rights Act (“CCPA/CPRA”).
“Data Subject” means an individual whose Personal Data is processed (e.g., employees, contractors, payees).
“Services” means WagePress payroll, tax preparation, electronic filing, reporting, integration, and related services.

2. ROLES OF THE PARTIES

2.1 Customer as Controller

Customer is the data controller/business and determines:

the purposes for which Personal Data is processed;
the categories of Personal Data submitted;
the legal basis for processing;
compliance with all applicable laws.

2.2 WagePress as Processor / Service Provider

WagePress acts as:

a processor under applicable data protection laws; and
a service provider under the CCPA/CPRA,

and processes Personal Data solely on documented instructions from Customer and as necessary to provide the Services.

3. SCOPE OF PROCESSING

3.1 Subject Matter

Processing of Personal Data for:

payroll calculation and reporting;
preparation and electronic filing of tax forms;
data synchronization with authorized integrations;
compliance, security, and audit logging.

3.2 Duration

Processing continues for the duration of the Agreement and any legally required retention period.

3.3 Categories of Personal Data

May include, depending on Customer use:

Identifiers (name, address, email, phone)
Government identifiers (SSN, ITIN, EIN)
Employment and compensation data
Tax withholding and filing information
Account and authentication data

3.4 Categories of Data Subjects

Customer employees
Independent contractors
Payees and recipients
Authorized users

4. CUSTOMER OBLIGATIONS

Customer represents and warrants that it:

Has obtained all required notices, consents, and authorizations from Data Subjects;
Has a lawful basis for processing Personal Data;
Will not submit Personal Data in violation of applicable law;
Is responsible for the accuracy and legality of all Personal Data provided.

WagePress has no independent obligation to verify the legality or accuracy of Customer Data.

5. WAGEPRESS OBLIGATIONS

WagePress shall:

Process Personal Data only to provide the Services and comply with law;
Not sell Personal Data or use it for purposes outside the Agreement;
Implement reasonable administrative, technical, and physical safeguards;
Ensure personnel with access to Personal Data are bound by confidentiality obligations;
Assist Customer, where required by law, with Data Subject requests.

6. SUBPROCESSORS

Customer authorizes WagePress to engage subprocessors to support the Services, including but not limited to:

cloud hosting providers,
security and monitoring services,
payment and financial infrastructure providers,
customer support platforms.

WagePress shall require subprocessors to maintain data protection obligations consistent with this DPA.

7. DATA SUBJECT REQUESTS

If WagePress receives a request from a Data Subject relating to Personal Data processed on behalf of Customer, WagePress shall:

notify Customer unless legally prohibited; and
reasonably assist Customer in responding, where required by law.

Customer is responsible for responding to Data Subject requests.

8. DATA SECURITY

WagePress implements safeguards designed to protect Personal Data, including:

access controls and authentication mechanisms;
encryption in transit and at rest where appropriate;
logging and monitoring of system access;
incident response procedures.

Customer acknowledges that no system is completely secure.

9. PERSONAL DATA BREACH

Upon becoming aware of a confirmed Personal Data breach affecting Customer Data, WagePress shall:

notify Customer without undue delay; and
provide information reasonably necessary to comply with applicable breach notification laws.

10. DATA RETENTION AND DELETION

WagePress retains Personal Data:

for the duration of the Services; and
as required by applicable tax, financial, and regulatory laws.

Upon termination of Services, WagePress will delete or de-identify Personal Data within a reasonable time, unless retention is legally required.

11. CCPA / CPRA SERVICE PROVIDER TERMS

WagePress:

processes Personal Data solely as a service provider;
does not sell or share Personal Data;
does not retain, use, or disclose Personal Data outside the business purpose of providing the Services;
does not combine Personal Data with data from other customers except as permitted by law.

12. LIMITATION OF LIABILITY

This DPA is subject to the limitation of liability provisions in the Terms and Conditions.

13. ORDER OF PRECEDENCE

If there is a conflict between this DPA and the Terms and Conditions, this DPA shall control solely with respect to data protection matters.

14. CONTACT INFORMATION

MMALI Financial Services LLC (dba WagePress)

6340 N Eldridge Pkwy, Suite N 150
Houston, TX 77041

Email: privacy@wagepress.com