A data processing agreement, or DPA, is the contract between a data controller (you) and a processor (your vendor) setting out what personal data is processed, why, how it is protected, which sub-processors may touch it and what happens on breach or termination. GDPR makes one mandatory whenever a processor handles personal data for you.
For workplace software the DPA is standard procurement paperwork: booking, attendance and visitor records are personal data, so the vendor processes on your behalf. A vendor who cannot produce a clean DPA and a current sub-processor list quickly is telling you something.