Data Processing Agreement

1. Roles and scope

For Customer Data, the Controller is the controller and the Processor is its processor. Annex 1 describes the processing. Each party will comply with Data Protection Law in relation to the processing.

2. Instructions

The Processor will process personal data only on the Controller's documented instructions, which are this DPA, the Terms of Service and the Controller's use and configuration of the Service, unless the law requires otherwise, in which case it will tell the Controller first unless the law forbids that. The Processor will tell the Controller if it believes an instruction breaks Data Protection Law.

3. Confidentiality

The Processor will make sure that everyone it authorises to process the personal data is bound by a duty of confidentiality and processes it only as needed to provide the Service.

4. Security

The Processor will take the technical and organisational measures required by Article 32 of the UK GDPR, including those in Annex 2, and will keep them under review as technology and risks change.

5. Sub-processors

The Controller gives general authorisation for the Processor to use the sub-processors listed in Annex 3 and on the Sub-processors page.

The Processor will tell the Controller at least 30 days before adding or replacing a sub-processor. If the Controller objects on reasonable data protection grounds and the parties cannot resolve the objection, the Controller may end the subscription and receive a refund of fees paid for the period after it ends.

The Processor will put a written contract in place with each sub-processor that gives the personal data at least the same protection as this DPA, and remains liable to the Controller for each sub-processor's performance.

6. International transfers

The Controller authorises the transfers described in Annex 3. The Processor will transfer personal data outside the UK only where an appropriate safeguard under Data Protection Law is in place, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment, a summary of which is available to the Controller on request.

7. Data subjects' rights

The Service gives the Controller tools to answer data subjects' requests: exporting everything held about a person, correcting records, letting staff update their own details, and deleting records.

If the Processor receives a request directly, it will pass it to the Controller within 5 working days and will not respond itself unless the Controller asks it to. The Processor will otherwise give the Controller reasonable help to answer requests.

8. Personal data breaches

The Processor will notify the Controller without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate numbers of people and records affected, the likely consequences and the measures taken or proposed. The Processor will take reasonable steps to contain the breach and will help the Controller meet its obligations to notify the Information Commissioner's Office and the people affected.

9. Assistance

Taking into account the nature of the processing and the information available to it, the Processor will give the Controller reasonable assistance with data protection impact assessments and any prior consultation with the Information Commissioner's Office.

10. Deletion or return

When the subscription ends, the Controller can export all Customer Data for 30 days. The Processor will then delete Customer Data from the live Service within 30 days, and it will be removed from backups as they expire (backups are kept for 14 days), unless the law requires the Processor to keep it. On request, the Processor will confirm deletion in writing.

11. Audits and information

The Processor will make available the information reasonably needed to demonstrate its compliance with this DPA, including by answering security questionnaires. The Controller, or an independent auditor bound by confidentiality, may carry out an audit on at least 30 days' notice, no more than once a year (unless required by the Information Commissioner's Office or following a personal data breach), during business hours and in a way that doesn't disrupt the Service or other customers. Each party bears its own costs.

12. Requests from authorities

If a public authority asks the Processor for Customer Data, the Processor will refer it to the Controller where possible, tell the Controller unless the law forbids it, and disclose only what it is legally required to.

13. The Controller's obligations

The Controller is responsible for the lawfulness of the processing it instructs, including having a lawful basis and, for special category and criminal offence data, a condition under Schedule 1 of the Data Protection Act 2018 and any appropriate policy document required; for the accuracy of the data; for giving privacy information to the people concerned; for managing its Users' access; and for using the Service's security features appropriately.

14. Liability and precedence

Each party's liability under this DPA is subject to the limits in the Terms of Service, except where the law does not allow it to be limited. If this DPA conflicts with the Terms of Service on a data protection matter, this DPA prevails. This DPA ends when the Processor has deleted all Customer Data.

Annex 1: Details of the processing

• Subject matter and duration: hosting the Service for the Controller for the subscription term and the export period that follows.
• Nature and purpose: storing, organising, calculating, displaying, exporting, emailing, backing up and deleting records so the Controller can manage its people, onboarding, checks, time off and attendance, payroll, expenses, company accounts and workforce compliance.
• Data subjects: the Controller's employees, former employees, job applicants and new starters, workers and contractors, their emergency contacts, the Controller's Users, and individuals named in the Controller's customer and supplier records.
• Personal data: identity and contact details; date of birth; nationality; National Insurance number; employment, job, salary, pay, tax code, pension, student loan and bank details; payslips; attendance, holiday and absence records; performance reviews, goals and training records; equipment issued; expense claims and receipts; documents uploaded; right-to-work and immigration records and identity documents; background check records; account and activity records; and business contact details in accounting records.
• Special category and criminal offence data: health information (sickness absence, and maternity, paternity and other family leave); information revealing racial or ethnic origin that may appear in nationality and immigration records; and the status and reference numbers of criminal record (DBS) checks. The Controller decides what it records.
• Frequency: continuous, for as long as the Controller uses the Service.
• Retention: as the Controller configures and deletes records, and as set out in section 10.

Annex 2: Technical and organisational measures

• Encryption in transit: all connections use HTTPS with a trusted certificate, and HSTS tells browsers never to connect without it.
• Separation: each Customer has its own web address, application, database and document store.
• Access control: role-based access (administrator, HR manager, read-only auditor, employee); employees can see only their own records.
• Authentication: passwords stored as salted scrypt hashes; accounts locked for 15 minutes after five failed attempts; sessions end after 12 hours; two-step sign-in available and can be made compulsory.
• Documents: stored outside the public website under random names and served only to signed-in, authorised Users; uploads are limited to permitted file types and checked.
• Accountability: an activity log, which nobody can edit or delete, records every change, document view, export and sign-in.
• Resilience: daily backups of each database, kept for 14 days; full data export available to the Controller at any time.
• Operations: server access is limited to named personnel using key-based authentication; software dependencies are kept up to date; security incidents are handled under a documented process.
• People: personnel with access to Customer Data are bound by confidentiality.

Annex 3: Sub-processors and transfers

• Namecheap, Inc. (United States): web hosting of the application, database, documents and backups, and delivery of service emails. Transfer safeguard: International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses.