Data processing agreement

1. Subject matter and duration

Processing of personal data of the Customer's employees, workers, candidates, contacts and users for the purpose of providing HR, recruitment, payroll, absence, learning and reporting functions, for as long as the Customer has a workspace and the retention period that follows it.

2. Nature and purpose of the processing

Storage, retrieval, organisation, calculation (including payroll, tax, National Insurance, pension and statutory payments), transmission to the recipients the Customer instructs (HMRC, pension providers, the Customer's bank and integrated systems), document generation, notification and reporting. Automated decision-making in the service (for example automatic approval of a leave request within guardrails) operates only where the Customer has switched it on and configured its limits.

3. Categories of data and data subjects

Data subjects: employees and former employees, workers, contractors, job applicants, users, emergency contacts and dependants, and the Customer's own staff who use the service.

Personal data: identification and contact details, employment and contract details, pay, tax and bank details, National Insurance numbers, absence and sickness records, right-to-work and identity documents, qualifications, performance and learning records, and any documents the Customer uploads.

Special category data: health data (sickness, occupational health, wellbeing), equality monitoring data where collected, and criminal records data where DBS checks are recorded.

4. Our obligations as processor

• Process personal data only on the Customer's documented instructions, which include the Subscription terms and the settings the Customer applies in the service, unless required by law to do otherwise, in which case we inform the Customer before processing where the law allows.
• Ensure that staff who have access to personal data are bound by confidentiality and have received data protection training.
• Apply the technical and organisational measures set out in the Security statement, and keep them under review.
• Assist the Customer with responding to data subject requests, with data protection impact assessments and with consultations with the ICO, taking into account the nature of the processing and the information available to us.
• Notify the Customer's administrators without undue delay, and in any event within 48 hours, on becoming aware of a personal data breach affecting the Customer's data, with the information needed to meet the Customer's own notification duties.
• At the end of the service, delete the Customer's personal data after the 60-day read-only period, or return it in a usable format on request before deletion, unless retention is required by law.
• Make available the information necessary to demonstrate compliance with this agreement and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, on reasonable notice and no more than once a year unless required by a supervisory authority or following a breach.

5. Sub-processors

The Customer gives general authorisation to the use of the following sub-processors. We give at least 30 days' notice of any intended addition or replacement by email to the workspace administrators, during which the Customer may object; if an objection cannot be resolved the Customer may end the subscription without penalty.

• Open Source AI Cloud (operated by Open Source AI Ltd, United Kingdom): hosting, database, file storage and backups.
• Stripe Payments Europe Ltd (Ireland; UK entity Stripe Payments UK Ltd): subscription billing. Receives the billing contact's name, email and payment details only; no employee data.
• Microsoft Ireland Operations Ltd: only where the Customer enables Microsoft Entra ID sign-in, Microsoft Teams interview scheduling, Microsoft 365 mail or Power BI, and only for the data those integrations exchange under the Customer's own Microsoft agreement.
• HM Revenue & Customs, pension providers and the Customer's bank receive data only on the Customer's instruction when a submission or file is sent; they are recipients acting as independent controllers, not sub-processors.

6. International transfers

Personal data is stored and processed in the United Kingdom. We do not transfer personal data outside the UK except where a sub-processor listed above does so under a lawful transfer mechanism (UK adequacy regulations, the UK International Data Transfer Agreement or Addendum), and we do not use the Customer's data to train machine-learning models.

7. Security

The measures we apply are described in the Security statement, which forms part of this agreement, and include isolation of each Customer's data in its own database schema, encryption in transit (TLS 1.2+) and at rest, role-based access control with multi-factor authentication, a complete audit trail, daily backups retained for 30 days, and vulnerability management.

8. Liability and term

The liability provisions of the Subscription terms apply to this agreement. This agreement lasts for as long as we process personal data on the Customer's behalf.

Data protection enquiries: ranjith@hr-payrollsystem.com. Open Source AI Ltd is registered with the Information Commissioner's Office.