Data Processing Agreement

1. Subject matter and duration

The Processor hosts EmployeeCore for the Controller for the length of the subscription and the export period that follows.

2. Nature and purpose

Storing, organising, displaying, exporting, backing up and deleting records so the Controller can keep employee, right-to-work, immigration and sponsor-licence records and meet its own legal duties.

3. Personal data and data subjects

Data subjects: the Controller's employees, former employees, job applicants and their emergency contacts, and the Controller's Users.

Personal data: identity and contact details, date of birth, nationality, National Insurance number, immigration status and permission details, right-to-work check records, copies of identity and immigration documents, job, pay, hours and absence records, notes, and account and activity records. Some of this may reveal racial or ethnic origin; the Controller decides what it records.

4. Processor's obligations

The Processor will: process personal data only on the Controller's documented instructions (these terms and the Controller's use of the service), unless the law requires otherwise; make sure people authorised to process it are bound by confidentiality; take appropriate technical and organisational security measures, including encryption in transit, access controls, two-step sign-in, separate databases per Customer, activity logging and daily backups; assist the Controller in responding to data subjects' requests, in particular through the service's export and deletion tools; assist with security, breach notification, impact assessments and consultation with the ICO where relevant; notify the Controller without undue delay, and within 48 hours where possible, after becoming aware of a personal data breach; delete or return all personal data at the end of the service, as described in the Terms; and make available the information needed to demonstrate compliance and allow reasonable audits, on 30 days' notice and no more than once a year unless there has been a breach.

5. Sub-processors

The Controller authorises these sub-processors: Namecheap, Inc. (United States): hosting, storage and email delivery. The Processor will give 30 days' notice of any new sub-processor, during which the Controller may object; it will impose data protection terms on each sub-processor equivalent to these, and remains liable for their performance.

6. International transfers

The service is currently hosted in the United States. The Processor will only transfer personal data outside the UK with appropriate safeguards under UK data protection law (such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses) and a transfer risk assessment, details of which are available to the Controller on request.

7. Controller's obligations

The Controller is responsible for the lawfulness of the processing it instructs, for the accuracy of the data, for giving privacy information to its employees, for managing its Users' access, and for using the service's security features appropriately.