Data Processing Terms

What we process

• Subject matter: providing the EasyHR service to the customer.
• Duration: the subscription, plus the export period.
• Data subjects: the customer's employees, workers, job candidates, and its client contacts.
• Data: identity, contact, employment, pay, attendance, leave, permit and passport, documents, and technical logs.

Our commitments

• Process personal data only on the customer's documented instructions, which are the use of the service and its settings.
• Keep the data confidential and limit access to people who need it.
• Keep each customer's data separate from every other customer's.
• Apply appropriate security: role-based access, encrypted connections, hashed passwords, an audit trail, backups and monitoring.
• Use only the sub-processors listed on the Sub-processors page, under written terms, and tell the customer before adding one so it can object.
• Help the customer answer requests from people exercising their data rights.
• Tell the customer of a personal data breach without undue delay, and in any case in time for the customer to meet a 72-hour notification obligation, with the information we have.
• On ending, return the data in a usable export and then delete it, unless the law requires us to keep it.
• Give the customer the information needed to show compliance and allow reasonable audits on notice.

The customer's commitments

• Have a lawful basis and any needed consent for the data it enters.
• Give its people the notices the law requires.
• Keep its own users' access appropriate and its sign-in details secure.

Contact

Data protection contact: our support team.