Data Processing Agreement

1. Parties and status

Support@employr.co.uk

This Data Processing Agreement (“DPA”) forms part of the agreement between Employr LTD (“Employr”, “Processor”, “we”, “us” or “our”) and the organisation that creates or uses a company account (“Customer” or “Controller”) for access to the Employr platform and related services (“Services”).

The Customer is the controller of Customer Personal Data and Employr is its processor, except where either party processes personal data as an independent controller for its own legitimate purposes, such as account administration, billing, fraud prevention, security, legal compliance or direct communications with its own personnel.

A person accepting this DPA for a Customer confirms that they have authority to bind that Customer. This DPA becomes effective when the Customer accepts it, enters into an order for the Services, or first provides Customer Personal Data to Employr, whichever occurs first.

2. Definitions and priority

“Applicable Data Protection Law” means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 where applicable, and any replacement or amending legislation that applies to the processing. “Customer Personal Data” means personal data processed by Employr on the Customer’s behalf through the Services. “Data Subject”, “personal data”, “personal data breach”, “processing”, “processor” and “controller” have the meanings given in Applicable Data Protection Law.

The Terms and Conditions, applicable order or subscription, and this DPA together form the parties’ agreement. If they conflict regarding the protection or processing of Customer Personal Data, this DPA prevails to the extent of that conflict. The Privacy Policy describes processing for which Employr acts as an independent controller and does not reduce either party’s obligations under this DPA.

3. Processing instructions

Employr will process Customer Personal Data only on the Customer’s documented instructions, including this DPA, the Terms, the Customer’s configuration and use of the Services, support requests, and other written instructions agreed by the parties.

Employr will not sell Customer Personal Data or use it for advertising. Employr may process Customer Personal Data where required by UK law; unless the law prohibits notice, Employr will inform the Customer of that legal requirement before processing.

Employr will promptly inform the Customer if, in its reasonable opinion, an instruction infringes Applicable Data Protection Law. Employr may suspend the affected processing while the parties resolve the issue and is not required to follow an unlawful instruction.

4. Customer responsibilities

The Customer determines the purposes and means of processing and is responsible for the lawfulness, fairness and transparency of its collection and use of Customer Personal Data. It must have an appropriate lawful basis, provide required privacy information, manage consents where relied upon, configure permissions, keep data accurate, and limit data to what is necessary.

The Customer is responsible for its users, credentials, role permissions, retention decisions, employee monitoring decisions, and lawful use of location, health, absence, incident, payroll, identity-document and signature features. The Customer must not instruct Employr to process personal data unlawfully.

5. Confidentiality and personnel

Employr will ensure that persons authorised to process Customer Personal Data are subject to an appropriate duty of confidentiality and receive access only where necessary for their role. Employr will take reasonable steps to ensure those persons understand and comply with relevant data-protection and security obligations.

6. Security

Taking account of the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the risk to Data Subjects, Employr will maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

The measures in Schedule 2 form part of this DPA. Employr may update them as technology and risk change, provided that the overall level of protection is not materially reduced. No service can guarantee absolute security.

7. Personal data breaches

Employr will notify the Customer without undue delay after becoming aware of a confirmed personal data breach affecting Customer Personal Data. Notice will include information reasonably available about the nature of the breach, likely consequences, affected data and Data Subjects, and measures taken or proposed. Information may be provided in phases.

Employr will take reasonable steps to contain, investigate, mitigate and remediate the breach and reasonably assist with the Customer’s notification obligations. The Customer remains responsible for deciding whether to notify the ICO, another regulator or affected Data Subjects.

8. Data-subject requests

Taking account of the nature of processing, Employr will provide reasonable assistance through appropriate technical and organisational measures to help the Customer respond to requests to exercise Data Subject rights.

If Employr receives a request relating primarily to Customer Personal Data, it will direct the requester to the Customer where reasonably possible and will not respond on the Customer’s behalf unless authorised or legally required. The Customer is responsible for verifying requests and determining the response.

9. Compliance assistance

Taking account of the nature of processing and information available, Employr will reasonably assist the Customer with obligations concerning security, breach notifications, data protection impact assessments and prior consultation with the ICO or another competent authority.

Where substantial assistance falls outside the normal Services or results from unusual Customer instructions, Employr may charge reasonable fees agreed in advance unless law prohibits doing so.

10. Subprocessors

The Customer gives Employr general written authorisation to appoint subprocessors. Employr will impose written data-protection obligations providing an equivalent level of protection required by Article 28 of the UK GDPR, to the extent applicable, and remains responsible to the Customer for a subprocessor’s performance of those obligations.

Current categories and core providers are in Schedule 3. Employr will provide reasonable advance notice of a material new subprocessor, ordinarily through published legal information or electronic notice. The Customer may object on reasonable data-protection grounds within 10 days. The parties will seek a solution in good faith; if none is available, either party may terminate the affected Services. Urgent security, continuity or legal substitutions may be notified as soon as reasonably practicable afterwards.

11. International transfers

Employr will not make a restricted transfer outside the United Kingdom unless permitted by Applicable Data Protection Law. Where required, it will use an adequacy regulation, the ICO International Data Transfer Agreement, the UK Addendum to approved EU Standard Contractual Clauses, or another legally recognised safeguard, and complete any required transfer risk assessment or data protection test.

The Customer authorises Employr to enter an appropriate transfer mechanism with a subprocessor on the Customer’s behalf where necessary to provide the Services.

12. Records, information and audits

Employr will make available information reasonably necessary to demonstrate Article 28 compliance. This may include policies, control summaries, available independent reports or certifications, and written questionnaire responses.

If that information is insufficient, the Customer may request an audit no more than once in 12 months unless a breach, regulator request or reasonable evidence of material non-compliance justifies another. Audits must occur during normal business hours on reasonable notice, protect other customers’ confidentiality and security, and use an independent confidential auditor. The Customer bears its costs unless material breach by Employr is identified.

13. Return and deletion

During the subscription the Customer may use available export and deletion features. On termination or expiry, and at the Customer’s choice where technically and legally practicable, Employr will return or delete Customer Personal Data after any agreed retrieval period unless UK law requires storage.

Deleted data may remain in access-restricted backups until ordinary secure rotation expires. It remains protected by this DPA and will not be restored except where necessary for disaster recovery or legal compliance.

14. Government and third-party requests

Unless prohibited by law, Employr will notify the Customer of a legally binding public-authority request for Customer Personal Data. Employr will disclose only what it is legally required to disclose and reasonably challenge requests that appear unlawful, overbroad or beyond the authority’s powers where there are reasonable grounds.

15. Liability, term and termination

This DPA remains in force while Employr processes Customer Personal Data. Liability is subject to the Terms to the maximum extent permitted by law, except where those limits cannot lawfully apply.

A material breach not remedied within a reasonable period after written notice permits termination of affected Services. Confidentiality, deletion, audit cooperation and processing restrictions continue for as long as Employr retains Customer Personal Data.

16. Changes and contact

Employr may update this DPA for changes in law, regulatory guidance, security practices or the Services and will provide reasonable notice of a material change. A change will not materially reduce protection during a current paid subscription without lawful basis or Customer agreement.

Notices and enquiries should be sent to Support@employr.co.uk. This DPA is governed by the laws of England and Wales, whose courts have exclusive jurisdiction subject to mandatory data-protection rights.

Schedule 1 — Details of processing

Subject matter: provision, support, security and improvement of the Employr workforce-management Services configured by the Customer.

Duration: the term of the Services and any limited period afterwards during which data is retained under the agreement, instructions, backup cycles or legal duties.

Nature and purpose: collecting, recording, organising, storing, retrieving, displaying, transmitting, calculating, reporting, exporting, securing, supporting and deleting data to provide accounts, employee records, scheduling, time and attendance, holidays and absences, pay-related calculations, projects, forms, documents, incident and safety reporting, training, equipment, uniform, notifications, authentication, support, backup and recovery.

Data Subjects: Customer personnel and users; employees, workers, contractors, temporary workers, applicants and former personnel; managers and supervisors; project clients, site contacts, emergency contacts and others entered by the Customer.

Personal data: identity, contact and account details; employment, role, team and identifier details; schedules, time records, hours and enabled location; holiday, absence, incident, accident, hazard, training, health-and-safety and injury information; pay rates, salary and deduction configuration; project, form, document, signature, equipment and uniform records; uploads, images and profile photographs; authentication, device, IP, session, audit and support data.

Special category data: health or injury information may be included where the Customer chooses. The Customer must identify an Article 9 condition and safeguards. The Services are not intended for criminal-offence data unless agreed in writing.

Schedule 2 — Technical and organisational measures

Measures include authenticated access; role and permission controls; restricted administrative access; TLS transport; provider-supported encryption at rest; logical customer separation; restricted file access; logging, monitoring, rate limiting, validation, maintenance and incident response; managed infrastructure, backup and recovery; confidentiality, least privilege and security awareness; export, retention and secure-deletion controls; and proportionate testing and remediation according to risk.

Schedule 3 — Subprocessor categories and core providers

Cloud infrastructure, database and object storage: Amazon Web Services, in configured European or United Kingdom regions.

Payments: Stripe for checkout, billing and payment administration. Payment-card data is submitted directly to Stripe and is not intended for Employr workforce records.

Authentication: Google and Apple where a user chooses OAuth sign-in.

Mobile security and notifications: Google Firebase where enabled for attestation, device registration and push notifications.

Transactional communications: Employr’s configured email-delivery provider for verification, security, account and service emails.

Professional support and infrastructure suppliers may receive limited data only where necessary under written confidentiality and data-protection obligations. Employr will keep this schedule or published subprocessor information reasonably current.