Data processing addendum

• The Customer is the data fiduciary and HROS is the data processor for personal data in Customer Data (“Customer Personal Data”).
• The Customer is responsible for the lawfulness of the processing, for notices to and consents from its employees and other data principals, and for the accuracy of what it uploads.
• Terms used here but not defined have the meaning given in the DPDP Act. Where the Customer is subject to other data-protection laws (for example for staff outside India), HROS will reasonably cooperate with terms those laws require.

HROS processes Customer Personal Data only on the Customer’s documented instructions — this DPA, the Terms, and the Customer’s configuration and use of the service — unless Indian law requires otherwise, in which case HROS will inform the Customer first unless the law forbids it. HROS will tell the Customer if it believes an instruction breaks the law. HROS does not sell Customer Personal Data or use it for its own purposes, including advertising or training machine-learning models.

HROS gives access to Customer Personal Data only to personnel who need it to provide, support or secure the service, who are bound by confidentiality obligations, and who are trained in data protection. Access to production is role-based, logged and reviewed.

HROS maintains reasonable security safeguards, as section 8(5) of the DPDP Act requires, including:

• TLS encryption in transit; encryption at rest of the database, file storage and backups;
• field-level encryption of bank account numbers and government identifiers;
• logical separation of each customer’s data, enforced in the application and by database row-level security;
• role-based access control, multi-factor authentication and passkeys, and session controls for Customer users;
• audit logs of changes to employee records and of access to selfie photos;
• app-integrity checks on mobile attendance to resist location spoofing;
• regular backups, tested restoration, and vulnerability management of dependencies and infrastructure.

The Customer authorises HROS to engage the sub-processors below. HROS binds each one by written contract to obligations at least as protective as this DPA and remains responsible for their performance.

HROS will give at least 30 days’ notice by email to the account owner before a new sub-processor processes Customer Personal Data. If the Customer objects on reasonable data-protection grounds and the parties cannot agree a solution, the Customer may terminate the affected service and receive a pro-rata refund of prepaid fees for it.

Integrations the Customer connects with its own credentials (such as SMS, WhatsApp, Slack or Microsoft 365) are engaged by the Customer, not by HROS, and are not HROS sub-processors.

The primary database is hosted in India. Sub-processors may process data outside India as described above. HROS will not transfer Customer Personal Data to a country restricted by the Central Government under section 16 of the DPDP Act.

• HROS gives the Customer the means, mostly self-service in the product, to access, correct, complete, update, export and erase Customer Personal Data, and to record and withdraw consent for selfie verification.
• If HROS receives a request directly from a data principal it will pass it to the Customer without undue delay and will not answer it except on the Customer’s instruction.
• HROS will reasonably assist the Customer with grievances, with requests from the Data Protection Board of India, and with any data protection impact assessment or audit that applies to the Customer as a significant data fiduciary.

HROS will notify the Customer without undue delay, and in any case within 48 hours, of becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as then known, the nature and extent of the breach, its likely consequences, the data principals and data affected, and the measures taken or proposed.

HROS will take reasonable steps to contain and remedy the breach, provide updates, and support the Customer in its intimation to the Data Protection Board and to affected data principals. HROS will make its own reports to CERT-In as Indian law requires.

On termination the Customer may export Customer Personal Data during the 30-day read-only window. HROS then erases it from production within 30 days, and from backups within a further 35 days, unless Indian law requires HROS to keep it, and will confirm erasure in writing on request. During the subscription, HROS erases data the Customer deletes in line with the same backup cycle.

HROS will make available on request the information reasonably necessary to demonstrate compliance with this DPA, including a description of its security measures and any independent assessment reports it holds. Where that is not enough, the Customer may, at its own cost and no more than once a year, conduct or appoint an independent auditor bound by confidentiality to conduct an audit, on 30 days’ notice, during business hours and without disrupting the service or other customers’ data.

Each party’s liability under this DPA is subject to the limits in the Terms of service. If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails. It is governed by the laws of India, and the courts at {{JURISDICTION_CITY}} have exclusive jurisdiction.

Privacy contact: {{PRIVACY_EMAIL}}.