Last updated: [EFFECTIVE DATE]
Data Processing Addendum
Draft processing terms for Customer Data.
This draft is provided for legal review and is not legal advice. Replace bracketed text and confirm the document for the jurisdictions and service configuration that apply before publication.
Scope and instructions
This DPA forms part of the Terms between Customer (Controller) and HutchHR (Processor) for Customer Personal Data. HutchHR will process that data only on Customer’s documented instructions, including these Terms, unless applicable law requires otherwise. Customer warrants its instructions and data collection are lawful.
Processor commitments
HutchHR will ensure persons authorized to process Customer Personal Data are bound by confidentiality; implement appropriate technical and organizational measures; assist Customer, taking account of the processing, with data-subject requests, security obligations, impact assessments, and regulator consultations; and notify Customer without undue delay after becoming aware of a personal-data breach, subject to legal limits.
Subprocessors and transfers
Customer authorizes HutchHR to use subprocessors needed to provide the Service, subject to appropriate written safeguards. The Subprocessors page identifies verified providers. HutchHR will provide [SUBPROCESSOR NOTICE / OBJECTION PROCESS PLACEHOLDER]. International transfers require lawful safeguards, including [SCC MODULE AND TRANSFER MECHANISM PLACEHOLDER] where applicable.
Audit, return, and deletion
Upon reasonable written request, HutchHR will make information reasonably necessary to demonstrate compliance available and cooperate with an audit subject to confidentiality, security, frequency, cost, and operational safeguards [AUDIT PROCESS PLACEHOLDER]. At termination, HutchHR will return or delete Customer Personal Data as instructed, unless retention is required by law; backup deletion timing is [BACKUP RETENTION PLACEHOLDER].
Processing details appendix
Duration: subscription term plus the return/deletion period. Nature: collection, storage, organization, retrieval, use, transmission, and deletion necessary to provide HRIS functions. Purpose: deliver the Service and support it. Data subjects: Customer personnel, applicants where enabled, administrators, and other individuals whose data Customer submits. Categories: identity/contact, employment, organizational, authentication, leave, performance, payroll/compensation, bank detail, document, usage, and support data. Customer must confirm the final categories, special-category data, and jurisdictional annexes.
Questions about these draft documents? Contact [CONTACT EMAIL].