This agreement forms part of the Terms of Service between Tech Lab India and each customer company. The customer is the controller (the "data fiduciary" under India's Digital Personal Data Protection Act) of the personal data it puts into HRHelm, and Tech Lab India processes that data on the customer's behalf. It is written to meet Article 28 of the EU and UK GDPR, the UAE Personal Data Protection Law and India's DPDP Act. For a countersigned copy, email support@hrhelm.com.
1. What we process and why
Subject matter and purpose: providing HRHelm to the customer, including support, backups and security. Duration: for as long as the customer's subscription lasts, then as described under "End of the service".
People: the customer's employees, former employees, job candidates, their dependants and nominees, and the customer's users.
Data: identity and contact details, job and organisation details, attendance, leave, payroll and bank details, tax and statutory identifiers, documents the customer uploads and, where the customer turns them on, location at clock-in and attendance selfies.
2. Our commitments
We process personal data only on the customer's documented instructions, which are the Terms, this agreement and the customer's use of HRHelm. If we believe an instruction breaks the law, we'll say so.
Everyone at Tech Lab India with access to customer data is bound by confidentiality.
We keep appropriate technical and organisational security measures, including encrypted connections, hashed passwords, encrypted storage of secrets, role-based access within each workspace, optional two-factor sign-in, an audit log and regular backups.
We help the customer respond to requests from the people whose data it holds (access, correction, deletion), mostly through features in HRHelm itself, and with security, breach notification and impact assessments where the law requires.
3. Sub-processors
The customer authorises the sub-processors listed at hrhelm.com/subprocessors. We'll give at least 30 days' notice by email before adding or replacing one, and the customer may object on reasonable data-protection grounds; if we can't resolve the objection, the customer may end the subscription and receive a pro-rata refund of prepaid fees.
We impose the same data-protection obligations on each sub-processor and remain responsible for them.
4. Personal data breaches
We'll notify the customer without undue delay, and in any case within 72 hours, after becoming aware of a breach affecting its personal data, with what we know about its nature, likely effects and the measures taken, and keep the customer updated.
5. Where data is stored and international transfers
Customer data is hosted by Our hosting provider in the country stated in your order. Moving it to another country is a change of sub-processor and gets the same notice.
Where data leaves the European Economic Area, the UK or the UAE, the transfer relies on the European Commission's Standard Contractual Clauses (with the UK addendum) or another mechanism the law recognises. Customers whose law requires personal data to stay in their country (for example some data under Saudi Arabia's PDPL) should contact us before subscribing.
6. End of the service
The customer can export its data to Excel at any time. When a subscription ends, we keep the data for 90 days so the customer can return or export it, then delete it, including from backups within a further 30 days, unless the law requires us to keep it.
7. Audits
We'll make available the information needed to show compliance with this agreement and allow for audits by the customer or an independent auditor it appoints, on 30 days' written notice, at the customer's cost and no more than once a year unless a breach or a regulator requires it.