Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") supplements and forms an integral part of the SaaS Master Agreement or Terms of Service entered into between omniHR Technologies Private Limited ("Data Processor" or "omniHR") and the Customer subscribing to the HRMS ("Data Controller" or "Data Fiduciary").

This DPA reflects the parties' commitment to abide by data privacy and security legislation, including Article 28 of Regulation (EU) 2016/679 (GDPR), the UK Data Protection Act 2018, and India's Digital Personal Data Protection Act, 2023 (DPDPA).

Processor agrees that it shall process Customer Personal Data strictly:

• In accordance with Customer's documented instructions, as set forth in the Agreement, this DPA, and Customer's active configuration of the HRMS portal;
• For the sole purpose of delivering the software features (payroll computations, leave tracking, clock-in management, talent operations, and corporate communications);
• Never for its own independent commercial benefit, direct marketing, or profiling.

If Processor is required by statutory law (e.g., court subpoena) to process data contrary to Customer's instructions, Processor shall notify Customer in advance unless prohibited by law.

The subject matter and specifics of processing under this DPA encompass:

Processor maintains state-of-the-art technical and organizational measures to ensure a level of security appropriate to the risk of processing employee compensation and identity records:

• Data In Transit: Enforced TLS 1.3 with AES-256 cipher suites and HSTS.
• Data At Rest: Relational databases and object store attachments encrypted via AES-256 GCM.
• Logical Tenant Partitioning: Cryptographic and row-level access control preventing cross-tenant leakage.
• Privilege Segregation: Dual-role RBAC matrices preventing IT service engineers from accessing HR salary vaults.
• Disaster Recovery: Daily automated encrypted backups with tested recovery procedures.

Processor warrants that all employees, contractors, and software engineers who have access to Customer Personal Data are bound by enforceable confidentiality obligations, have completed background verification, and receive regular data privacy training. Access is strictly granted on a least-privilege, need-to-know basis.

Customer grants Processor general written authorization to engage third-party subprocessors. Processor shall:

• Maintain an up-to-date public list at Subprocessors Directory;
• Provide at least thirty (30) days prior notice before appointing any new subprocessor;
• Impose equivalent contractual data protection obligations on any subprocessor as are imposed on Processor under this DPA;
• Remain fully liable to Customer for the performance of each subprocessor's obligations.

Processor shall notify Customer without undue delay (and in no event later than [24 to 48 hours]) upon becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data.

The notification shall provide sufficient information to enable Customer to meet its obligations to report the incident to regulatory authorities (including the Data Protection Board of India and EU DPAs) and affected employees.

Taking into account the nature of the processing, Processor shall assist Customer by providing built-in self-service administrative features (data export, profile correction, employee archival) to enable Customer to respond to requests from Data Subjects exercising their statutory rights under DPDPA, GDPR, or applicable privacy laws.

To the extent Customer Personal Data originating from the European Economic Area (EEA), United Kingdom, or Switzerland is transferred outside those regions, the European Commission's Standard Contractual Clauses (Module 2: Controller to Processor) are hereby incorporated by reference.

Upon expiration or termination of the SaaS Master Agreement, Processor shall, at Customer's election, provide an export mechanism to return all Customer Personal Data, and thereafter cryptographically erase all existing copies from production databases within [30 to 60 days], unless applicable statutory law requires prolonged retention.

Processor shall make available to Customer all information reasonably necessary to demonstrate compliance with this DPA. Customer may conduct an audit (no more than once per calendar year upon thirty (30) days written notice) by reviewing independent third-party audit reports (such as [SOC 2 / ISO 27001 AUDIT SUMMARY PLACEHOLDER]) or conducting a reasonable remote security assessment.

This DPA shall be governed by and construed in accordance with the governing law and jurisdiction specified in the SaaS Master Agreement. In the event of any conflict between this DPA and the Master Agreement, the terms of this DPA shall take precedence with respect to data protection obligations.