Data processing terms
These terms form part of the agreement between a customer organisation (the controller) and Technocity Solutions (the processor) for PipalHR. They apply whenever the service processes personal data on the customer's behalf, including under the EU and UK General Data Protection Regulation and the data protection laws of the UAE and Saudi Arabia.
Subject, duration and purpose
We process personal data only to provide the service the customer has signed up for (employee records, attendance, leave, documents, approvals and the other modules it switches on) for as long as the subscription lasts and the ninety days after it ends, then delete it.
Data and people concerned
- People: the customer's employees, former employees, candidates, and the contacts they give (family, emergency contacts, references).
- Data: identity and contact details, employment details, identity and work permit documents, attendance and location where the customer turns it on, leave, performance and training records, and bank details for pay.
- Special categories (health, biometric templates for face punching) only where the customer collects them, with the consent or legal basis the customer records.
Our commitments as processor
- We act only on the customer's documented instructions: the service's settings and what its users do in it.
- Everyone at Technocity Solutions with access is bound by confidentiality, and access to customer data is logged.
- Security: encryption in transit and at rest for identifiers, documents and biometric templates; role-based access; session expiry; daily encrypted backups kept on a separate server.
- Sub-processors: hosting, email delivery and payment providers. We tell customers before adding or replacing one, and they may object.
- We help the customer answer requests from the people concerned (access, correction, deletion, portability): HR has the tools in the service, and we assist on request.
- Personal data breaches are reported to the customer without undue delay, and in any case within 48 hours of our becoming aware, with what we know.
- At the end of the subscription the customer can export its data; we delete it within ninety days, except where the law requires us to keep it.
- We make available what is needed to show compliance, and allow reasonable audits on notice.
Transfers
Where data leaves the country or region it was collected in, the transfer is covered by the European Commission's standard contractual clauses (with the UK addendum), or the equivalent safeguard the customer's law requires. A customer can ask which region its data is stored in.
Contact
To sign a countersigned copy, or for questions about these terms, write to the provider.