Scope and parties
This Data Processing Agreement (“DPA”) is part of the Terms of Service between EpicKOD (SMC-PVT) Ltd. (“Processor”) and the Customer (“Controller”). It applies whenever we process personal data in Customer Data on the Customer’s behalf. If this DPA conflicts with the Terms, this DPA wins.
“Data protection law” means every law that applies to that processing, including the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, India’s Digital Personal Data Protection Act, 2023, the California Consumer Privacy Act as amended (CCPA), Saudi Arabia’s Personal Data Protection Law, the UAE’s Federal Decree-Law No. 45 of 2021, and Pakistan’s Prevention of Electronic Crimes Act, 2016. Terms like “controller”, “processor”, “data fiduciary”, “personal data breach” and “service provider” have the meaning those laws give them.
Roles
The Customer is the controller (data fiduciary under the DPDP Act; business under the CCPA) and EpicHRM is the processor (data processor; service provider). Where the Customer is itself a processor for another company, EpicHRM is its subprocessor and the Customer will pass on that company’s instructions.
Processing on instructions
We process personal data only on the Customer’s documented instructions. The Terms, this DPA and the Customer’s use and configuration of the Service are those instructions. We will tell the Customer if we believe an instruction breaks data protection law, unless the law forbids it.
Under the CCPA, we will not:
- sell or share the personal data;
- keep, use or disclose it for any purpose other than providing the Service, or outside our direct business relationship with the Customer;
- combine it with personal data from other sources, except as the CCPA permits.
We certify that we understand and will comply with these restrictions.
Confidentiality of personnel
Everyone at EpicHRM who can access personal data is bound by confidentiality and gets access only as far as their job needs.
Security
We maintain the technical and organisational measures in Annex 2 and on our Security page, appropriate to the risk of the processing. We may improve them over time, but will not reduce overall protection.
Subprocessors
- The Customer authorises the subprocessors listed on our Subprocessors page.
- Each subprocessor is bound by written terms that protect the data at least as well as this DPA. We remain responsible for their work.
- We will give at least 30 days’ notice of a new subprocessor. If the Customer objects on reasonable data-protection grounds and we cannot resolve the objection, the Customer may end the affected service and get a pro-rata refund of prepaid fees.
Helping with individuals’ requests
The Service lets the Customer view and correct the personal data it controls and export it through reports. Where it cannot do something itself, we will help it answer requests from individuals exercising their rights. If we receive a request directly, we will pass it to the Customer and not answer it ourselves unless the Customer authorises us.
Personal data breaches
We will notify the Customer without undue delay, and in any case within 48 hours, after we become aware of a personal data breach affecting Customer Data. We will describe what happened, the data and people likely affected, the likely consequences and the steps taken, and keep the Customer updated. This lets the Customer meet its own deadlines, including the GDPR’s 72 hours and the DPDP Act’s requirement to inform the Data Protection Board and affected people.
Impact assessments and consultation
We will give reasonable help with data protection impact assessments and consultations with regulators, as far as they concern our processing.
International transfers
Customer Data is stored in [database region]. Where processing involves a restricted transfer:
- from the EEA: the Standard Contractual Clauses (Commission Decision 2021/914) apply, Module 2 (controller to processor) or Module 3 (processor to processor), with Clause 7 included, the optional wording in Clause 11 omitted, and Clauses 17 and 18 governed by the law and courts of Ireland. Annexes 1 to 3 of this DPA complete their annexes;
- from the UK: the UK International Data Transfer Addendum to those clauses applies;
- from Switzerland: the same clauses apply, with the Swiss Federal Data Protection Act in place of the GDPR where relevant;
- from India, Saudi Arabia, the UAE or Pakistan: we transfer only where those countries’ laws permit, and on the safeguards they require.
Return and deletion
When the Service ends, the Customer can export its data, or ask us for a full export, for 30 days. We then delete Customer Data, including copies held by subprocessors, except where the law requires us to keep it. Backups expire within 30 days.
Audits
We will make available the information needed to show compliance with this DPA, and allow audits by the Customer or an independent auditor it appoints, once a year on 30 days’ notice, during business hours and under confidentiality, or after a breach or a regulator’s request.
Annex 1: Details of processing
| Subject matter | Providing the EpicHRM HR service to the Customer. |
|---|---|
| Duration | The term of the Customer’s subscription, plus the export and deletion period above. |
| Nature and purpose | Hosting, storage, display, calculation (attendance, leave balances, payroll), transmission (email notifications) and deletion, to run the Customer’s HR administration. |
| Data subjects | The Customer’s employees, contractors, applicants it records, former staff, and its authorised users. |
| Categories of data | Identity and contact details; photo; date of birth; national ID number; address; emergency contact; employment details; attendance times; leave; expenses and receipts; salary, payroll and bank account details; uploaded documents; account and sign-in data. |
| Sensitive data | Blood group (health data), only if the Customer enters it; national ID numbers; financial account details. Protected by the measures in Annex 2. |
| Frequency | Continuous. |
Annex 2: Security measures
- Server-side isolation of every company’s data on every request.
- Role-based access control enforced by the API, with built-in and custom roles; invitation-only membership.
- Passkey (WebAuthn) authentication; passwords stored as Argon2 hashes; HTTP-only, secure session cookies with a 30-day lifetime.
- Rate limiting on authentication and other sensitive endpoints.
- Encryption in transit (HTTPS with HSTS) and at rest (database and file storage).
- Private file storage with short-lived signed links and upload type and size checks.
- Records of sensitive changes; platform staff have no access to employee records through the product.
- Regular database backups, kept for 30 days.
- Personnel confidentiality and least-privilege access.
Annex 3: Subprocessors and contact
Authorised subprocessors are listed on the Subprocessors page. Data protection contact: info@epickod.com; Grievance Officer / DPO: [name and email].