Data processing agreement

Purpose. Providing the service described in our terms of service, and nothing else.

Duration. While your account is open, and until deletion under section 6.

People concerned. Your employees and workers, your users, and your clients, contacts and suppliers.

Types of data. Whatever you put into the product, which can include identity and contact details, employment, leave, attendance and payroll records, documents, messages, invoices and payment details.

We process this data to provide the service, to keep it secure, and where a law we are subject to requires it. We do not sell it, and we do not use it to train anything. If an instruction from you appears to breach data protection law, we will say so.

Access is limited to people who need it to run the service, each under a duty of confidentiality. Traffic is encrypted in transit. Credentials for services you connect are encrypted at rest. Documents and other files are encrypted before they are stored and held in private storage. Backups are encrypted and kept in a separate region of the European Union.

You give us general authorisation to use the companies on our sub-processor list. We bind them to equivalent obligations and remain responsible to you for what they do. Before adding or replacing one we will update that list and give you reasonable notice. If you object on reasonable data protection grounds, tell us: we will find another route, or you may end the affected part of the service.

Requests from individuals. The product gives you export and erasure tools for the records you hold. If a request reaches us directly we pass it to you rather than answering it ourselves, and we help where the tools are not enough.

Breaches. If we become aware of a personal data breach affecting your data we will tell you without undue delay, with what we know and what we are doing about it.

Assessments and audits. We will give you the information you reasonably need for a data protection impact assessment, and to show compliance with this agreement, and allow an audit where the law entitles you to one.

You can export your records from within the product at any time. If you close your account we will delete your data within 30 days of your asking us to, except where we are required to retain something by law. Encrypted database backups are removed after 90 days, and files removed from storage leave our backups after 30 days.

Your data and files are stored in the European Union. Infinity Curve LLC is established in Georgia, so access by our own staff to personal data can take place from outside the European Economic Area. Some sub-processors are in the United States, as shown on the sub-processor list.

Georgia has no European Commission adequacy decision. For controllers in the European Economic Area, our access is made under the European Commission’s standard contractual clauses, Module Two (controller to processor), incorporated into this agreement with you as exporter and us as importer. Sections 1, 3 and 4 serve as their annexes. For controllers in the United Kingdom the same clauses apply as amended by the UK International Data Transfer Addendum.

Where this agreement and the terms of service conflict on personal data, this agreement wins. Where this agreement and the standard contractual clauses conflict, the clauses win. Our own handling of your account and billing data, as controller, is in our privacy notice.

Questions, or a signed copy: privacy@ergira.com.