Data Processing Addendum

This Data Processing Addendum is current as of 9 April 2024 and explains Employment Hero’s data processing activities carried out as a Data Processor on behalf of its Customers.

It is important for users of the Swag app to know that ‘Swag’ is a brand created by Employment Hero, and this Data Processing Addendum also applies to relevant data processing activities carried out on behalf of Customers of the Swag app.

Previous versions of this document can be found here.

BACKGROUND

This Data Processing Addendum (“DPA”) forms part of the written or electronic agreement(s) between the Customer and Employment Hero (and its affiliates including Employment Innovations entities) for the provision of the Services, including the use of the Employment Hero Platform and/or the Swag app (the “Agreement”), to reflect the parties’ agreement regarding the processing of Personal Data.

This DPA also forms part of the Employment Hero Platform Terms and Conditions, and/or any other terms and conditions found here to which the Customer agrees when receiving Services from Employment Hero.

1. DEFINITIONS AND INTERPRETATION

In this DPA:

“Affiliates” means any corporation or other business entity controlling, controlled by or under common control with Employment Hero. A current list of Affiliates is available here;

“Applicable Law” means all laws, regulations, orders, rules, judgments, directives, industry agreements or determinations in force from time to time applicable to a party and relevant to the Agreement or this DPA, including, without limitation the GDPR and the UK GDPR;

“Customer” means the specific party which has entered into the Agreement with Employment Hero;

“Customer Personal Data” means Personal Data in respect of which the Customer is the Data Controller, and Employment Hero is the Data Processor; but which excludes Personal Data held by Employment Hero when acting as a Data Controller;

“Data Controller” means the entity which alone or jointly with others determines the purposes and means of Processing of Personal Data, it will be interpreted in accordance with the GDPR and the UK GDPR;

“Data Processor” means an entity which Processes Personal Data on behalf of a Data Controller, it will be interpreted in accordance with the GDPR and the UK GDPR;

“Data Protection Law” means the GDPR, the UK GDPR, Directive 2002/58/EC concerning the processing of Personal Data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), any national laws or regulations implementing the foregoing Directives, any other privacy and data protection laws that may be applicable to the parties (including data privacy laws that are specific to the region in which the Customer or relevant Employment Hero Affiliate is based), and any amendments to or replacements of such laws and regulations;

“Data Subject” has the meaning given to it in the GDPR and the UK GDPR;

“EEA” means the European Economic Area;

“GDPR” means in each case to the extent applicable to the processing activities: (i) Regulation (EU) 2016/679; and (ii) Regulation (EU) 2016/679 as amended by any legislation arising out of the withdrawal of the UK from the European Union;

“Employment Hero” means Employment Hero Pty Ltd, Employment Hero (UK) Ltd or the relevant Employment Hero Affiliate which has entered into the Agreement with the Customer for the provision of the Services;

“Personal Data” means any information relating to an identified or identifiable natural person and an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

“Processing” has the meaning given to it in Data Protection Law (the “GDPR” and the “UK GDPR”) and “process”, “processes” and “processed” will be interpreted accordingly;

“Relevant Country” means all countries other than those (a) within the EEA and (b) countries in respect of which an adequacy finding under Article 25(6) of the European Data Protection Directive or Article 45 of the GDPR has been given;

“Services” means the provision of cloud-based and artificial intelligence powered human resources and payroll software services, Managed Payroll services, Global Teams Employer of Record services where Employment Hero acts on behalf of its Customer, Applicant Tracking System (ATS), financial services products, and/or other products and services provided by Employment Hero and/or its Affiliates under the Agreement through its websites, platforms and apps where it acts in the capacity of a Data Processor;

“Standard Contractual Clauses” mean:

1. in respect of EU Personal Data, the EU Standard Contractual Clauses for the transfer of Personal Data to third countries pursuant to the GDPR, adopted by the European Commission under Commission Implementing Decision (EU) 2021/914 and made available on the European Commission website (or any replacement publication made on the website), including the text from modules two and three of such clauses and not including any clauses marked as optional (“EU Standard Contractual Clauses”);
2. in respect of UK Personal Data:
   1. the International Data Transfer Addendum to the EU Standard Contractual Clauses (“UK Addendum“) made available on the ICO website (or any replacement publication made on the website), issued by the Information Commissioner and laid before Parliament in accordance with s.119A of the Data Protection Act 2018 on 2 February 2022 but, as permitted by clause 17 of such addendum, the parties agree to change the format of the information set out in Part 1 of the UK Addendum so that:
      1. the details of the parties in table 1 of the UK Addendum will be as set out in Schedule 3 (with no requirement for signature);
      2. for the purposes of table 2 of the UK Addendum, the UK Addendum will be appended to the EU Standard Contractual Clauses (including the selection of modules and non-application of optional clauses as noted above); and
      3. the appendix information listed in table 3 of the UK Addendum is set out in Schedule 3.

“Swag app” means the mobile application and its services provided to Customers under Employment Hero’s ‘Swag’ brand.

“Sub-Processor” means any entity which is engaged by Employment Hero or by any other sub-processor of Employment Hero who may access or process Customer Personal Data;

“UK GDPR” means the GDPR as applicable as part of UK domestic law by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (as amended);

“User” means individual users of the Services including employees of Customer organisations.

1.1 Clarifications for this DPA

1.1.1 any words following the terms “including”, “include”, “in particular”, “for example” or any similar expression will be construed as illustrative and will not limit the sense of the words, description, definition, phrase or term preceding those terms;

1.1.2 references to Clauses and Schedules are, unless otherwise stated, references to the clauses of, and schedules to, this DPA; and

1.1.3 references to this DPA or any other agreement or document are to this DPA or such other agreement or document as it may be varied, amended, supplemented, restated, renewed, novated, or replaced from time to time.

2.DATA PROCESSING TERMS

2.1 General Data Processing Terms

2.1.1 Roles of the parties: The parties acknowledge that the Customer is the Data Controller and Employment Hero is the Data Processor of Customer Personal Data. The parties acknowledge that Employment Hero requires certain Personal Data to set up and manage the Customer’s account on Employment Hero’s platforms and apps and provide Services under the Agreement. Employment Hero may also provide specific services and support relating to individuals where it determines the purposes for which, and means in which, the Personal Data is processed, and in such cases, Employment Hero will process such Personal Data as a Data Controller.

2.1.2 Scope of this DPA: This DPA only applies to the processing of Customer Personal Data by Employment Hero in connection with the Services under the Agreement. The categories of Data Subjects and types of Customer Personal Data processed are set out in Schedule 1 of this DPA. Customer Personal Data is processed for the purpose of providing the Services and other purposes as identified in Schedule 1 of this DPA. Employment Hero may process Customer Personal Data for the duration of the Agreement (or longer to the extent permitted by Applicable Law).

2.1.3 Legal compliance obligation: Each party agrees that in relation to this DPA, it is compliant with, and will remain compliant with all Applicable Law. The Customer will ensure that it has a provided notice to Data Subjects of the data processing activities carried out under this DPA. If the Customer is a UK and/or EU based, the Customer will ensure that there is a valid lawful basis under the UK GDPR and/or GDPR for all Customer Personal Data that is disclosed in connection with the Agreement for the data processing activities envisaged by the Agreement.

2.1.4 Employment Hero’s rights and responsibilities: Other than for anything to the contrary in the Agreement, in relation to Customer Personal Data, Employment Hero will:

a. process Customer Personal Data only in accordance with the Customer’s instructions as established in the Agreement or as provided in writing by the Customer from time to time, provided such instructions are reasonable and subject to Employment Hero’s right to charge additional sums at its current rates should the scope of the agreed services be exceeded. In addition to this, Employment Hero may:

i.  process Customer Personal Data as required under Applicable Law and take reasonable steps to inform the Customer of such a requirement before processing the data, unless the law prohibits this; and

ii. process Customer Personal Data when analysing and/or providing support in relation to the Services, and carrying out measures to further develop and improve the Services for the Customer as a part of the ongoing delivery of Services, provided that necessary safety measures are put in place as may be required by Applicable Law;

b. promptly notify the Customer, if in Employment Hero’s opinion, an instruction from the Customer infringes Data Protection Law;

c. where applicable, ensure only its (or its Sub-Processors) personnel who are contractually bound to respect the confidentiality of Customer Personal Data will have access to the same;

d. implement appropriate technical and organisational measures to protect against unauthorised or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data. These measures will be appropriate to the harm which might result from any unauthorised or unlawful processing, accidental loss, destruction, damage, or theft of Customer Personal Data, and having regard to the nature of the Customer Personal Data which is to be protected and is set forth in Schedule 1 of this DPA. The Customer acknowledges that Employment Hero may change the security measures through the adoption of new or enhanced security technologies and authorises Employment Hero to make such changes provided that they do not materially diminish the level of protection. Employment Hero makes information about the most up to date security measures applicable to the Services available here;

e. at the Customer’s reasonable request and at the Customer’s cost, taking into account the nature of the processing, assist the Customer by implementing appropriate technical and organisational measures, insofar as this is possible, to assist with the Customer’s obligation to respond to requests from Data Subjects of Customer Personal Data seeking to exercise their rights under Data Protection Law (to the extent that the Customer Personal Data is not accessible to the Customer through the Services provided under the Agreement);

f. at the Customer’s reasonable request and at the Customer’s cost, taking into account the nature of the processing and the information available to Employment Hero, assist the Customer with its obligations under Articles 32 to 36 of the GDPR; and

g. upon written request by the Customer, delete or return to the Customer any such Customer Personal Data within the agreed period of time after the end of the provision of the Services as set out in the Agreement (or within a reasonable period of time if the Agreement is silent on this point), unless Applicable Law requires storage of the Customer Personal Data.

2.1.5 Data storage: Personal Data held by Employment Hero will be stored and managed on secure data centres in Australia and Ireland by a third-party storage provider.

2.2 Sub-Processors

2.2.1 Appointment of Sub-Processors: The Customer agrees that Employment Hero may transfer Customer Personal Data or give access to Customer Personal Data to Sub-Processors for the purposes of providing the Services or other purposes identified in Schedule 1 of this DPA, provided that Employment Hero complies with the provisions of this Clause. Employment Hero will remain responsible for its Sub-Processor’s compliance with the obligations of this DPA. Employment Hero will ensure that any Sub-Processors, to whom it transfers Customer Personal Data, enter into written agreements with Employment Hero requiring that the Sub-Processors abide by terms no less protective, in any material respect, than this DPA.

2.2.2 List of current Sub-Processors and notice of updates to the list: A current list of Sub-Processors is available here and is deemed to be pre-approved by the Customer. Employment Hero can at any time and without justification either appoint a new Sub-Processor, or remove or change an existing Sub-Processor. If the Customer subscribes for updates in regard to the Sub-Processor list by emailing privacy@employmenthero.com, the Customer will be given thirty (30) days’ prior written notice by email of such updates to the Sub-Processor list, or via the Employment Hero Platform and Swag app. The Customer is also advised to periodically check Employment Hero’s website, platforms, or apps for communications concerning updates to the Sub-Processor list.

2.2.3 Objections to Sub-Processors: If the Customer does not legitimately object to such changes within the time frame specified in clause 2.2.2, the Sub-Processor list update is deemed to be approved by the Customer. Legitimate objections to the Sub-Processor list update must contain reasonable and documented data protection grounds relating to a Sub-Processor’s non-compliance with applicable Data Protection Law. In the event the Customer reasonably objects to a new Sub-Processor, Employment Hero will use reasonable efforts to make available to the Customer a change in the Services or recommend a commercially reasonable change to the Customer’s configuration or use of the Services. This will be done to avoid processing of Personal Data by the new Sub-Processor to whom the Customer objects without unreasonably burdening the Customer. If Employment Hero is unable to make available such change within a reasonable period of time, which will not exceed sixty (60) days, the Customer may terminate the applicable Services which cannot be provided by Employment Hero without the use of the objected-to new Sub-Processor with written notice to Employment Hero.

2.2.4 Employment Hero must provide the Customer with agreements or contracts (subject to redaction of any confidential information) it has entered into with the Sub-Processor. Such copies will be provided by Employment Hero in a manner to be determined in its discretion, only upon the written request by the Customer via email to privacy@employmenthero.com, and at the sole expense of the Customer.

2.3 International Transfer Mechanisms

2.3.1 The Customer acknowledges that, in relation to providing the Services, EU or UK Customer Personal Data may be transferred to, or accessed from Australia or another Relevant Country. Where such transfer occurs, the Standard Contractual Clauses as specified in Schedule 3 of this DPA will apply and be incorporated as part of this DPA.

2.3.2 Employment Hero will not, and will ensure that none of its Affiliates or contractors, transfer, access or use EU or UK Personal Data in a Relevant Country other than in compliance with the terms of this DPA and the Standard Contractual Clauses (and as amended by the UK Addendum, where applicable). The Customer agrees to authorise the international transfers in application of Schedule 3, and the parties agree to comply with the obligations set out in the Standard Contractual Clauses as though they were set out in full in this DPA, with the Customer as the ‘data exporter’ and Employment Hero as the ‘data importer’, with the parties signature and dating of the Agreement being deemed to be the signature and dating of the Standard Contractual Clauses and with the Annexes and/or Appendices to the Standard Contractual Clauses being as set out in Schedule 3 to this DPA.

international data transfers out of the EEA, UK and/or Switzerland	obligations
Customer (as Controller) to Employment Hero Affiliate Transfer (EEA, and/or Switzerland to Relevant Countries)	If Employment Hero (acting as a Processor) is based outside of the EEA, United Kingdom and/or Switzerland, and transfer of Customer Personal Data is made by the Customer out of the EEA, United Kingdom and/or Switzerland to Employment Hero Affiliates located in Relevant Countries, such transfer will be governed by Module Two (Controller-to-Processor) of the Standard Contractual Clauses, if the Customer acts as a Controller.
Customer (as Processor) to Employment Hero Affiliate Transfer (EEA, and/or Switzerland to Relevant Countries)	If Employment Hero (acting as a Processor) is based outside of the EEA, United Kingdom and/or Switzerland, and transfer of Customer Personal Data is made by the Customer out of the EEA, United Kingdom and/or Switzerland to Employment Hero Affiliates located in Relevant Countries, such transfer will be governed by Module Three (Processor-to-Processor) of the Standard Contractual Clauses, if the Customer acts as a Processor.
Customer to Employment Hero Affiliate Transfer (United Kingdom to Relevant Countries)	Transfers of Customer Personal Data out of the United Kingdom to Employment Hero Affiliates (acting as sub-processors) located in Relevant Countries, will be governed by the applicable Module of the Standard Contractual Clauses as described in the two columns above (amended by the UK Addendum).
Employment Hero to Employment Hero Affiliate Transfer (United Kingdom to Relevant Countries)	If Employment Hero (acting as a Processor) is based within the United Kingdom, transfers of Customer Personal Data out of the United Kingdom to Employment Hero Affiliates (acting as sub-processors) located in Relevant Countries, will be governed by Module Three (Processor-to-Processor) of the Standard Contractual Clauses as amended by the UK Addendum.
Employment Hero to Employment Hero Affiliate Transfer (EEA and/or Switzerland to Relevant Countries)	If Employment Hero (acting as a Processor) is based within the EEA, and/or Switzerland, transfers of Customer Personal Data out of the EEA, and/or Switzerland to Employment Hero Affiliates (acting as sub-processors) located in Relevant Countries, will be governed by Module Three (Processor-to-Processor) of the Standard Contractual Clauses.
Employment Hero to Sub-Processor Transfer	Transfers of Customer Personal Data out of the EEA, United Kingdom and/or Switzerland to Employment Hero third-party Sub-Processors will be governed by data processing agreements, incorporating the Standard Contractual Clauses (as amended by the UK Addendum where applicable), that have been executed by Employment Hero at global level with the third-party Sub-Processors.

2.3.3 For the purposes of the EU Standard Contractual Clauses, the following will apply:

a. Clause 9 OPTION 2: where applicable, general written authorisation will be required for the engagement of new Sub-Processors. The parties agree that the time period for providing written notice of the engagement of a new Sub-Processor to Customers that have subscribed to receive such notice will be thirty (30) days;

b. Clause 17 (Governing law): the clauses will be governed by the laws of the Republic of Ireland; and

c. Clause 18 (Choice of forum and jurisdiction) the courts of the Republic of Ireland will have jurisdiction.

2.3.4 In the event that the Customer gives its consent to Employment Hero transferring Personal Data to a Relevant Country and a relevant European Commission decision or other valid adequacy method under applicable Data Protection Legislation, on which the Customer has relied in authorising the data transfer, is held to be invalid, or that any supervisory authority requires transfers of Personal Data made pursuant to such decision to be suspended, then the parties agree to discuss in good faith and facilitate use of an alternative transfer mechanism.

2.3.5 For transfer of Customer Personal Data out of countries other than the EEA, United Kingdom and/or Switzerland, Employment Hero will meet its obligations under Applicable Laws when carrying out such transfer.

2.4 Security Incident

2.4.1 Employment Hero will notify the Customer in writing (including via email), without undue delay, if it becomes aware of any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data processed by Employment Hero (“Security Incident“) that requires such notice under Applicable Law. Employment Hero will take such steps, within a reasonable timescales, to remedy the Security Incident and provide further information to the Customer as may be reasonably required.

2.4.2 Employment Hero will make reasonable efforts to identify the cause of any Security Incident and take steps as it deems necessary and reasonable to remediate the cause of such a Security Incident to the extent the remediation is within Employment Hero’s reasonable control.

2.4.3 Employment Hero’s assistance under this clause which exceeds any obligations set out by Applicable Law will be chargeable, as incurred, at Employment Hero’s then current rates unless the Customer demonstrates that such assistance is required because of a failure by Employment Hero to comply with the obligations under this DPA.

2.4.4 The obligations under this clause will not apply to Security Incidents that are caused by the Customer or its personnel.

2.5 Audits and Inspections

2.5.1 To the extent required by Applicable Law, and upon written request from the Customer within reasonable intervals between each request and at the Customer’s cost and expense, Employment Hero will, audit the security of the computers and computing environment that it uses in processing Customer Personal Data. This audit will be performed no more than once annually and it may be performed by independent third-party security professionals at Employment Hero’s selection (in which case such selection is made at Employment Hero’s expense). In the event that Employment Hero has recently acted in respecting such rights for another customer, it will provide to the Customer a summary of the most recent audit results.

2.5.2 Employment Hero will respond, no more frequently than annually, to any reasonable security questionnaire provided by a Customer which seeks to assist Customer’s assessment of Employment Hero ’s compliance with the security obligations under this DPA and which may be applicable to the Services. The responses to such questionnaires and any supporting evidence provided by Employment Hero will be considered the confidential information of Employment Hero.

2.5.3. If the Customer desires to change this instruction regarding exercising the audit rights or the provision of information in order to demonstrate compliance with Article 28 of the GDPR, then the Customer has the right to change this instruction to the extent so required to ensure compliance, which must be requested in writing via email to privacy@employmenthero.com, provided that Employment Hero will have no obligation to provide commercially confidential information.

2.6 Return or Deletion of Personal Data

2.6.1 At the end of the Services, upon the Customer’s written request, Employment Hero must securely destroy, or return such Personal Data to the Customer, and delete existing copies unless Applicable Law requires storage of such Personal Data.

2.6.2 A certification of deletion of the Personal Data will be provided by Employment Hero upon the Customer’s written request via email to privacy@employmenthero.com, provided that the Customer has a right to receive a certification of deletion under Applicable Law.

2.7 Limitation of Liability

2.7.1 The parties acknowledge and agree that any liability of Employment Hero and/or its Affiliates arising out of or in relation to this DPA is subject to the liability sections of the Agreement (namely the applicable sections of the Employment Hero Platform Terms and Conditions and/or any other specified terms and conditions of an Agreement entered into between the Customer and Employment Hero).

2.7.2 For the avoidance of doubt, Employment Hero and its Affiliates’ total liability for all claims from the Customer and all of its affiliates arising out of or related to the Agreement and all DPAs will apply in the aggregate for all claims under both the Agreement and all DPAs established under the Agreement, including by the Customer and all Affiliates, and will not be understood to apply individually and severally to the Customer and/or to any Affiliate that is a contractual party to any such DPA.

2.8 Other General Terms

2.8.1 Conflict: In the event of any conflict or inconsistency between the body of this DPA and any of its Schedules (not including the specifications of the Standard Contractual Clauses), and the Standard Contractual Clauses specified in Schedule 3, the Standard Contractual Clauses will prevail (unless this would result in the invalidity of this DPA under Data Protection Laws (in which case the relevant term(s) of this DPA will prevail).

2.8.2 Changes to this DPA: Employment Hero reserves the right to make any updates or changes to this DPA to reflect changes in its Services, information practices, operational requirements, or changes to laws and regulations. The Customer should periodically review this DPA to see any amendments that have been made. If Employment Hero makes any significant changes to this DPA, Employment Hero may provide notice to Customers via email or by other means of communication.

 

 

Schedule 1

Data Processing Information

Nature and purpose of processing operations

The nature of processing is the collection, recording, organisation, storage, adaptation, use, disclosure, or transfer of Customer Personal Data.

The Customer Personal Data will be processed for the purpose of providing, and further improving the Services provided by Employment Hero. This primarily includes the provision of:

• Employment Hero HR and Payroll platform,
• Managed Payroll services;
• Applicant Tracking System; and
• Global Teams Employer of Record services (if Employment Hero acts as a Processor)

Categories of data subject

Customers, Users and other persons authorised to use the Services by Customers of the Services provided by Employment Hero and its Affiliates.

Categories of data

This data primarily includes data relevant for processing carried out in the provision of the Services including:

Categories of Personal Data

Customers Business account information including business name and details, logos and information relating to representatives of the business; Contact information including residential and/or postal address, email address, telephone number, and social media handles; Payroll information including information relating to payroll processing, compensation, timesheets and bank account information; Employee related information including employee names, job title and details, and contact details; General business information including information relating to employees’ and the businesses goals, accomplishments, training and development, awards and performance, feedback and reviews, onboarding and offboarding details, and implementation process information; and Recruitment related information including job vacancy details, profile photo, company details relevant to the job posting such as work location and contact emails, and the name and contact details of any personnel involved in the recruitment process.   Users Individual or business account information including name, business name, date of birth, age, gender, sex, marital status, profile photo;. Contact information including residential and/or postal address, email address, telephone number, and social media handles; Employment related information including occupation or job title, information relating to current and former employers, key dates relating to the current role and/or past roles, superannuation information, salary and/or pension details including documents such as payslips and payment summaries, timesheets, performance reviews and workplace engagement information, workplace issues and incident information citizenship and visa status for work eligibility purposes, emergency contact information, and tax information; and Job application related information including CV, cover letter, profile photo, work preferences, salary expectations, education history, work history, qualifications, languages, and references.

Special Categories of Personal Data

The Customer or users of the Services may submit Special Category Personal Data to the platform or app at their discretion, or Employment Hero may collect such data with prior consent for the purpose of providing its Services to the Customer or relevant end-users.  This data primarily includes: sensitive information provided in compliance documentation stored on the Services by the Customer or end-users; ID documents and information provided within such documents that may include details about ethnicity or race, religious beliefs; health information such as disability information, health status relevant to administration of long-term disability or other medical benefit programs, vaccination history, medical reports, return or work/adjustment reports and workplace injury reports; and work eligibility information such as immigration status, visa status and details, and criminal history and background.

 

Duration of Processing

Employment Hero will process Customer Personal Data for the duration of the Agreement (or longer to the extent permitted by Applicable Law).

 

Schedule 2

Technical and Organisational Measures

The Technical and Organisational Measures are detailed in our Security Centre and Security Portal.

The measures identified in these pages may be updated by Employment Hero from time to time in accordance with clause 2.1.4(d).

Schedule 3

Annexes to the EU SCCs and Appendices to the UK SCCs

Annex I/ Appendix 1:

A: LIST OF PARTIES

Data exporter:

Name: Customer

Activities relevant to the data transferred under these Clauses: Provision of the Services, all data processing categorised as “C2P” where the Controller is located inside, and the Processor is located outside the EU/EEA or the UK.

Role (controller/processor): controller

Data importer:

Name: Employment Hero

Address: Set forth in the applicable Customer Services Agreement

Contact email: privacy@employmenthero.com

Activities relevant to the data transferred under these Clauses: Provision of the Services and all data processing categorised as “C2P”, where the Controller is located inside, and the Processor is located outside the EU/EEA or the UK.

Role (controller/processor): processor

B: DESCRIPTION OF TRANSFER

MODULE TWO: CONTROLLER TO PROCESSOR

Nature of Processing: See Schedule 1 above.

Purpose of Processing: See Schedule 1 above.

Categories of Data Subjects: See Schedule 1 above.

Categories of Personal data Transferred: See Schedule 1 above.

Sensitive data transferred (if applicable): See Schedule 1 above.

Frequency of transfer: Continuous.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period (EU standard contractual clauses only): in accordance with relevant data retention/deletion obligations.

For transfers to sub- processors, the subject matter, nature and duration of the processing (EU standard contractual clauses only): As set out in Schedule 1.

C: COMPETENT SUPERVISORY AUTHORITY

Irish Data Protection Commission

21 Fitzwilliam Square

South Dublin 2

Republic of Ireland

D02 RD28

dpo@dataprotection.ie

 

Annex II/ Appendix 2: Technical and Organisational Measures

Data importer has implemented and will maintain appropriate technical and organisational measures to protect Customer Personal Data (as defined in the DPA) against the unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data. The measures described in Schedule 2 of the DPA are hereby incorporated into this Appendix 2 by this reference and are binding on the data importer as if they were set forth in this Appendix 2 in their entirety.

 

Annex III of the EU Standard Contractual Clauses

LIST OF SUB-PROCESSORS

You can find a list of all Employment Hero Sub-Processors here.

LIST OF EMPLOYMENT HERO AFFILIATES

You can find a list of all Employment Hero Affiliates here.