Data Processing Agreement (DPA)

1. Scope and Roles

This Data Processing Agreement ("DPA") applies to the processing of personal data by HRHolly as a Data Processor on behalf of the Customer, who acts as the Data Controller. This DPA is an integral part of the HRHolly Terms of Service.

2. Processing Instructions

HRHolly shall only process personal data in accordance with the Customer's documented instructions, unless required to do so by Union or Member State law. Use of the HRHolly platform constitutes the primary instruction for data processing.

3. Confidentiality

HRHolly ensures that personnel authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4. Security Measures

Taking into account the state of the art, the costs of implementation, and the nature of processing, HRHolly implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption of data at rest and in transit.

5. Subprocessors

The Customer grants a general authorization for HRHolly to engage sub-processors for the delivery of the Service. Current sub-processors include our infrastructure providers in Sweden (document storage) and Holland (application data). HRHolly shall inform the Customer of any intended changes concerning the addition or replacement of sub-processors.

6. Breach Notification

In the event of a personal data breach, HRHolly shall notify the Customer without undue delay and, in any event, within 72 hours after becoming aware of the breach. Such notification will include information on the nature of the breach and measures taken to mitigate its effects.

7. Data Return and Deletion

Upon termination of the Service, HRHolly shall, at the choice of the Customer, delete or return all personal data to the Customer and delete existing copies, unless applicable law requires storage of the personal data.

8. Governing Law

This DPA is subject to the same governing law and jurisdiction as the primary Terms of Service (Denmark).

Data Processing Agreement