Data processing agreement (DPA)

Subject matter, duration and nature of the processing

EACHR processes data to provide the eachr service: hosting, storage, display, computation, email notification, export and deletion, according to the modules the client company switches on. The processing lasts as long as the subscription, then for the time needed to return the data.

Categories of data and data subjects

• Data subjects: employees, managers, administrators and billing contacts of the client company, mandated office managers.
• Data: identity and contact details, contractual and career data, expense reports and receipts, absences and supporting documents (which may contain health data), working time and clock-ins, payroll elements and payslips (containing the social security number), HR documents, internal communication content, access logs.

EACHR's obligations

• Process the data only on the documented instructions of the client company, the features of the service constituting those instructions.
• Ensure the confidentiality of the people authorized to process the data.
• Implement the security measures described on the Security page: encryption in transit and at rest, isolation per company, role-based access control, document sealing, logging, backups.
• Assist the client company in answering data subject requests and, where needed, in its impact assessments.
• Notify the client company of any personal data breach without undue delay after becoming aware of it, with the information useful for its own notification.
• Keep a record of the categories of processing activities carried out on behalf of the client company.

Sub-processors

The client company authorizes EACHR to use the sub-processors listed in the privacy policy (hosting, database, file storage, automatic receipt reading, payment, emails, Google sign-in, monitoring, abuse protection). EACHR informs the client company of any addition or replacement at least 30 days in advance, by email or in the application; the client company may object in writing and, failing a solution, terminate the subscription free of charge.

Location and transfers

Data is stored in the European Union. Transfers to sub-processors established outside the EU are governed by the European Commission's Standard Contractual Clauses.

End of processing

At the end of the subscription, the client company has 60 days to export its data from the application or request its return. After that, EACHR deletes the data, except where a legal retention obligation applies (notably accounting).

Audit

EACHR makes available the information needed to demonstrate compliance with its obligations and allows, once a year and with 30 days' notice, an audit carried out by the client company or an independent auditor it mandates, at the client company's expense and without disrupting the service.

Liability

EACHR's liability under this agreement is subject to the limits set out in the terms.