Data Processing Agreement.

KivoHR Data Processing Agreement

This Data Processing Agreement ("DPA") is section 6 of the KivoHR Terms of Service ("terms") between Sitenet Tech Ltd ("we", "us") and the organisation that uses KivoHR ("you"). It meets Article 28 of the UK GDPR. Words defined in the UK GDPR have the same meaning here. "Your data" means the personal data we process for you in providing KivoHR.

6. How we process your data

6.1 Roles. For the personal data in your data, you are the controller and we are your processor under the UK GDPR and the Data Protection Act 2018. This section, with Annex 1 (the processing), Annex 2 (our security measures) and Annex 3 (our sub-processors), is our data processing agreement with you. If anything else in the terms conflicts with this section, this section applies, except that an addendum accepted under the terms (such as our AI addendum) applies where it is more specific about the feature it covers. For our own records about your organisation and its users (accounts, billing, support), we are the controller, as our privacy notice explains.

6.2 Your instructions. We process personal data only on your documented instructions, including about transfers outside the UK (6.7). Your instructions are the terms, any order form, written requests from your account owners, and what you and your users do in the service, including the settings you choose. You decide your organisation's HR policies and settings. We apply them as you configure them, and we are responsible for the service working as we describe it and for its built-in figures and calculations being correct. You are responsible for your instructions, settings and use of the service being lawful, for having a lawful basis for the data you put in, and for giving your staff the privacy information the law requires. We will process personal data in any other way only where UK law requires us to. If it does, we will tell you before we do, unless that law forbids us to on important grounds of public interest.

6.3 Instructions we think are unlawful. If we think an instruction from you breaks the UK GDPR or other data protection law, we will tell you straight away. We are not in breach of the terms if we do not carry out that instruction until you confirm or change it.

6.4 Our people. Everyone at Sitenet Tech, and at our sub-processors, who can access your personal data is bound by a duty of confidentiality and acts only on your instructions. Our staff reach your data only to run, secure and support the service for you. When we open your account to help with a support request, our access is tied to a support ticket from your organisation, is read-only, hides every category of data above basic details, ends automatically (after eight hours at most), and is recorded in your own audit log.

6.5 Security. We keep the technical and organisational measures in Annex 2, which are designed to meet Article 32 of the UK GDPR. We review them regularly. We may change them, but never in a way that lowers the overall protection of your data.

6.6 Sub-processors. You give us general authorisation to use the sub-processors in Annex 3. For each one the list says what it does, which personal data it handles, where it processes and stores it, and the safeguard for any transfer outside the UK. We will:

• put each sub-processor under a written contract that imposes the same data protection obligations as this section, including sufficient guarantees of appropriate security;
• email your account owners at least 30 days before we add or replace a sub-processor, or change where one processes your data, stating the date the change takes effect;
• let you object on reasonable data protection grounds before that date, by email to support@kivohr.com. If you object, we will discuss it with you in good faith. If we cannot avoid using that sub-processor for your data, you may end the agreement by notice before the change takes effect, and we will refund any fees you paid in advance for the period after it ends; and
• remain fully liable to you for each sub-processor's performance of its data protection obligations, as if they were our own.

AI providers process your data only if an account owner has switched on AI suggestions and accepted our AI addendum. They are authorised only by that addendum and listed on our AI sub-processors page, with what each keeps as its own terms state; they never receive your data otherwise.

6.7 Transfers outside the UK. We transfer personal data outside the UK only to the sub-processors in Annex 3, to the places named there, and only where the transfer meets Chapter V of the UK GDPR: either the transfer is approved by UK regulations (which cover the EEA, and US organisations taking part in the UK Extension to the EU-US Data Privacy Framework), or it is made under the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses and we have concluded, acting reasonably and proportionately, that the data protection test in Article 46 is met.

6.8 Your staff's rights. Taking into account what we do for you, we will help you answer requests from people exercising their data protection rights, through the service's own features (finding, exporting, correcting and deleting records) and, where those are not enough, by other reasonable means. If such a request reaches us directly, we will pass it to you without undue delay and will not answer it ourselves unless you ask us to.

6.9 Personal data breaches. We will tell your account owners without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting your data. We will tell you what we know: what happened, the categories and approximate numbers of people and records involved, the likely consequences, what we have done and will do about it, and who to contact. If we cannot give all of this at once, we will give it in stages as we learn it. We will help you notify the Information Commission and the people affected where you must. We will not notify them on your behalf unless you ask us to or the law requires it.

6.10 Impact assessments and the regulator. We will give you the information and reasonable help you need to carry out a data protection impact assessment of your use of the service, and to consult the Information Commission before processing where an assessment shows a high risk you cannot reduce. Annex 1 and Annex 2 describe the processing and our measures for that purpose. We will cooperate with the Information Commission if it asks us to.

6.11 Showing we comply: information and audits. We will give you all the information you need to show that we meet our obligations under Article 28 of the UK GDPR, and we will allow for and contribute to audits, including inspections, by you or an auditor you appoint. So that an audit does not put other customers' data or the service at risk:

• give us at least 30 days' written notice, with the audit's scope;
• audits take place in UK working hours, no more than once in any 12 months, unless the Information Commission requires one or there has been a personal data breach affecting your data;
• the auditor must be bound by confidentiality and must not be our competitor;
• an audit cannot give access to other customers' data or weaken the service's security. We may first answer the audit's questions with documents, such as our policies and test reports; if they do not answer them, the audit goes ahead;
• we do not run our own data centres. For the premises and systems of our hosting and other sub-processors, we will give you the audit reports and certifications they make available to us, and use our own audit rights under our contracts with them where those reports do not answer your reasonable questions; and
• each of us pays its own costs, unless the audit shows we have materially broken this section, when we pay your reasonable costs.

6.12 Records. We keep the records of processing that Article 30(2) of the UK GDPR requires, and make them available to the Information Commission on request.

6.13 When the agreement ends. You can return your data to yourself by exporting it during the 90 days of read-only access that follow the end of the agreement. Your data is then deleted as the terms describe, which is your instruction to us. We delete every copy, except where UK law requires us to keep it. Backups, including safety copies of the whole database that we take before maintenance such as moving an organisation to a database of its own, are kept for no longer than 35 days, are encrypted, can be restored only by named members of our staff, and are never used to bring back a deleted organisation. We send your account owners a deletion certificate that gives the date by which copies in backups are gone.

6.14 Liability. The liability section of the terms applies to claims under this section, including its separate limit for your data.

6.15 Changes the law requires. If data protection law, or the Information Commission's guidance, changes in a way that requires this section to change, we may update it under the terms' section on changes.

Annex 1: The processing

Subject matter. Our hosting, running and support of KivoHR, an HR software service, for you.

Duration. From when you start a trial or sign up until your data is deleted under the terms (including the 90 days of read-only access after the agreement ends, and any time on the Archive plan), and then up to 35 days while copies leave our backups.

Nature. Collecting data through the forms, imports and connections you and your users use; storing, organising and displaying it to the people you authorise; calculating (for example leave, holiday pay, notice and deadlines) as your settings direct; producing documents, letters, reports and exports; sending email and notifications; scanning uploaded files for viruses; backing up; deleting; and, only if an account owner switches it on under our AI addendum, sending limited, masked information to an AI provider to get suggestions.

Purpose. To provide, secure and support KivoHR for you, as the terms describe. Never for our own purposes, never for marketing, and never to train AI models.

People the data is about. Your employees and former employees; workers, contractors, agency workers and volunteers; job applicants and candidates; new starters before they join; your users; their emergency contacts and next of kin that you record; referees; people named in records such as conduct, grievance and harassment cases (complainants, witnesses and third parties such as customers or visitors); and contacts at your sites, clients, suppliers and advisers that you record.

Types of personal data.

• identity and contact details: name, address, email, phone, date of birth, photo;
• identifiers: National Insurance number, employee number, passport and other identity document numbers, tax code, and a contractor's Unique Taxpayer Reference;
• employment: job, contract, hours, workplace, manager, start and leaving dates, notice;
• pay and money: salary, payslips, bank details, pension, expenses and deductions;
• time and attendance: rotas, shifts and clock times, the network a clock-in came from, and, only at a site you set to check location, the location where someone clocked in or out (deleted after 31 days unless you change that);
• leave and absence;
• performance, training, qualifications, certificates and professional registrations;
• conduct, discipline and grievance records;
• right-to-work and immigration records: check results, document copies, visa conditions and sponsorship records (share codes are used to make a check but are not kept);
• recruitment: applications, CVs, interview notes, references and offers;
• documents and files you upload, and equipment issued; and
• system data: user accounts, sign-in and device records, IP addresses, and audit logs.

Special category data (Article 9 UK GDPR).

• health: sickness absence and its reasons, fit notes, occupational health, disability and adjustments, and pregnancy and family-leave records;
• equality monitoring answers, such as ethnic origin, religion or belief, sexual orientation and disability, given voluntarily, seen only by the person themselves and, by account owners, only as an anonymous report; and
• any other special category data you choose to record, for example trade union membership in a grievance record.

KivoHR does not process biometric data.

Criminal offence data (Article 10 UK GDPR). Criminal record checks (DBS, AccessNI, Disclosure Scotland and PVG) and their outcomes, certificate details where you record a lawful basis for keeping them, and any offence information you record in a conduct case.

Your obligations and rights as controller. As set out in this section and the rest of the terms.

Annex 2: Security measures

Separation. Every record belongs to one organisation, and the system refuses to read records when it does not know which organisation is asking. Each organisation has its own web address, and a sign-in works only there. On the Group plan, or with the separate database option, an organisation's records are kept in a database of their own.

Encryption. All traffic to the service is encrypted (HTTPS, with HSTS). The most sensitive fields (National Insurance numbers, dates of birth, bank account numbers, IBANs and building society roll numbers, Unique Taxpayer References, identity document numbers, and DBS and PVG certificate numbers) are also encrypted inside the database, under a key kept separately from the application's own key. Backups are encrypted on our server before they are stored, with a key only we hold, kept offline. Encryption at rest of the live database and file store by our hosting providers: to be confirmed before launch. Uploaded files, including identity document scans, are not yet encrypted by the application.

Files. Uploads are kept in a private store, never publicly reachable, and are served only after an access check. Every uploaded file is scanned for viruses before anyone can open or import it, and is refused if the scanner finds anything or cannot run. Only listed document, image and text types are accepted: web pages, SVG images and programs are refused, and a file that could run script in a browser always downloads rather than opening.

Access for your users. Access follows the roles and permissions you set. Health, equality, criminal-record, immigration and pay information is shown only to roles allowed to see it. Two-factor sign-in is available to every user, and required for account owners and anyone who can see identifiers, pay or conduct records. Failed sign-ins are limited for each account within your organisation, and for each network address. Passwords are stored only as salted Argon2id hashes, combined with a separate secret, and a new password found in a known data breach is refused.

Access for our staff. Our staff use a separate console with mandatory two-factor sign-in, abilities limited by role, and automatic sign-out after 30 minutes of inactivity. Support access to your account needs a support ticket from your organisation and a recorded reason, is read-only, masks every category of data above basic details, expires automatically after eight hours at most, and is recorded in your audit log and ours. An organisation is deleted only on a verified request from it, approved by two members of our staff, after a 7-day cooling-off period, and we send a certificate when deletion is complete.

Records of activity. Changes to your data are recorded in an audit log. Your account owners can read all of it; other users see the history of the records they are allowed to see.

Web security. A strict Content Security Policy, cross-site request forgery protection and security headers on every page.

Resilience and recovery. A nightly encrypted copy of the database, kept for 35 days. To be in place before launch: continuous database backups with point-in-time restore from our hosting provider, the nightly copy held in a separate account in the UK, and tested restores.

Testing and change. Every change to the service is checked by an automated test suite before it is released, including tests that no organisation can reach another's data and that the controls on this page hold.

Staff. Everyone with access is bound by confidentiality, has only the access their role needs, and loses it when they leave.

Incidents. To be adopted before launch: a written process for handling and reporting personal data breaches (6.9).

Annex 3: Sub-processors

Version 0.9, 16 October 2026. We give 30 days' notice of any change (section 6). Square brackets mark details the owner must confirm against each provider's own terms before publishing.

Services that do not receive your data as our sub-processors, listed so you have the whole picture: