Data Processing Agreement

"Controller" means the entity that determines the purposes and means of the processing of Personal Data.

"Processor" means the entity that processes Personal Data on behalf of the Controller.

"Personal Data" means any information relating to an identified or identifiable natural person.

"Processing" means any operation performed on Personal Data, whether or not by automated means.

"Data Subject" means the identified or identifiable natural person to whom the Personal Data relates.

"Sub-processor" means any third party appointed by the Processor to process Personal Data on behalf of the Controller.

HubNest HRM processes Personal Data solely for the purpose of providing the HR management services as described in the main service agreement.

The categories of data processed include: employee names, contact information, employment records, attendance data, payroll information, and performance metrics.

Processing activities include collection, storage, organization, retrieval, consultation, use, disclosure by transmission, and erasure of Personal Data.

The duration of processing shall be for the term of the service agreement unless otherwise required by applicable law.

We assist the Controller in fulfilling its obligations to respond to Data Subject requests, including the right of access, rectification, erasure, restriction, portability, and objection.

Upon receiving a request from a Data Subject, HubNest will promptly notify the Controller and provide reasonable assistance in responding to such requests.

HubNest provides built-in tools for Controllers to manage Data Subject access requests efficiently through the platform's admin dashboard.

All Data Subject requests are logged and tracked to ensure timely compliance within the legally mandated timeframes.

Encryption of Personal Data in transit (TLS 1.3) and at rest (AES-256) across all systems and databases.

Strict access controls with role-based permissions, multi-factor authentication, and principle of least privilege enforcement.

Regular security audits, penetration testing, and vulnerability assessments conducted by independent third-party firms.

Comprehensive incident response plan with documented procedures for detection, containment, eradication, and recovery.

Employee security awareness training programs conducted quarterly for all personnel with access to Personal Data.

HubNest maintains a list of approved sub-processors, which is available upon request and updated regularly.

Prior written consent from the Controller is required before engaging any new sub-processor for the processing of Personal Data.

All sub-processors are bound by data protection obligations no less protective than those set forth in this Agreement.

HubNest remains fully liable for the acts and omissions of its sub-processors in relation to the processing of Personal Data.

Personal Data may be transferred to countries outside the European Economic Area (EEA) only when adequate safeguards are in place.

Transfers are conducted under Standard Contractual Clauses (SCCs) approved by the European Commission, or other approved transfer mechanisms.

HubNest ensures that any country receiving Personal Data provides an adequate level of data protection as determined by applicable regulations.

Data residency options are available for Controllers who require Personal Data to remain within specific geographic regions.

In the event of a Personal Data breach, HubNest will notify the Controller without undue delay and no later than 72 hours after becoming aware of the breach.

Notification will include: the nature of the breach, categories and approximate number of Data Subjects affected, likely consequences, and measures taken to address the breach.

HubNest will cooperate fully with the Controller and supervisory authorities in investigating and remediating any breach.

A detailed post-incident report will be provided within 30 days of breach resolution, including root cause analysis and preventive measures.

Upon termination of the service agreement, HubNest will, at the Controller's choice, return or securely delete all Personal Data within 90 days.

A certification of deletion will be provided upon request, confirming that all Personal Data has been permanently and irreversibly destroyed.

Obligations regarding confidentiality and data protection shall survive the termination of this Agreement.

HubNest may retain Personal Data where required by applicable law, provided that such retention is limited to the minimum extent necessary.