Data processing addendum

Roles

The customer is the controller of employee, candidate, and contractor data. HRFlow is the processor. We process that data only on documented instructions, which include the subscription agreement and the product settings an admin configures.

Instructions and confidentiality

People who can access customer data are bound by confidentiality. We will not use customer HR data for advertising or to train foundation models.

Security and subprocessors

We maintain the technical and organizational measures described on the Security page. Subprocessors are listed publicly. We will give customers notice before adding a subprocessor that handles personal data, and a reasonable chance to object.

International transfers

Customer data stays in India. If a transfer outside India is ever required, it happens only as the DPDP Act and the customer agreement allow.

Assistance, audits, and deletion

We help customers answer data-subject requests and regulatory questions that relate to our processing. Customers may review security evidence under a confidentiality agreement.

When the subscription ends, we delete or return customer personal data within the wind-down window, except where the law requires us to keep a copy.