Data Processing Addendum
Learn how HR Partner protects and processes customer data
This Data Processing Addendum (“Addendum”) forms part of the agreement between HR Partner Software Pty Ltd (“HR Partner”, “Vendor”) and the customer (“Company”) and applies where HR Partner processes Personal Data on behalf of Company in connection with the provision of the Services.
This Addendum is incorporated into and forms part of the applicable agreement governing the Services (the “Principal Agreement”).
1. Definitions
In this Addendum:
“Applicable Laws” means all applicable data protection and privacy laws, including EU Data Protection Laws and any other applicable data protection laws.
“Company Personal Data” means any Personal Data processed by a Contracted Processor on behalf of Company in connection with the Services.
“Contracted Processor” means HR Partner or any Subprocessor.
“Data Protection Laws” means EU Data Protection Laws and, where applicable, the data protection or privacy laws of any other country.
“EU Data Protection Laws” means the GDPR and laws implementing or supplementing the GDPR.
“Restricted Transfer” means a transfer of Company Personal Data to a country where such transfer would be prohibited without appropriate safeguards.
“Standard Contractual Clauses” means the European Commission’s Standard Contractual Clauses for the transfer of personal data to processors established in third countries, including Commission Implementing Decision (EU) 2021/914, as amended or replaced from time to time.
“Subprocessor” means any third party engaged by HR Partner to process Personal Data on behalf of Company.
Terms such as “Personal Data”, “Processing”, “Controller”, “Processor”, “Data Subject”, and “Personal Data Breach” have the meanings given in applicable Data Protection Laws.
2. Scope and Roles
Company acts as the Controller and HR Partner acts as the Processor.
HR Partner processes Company Personal Data solely for the purpose of providing the Services and in accordance with Company’s documented instructions.
3. Processing of Personal Data
HR Partner shall:
- Process Company Personal Data only on documented instructions from Company unless required by Applicable Laws
- Comply with all applicable Data Protection Laws
- Inform Company if it becomes aware that an instruction infringes Applicable Laws
Company instructs HR Partner to process Company Personal Data as necessary to provide the Services, including transfers where required.
4. Personnel
HR Partner shall ensure that personnel with access to Company Personal Data:
- Are subject to appropriate confidentiality obligations
- Have access only where necessary to perform their duties
5. Security
Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, HR Partner shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including measures aligned with Article 32 of the GDPR.
HR Partner shall take into account the risks presented by Processing, including risks arising from Personal Data Breaches.
6. Subprocessing
Company authorises HR Partner to engage Subprocessors - see the current list of Subprocessors.
HR Partner shall:
- Conduct appropriate due diligence before appointing Subprocessors
- Ensure Subprocessors are bound by written agreements with obligations no less protective than those set out in this Addendum
- Remain responsible for the acts and omissions of Subprocessors
HR Partner will provide notice of material changes to Subprocessors, and Company may object on reasonable grounds. Where such objection cannot be resolved, Company may terminate the affected Services.
7. Data Subject Rights
HR Partner shall:
- Assist Company, taking into account the nature of Processing, in responding to Data Subject requests
- Notify Company of any request received directly
- Not respond to such requests except on Company’s instructions or as required by law
8. Personal Data Breach
HR Partner shall:
- Notify Company without undue delay upon becoming aware of a Personal Data Breach affecting Company Personal Data
- Provide sufficient information to enable Company to meet its obligations under Data Protection Laws
- Cooperate with Company in investigating, mitigating, and remediating the breach
9. Data Protection Impact Assessments
HR Partner shall provide reasonable assistance to Company with data protection impact assessments and consultations with supervisory authorities where required.
10. Deletion or Return of Data
Upon termination of the Services, HR Partner shall:
- Delete or return Company Personal Data within a reasonable period, unless retention is required by Applicable Laws
- Ensure that retained data remains protected and confidential
- Confirm deletion upon request
11. Audit and Compliance
HR Partner shall make available to Company information reasonably necessary to demonstrate compliance with this Addendum and applicable Data Protection Laws.
12. International Data Transfers
12.1 EU Transfers
Restricted Transfers from the European Economic Area are governed by the Standard Contractual Clauses, which are incorporated by reference.
12.2 UK Transfers
Restricted Transfers from the United Kingdom are governed by:
- The Standard Contractual Clauses
- The UK International Data Transfer Addendum
13. General Terms
In the event of any conflict between this Addendum and the Principal Agreement, this Addendum shall prevail in relation to data protection matters.
The parties shall cooperate in good faith to address changes required to ensure compliance with Applicable Laws.
If any provision of this Addendum is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.
Annex I – Processing Details
Nature and Purpose
Processing of Personal Data for the provision of HR Partner services, including storage, management, analytics, and optional AI-assisted features such as resume screening and content generation, where enabled by the customer.
Categories of Data Subjects
Employees, contractors, and related individuals.
Types of Personal Data
Contact details, employment information, and related HR data.
Annex II – Standard Contractual Clauses
The Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (Controller to Processor), are incorporated into and form part of this Addendum and apply to Restricted Transfers.
Annex III – UK International Data Transfer Addendum
This Addendum incorporates the UK International Data Transfer Addendum issued by the UK Information Commissioner’s Office.
The parties agree that:
- The Standard Contractual Clauses apply as amended by the UK Addendum
- Company acts as data exporter and HR Partner acts as data importer
- This Annex applies to Personal Data subject to UK GDPR
In the event of any conflict between the Standard Contractual Clauses and the UK Addendum, the UK Addendum shall prevail to the extent required by UK Data Protection Laws.
Version and Effective Date
This Data Processing Addendum is effective as of the date below and forms part of the Terms of Service. We may update this Addendum from time to time, and the current version will always be available on this page.
A countersigned version of this Data Processing Addendum, including additional contractual detail for procurement and compliance purposes, is available to customers on request.
Related Documentation
Questions?
If you have questions about this Data Processing Addendum or require a formal executed version for procurement or compliance purposes, please contact us at support@hrpartner.io.
Document Information
This Data Processing Addendum forms part of HR Partner’s Terms of Use.
We may update this Addendum from time to time, and the current version will always be available on this page.
Last Updated: August 2026