GDPR Compliance

Data Processing & International Transfers

HR Partner acts as a data processor for our customers. Our customers remain the data controllers and retain control over the personal data stored and managed within HR Partner.

HR Partner does not own customer data. Customers retain ownership and control of the personal data they store within the platform at all times.

We support our customers’ GDPR obligations through secure infrastructure, documented data protection commitments, subprocessors oversight, and recognized safeguards for international data transfers.

Customers can also request or review our Data Processing Addendum (DPA), which incorporates:

• The European Commission Standard Contractual Clauses (2021)
• The UK International Data Transfer Addendum for transfers subject to UK GDPR

These safeguards help support lawful international transfers of personal data in connection with the provision of HR Partner’s services.

For more detailed information about our processor obligations and international transfer safeguards, please refer to our Data Processing Addendum.

Security & Data Protection

Protecting customer data is a core part of how HR Partner is designed and operated.

HR Partner uses industry-standard security measures to help protect customer data, including:

• Encryption of data in transit and at rest
• Secure cloud infrastructure hosted on AWS
• Role-based access controls
• Regular backups and infrastructure monitoring
• Ongoing patching and vulnerability management

Access to customer data within HR Partner is restricted to authorized personnel who require access to perform their duties and who are subject to confidentiality obligations.

We also work with trusted third-party service providers and subprocessors that are subject to appropriate contractual and security obligations.

In the event of a confirmed security incident affecting customer data, HR Partner will notify affected customers without undue delay and work promptly to investigate and remediate the issue.

Learn more on our Security page.

Data Subject Rights & Customer Responsibilities

Under GDPR, our customers act as the data controllers for the personal data they store in HR Partner. This means customers are responsible for determining the lawful basis for processing employee and applicant data and for responding to requests from data subjects where required.

HR Partner does not determine the lawful basis for processing customer data. This remains the responsibility of the customer as the data controller.

HR Partner supports these obligations by providing tools and assistance to help customers:

• Export personal data
• Delete records where appropriate
• Manage user access and permissions
• Respond to data-related requests

Customers may request export or deletion of their data in accordance with our Terms of Use and applicable legal obligations.

Subprocessors

Like most modern SaaS platforms, HR Partner uses a small number of carefully selected subprocessors and cloud providers to help deliver our services, including infrastructure hosting, customer support tooling, communications services, and optional AI-assisted functionality.

We conduct due diligence before engaging subprocessors and require appropriate contractual protections to safeguard customer data.

A current list of subprocessors used by HR Partner is available on our Subprocessors page.

AI-Assisted Functionality

HR Partner offers optional AI-assisted features in some areas of the platform, such as resume screening and content generation, where enabled by the customer.

Where customers enable AI-assisted recruiting or applicant evaluation features, limited applicant-provided information may be processed through approved AI providers.

HR Partner’s AI-assisted functionality does not send employee records or core HR personnel data to external AI providers.

Certain AI-assisted workflow functionality may process natural language requests only, while customer HR data remains within HR Partner’s systems.

Customers remain responsible for reviewing and approving AI-assisted outputs.

HR Partner does not use customer data submitted through the platform to train public AI models.

Data Hosting

HR Partner is hosted using Amazon Web Services (AWS). Customer data may be processed or transferred internationally where necessary to provide the Services, subject to the safeguards described in our Data Processing Addendum.

HR Partner’s privacy and security practices are designed to support customers operating across multiple jurisdictions, including the UK, EU, United States, Canada, Australia, New Zealand, and other countries.

Questions?

If you have questions about GDPR, international data transfers, or our data protection practices, please contact us at support@hrpartner.io.

Document Information

This page is provided for informational purposes and reflects HR Partner’s approach to GDPR, data protection, and international data transfers.

We may update this page from time to time, and the current version will always be available here.