{"id":41958,"date":"2025-03-27T03:44:21","date_gmt":"2025-03-27T03:44:21","guid":{"rendered":"https:\/\/employmenthero.com\/nz\/legals\/data-processing\/"},"modified":"2026-07-23T05:30:15","modified_gmt":"2026-07-23T05:30:15","slug":"data-processing","status":"publish","type":"legals","link":"https:\/\/employmenthero.com\/nz\/legals\/privacy-policy\/data-processing\/","title":{"rendered":"Data Processing Addendum"},"content":{"rendered":"\n
\n
\n
\n
\n
\n

Data Processing Addendum<\/h1>\n\n\n\n

These are our data processing terms that apply between 91爆料 and the Customer<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n

\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n\n\n\n
\n
\n

Overview<\/h2>\n\n\n\n

This Data Processing Addendum is effective <\/strong>as of 15 June 2026<\/strong> and explains our data processing activities carried out as a Data Processor on behalf of our Customers.<\/p>\n\n\n\n

Previous versions of this document can be found here<\/strong><\/a>.<\/strong><\/p>\n\n\n\n

Background<\/h2>\n\n\n\n

This Data Processing Addendum (\u2018DPA<\/strong>\u2018) forms part of the agreement between 91爆料 (and its Affiliates including Employment Innovations entities) (\u2018us<\/strong>\u2018, \u2018we<\/strong>\u2018, or \u2018our<\/strong>\u2018) and our Customers (\u2018you\u2019 <\/strong>or \u2018your<\/strong>\u2018). It reflects our agreement with you regarding the processing of your Customer Personal Data and acts as an addendum to the 91爆料 Platform Terms and Conditions<\/a>, and\/or any other terms and conditions that you agree to when receiving Services from us (the \u2018Agreement<\/strong>\u2018).<\/p>\n\n\n\n

When you enter into the Agreement, including this DPA, you do so to receive our Services, including the use of the 91爆料 Platform and\/or the 91爆料 Work app.<\/p>\n\n\n\n

1. Definition<\/h2>\n\n\n\n

In this DPA:<\/p>\n\n\n\n

Affiliates<\/strong> means any corporation or other business entity controlling, controlled by or under common control with 91爆料 Pty Ltd. A current list of Affiliates is available here<\/a>;<\/p>\n\n\n\n

Applicable Law <\/strong>means all laws, regulations, orders, rules, judgments, directives, industry agreements or determinations in force from time to time applicable to a party and relevant to the Agreement or this DPA, including, without limitation the GDPR, the UK GDPR, Privacy Act 1988 (Cth), Personal Information Protection and Electronic Documents Act (PIPEDA), and Privacy Act 2020;<\/p>\n\n\n\n

Customer<\/strong> means you, the specific party which has entered into the Agreement with us;<\/p>\n\n\n\n

Customer Personal Data<\/strong> means Personal Data in respect of which you are the Data Controller, and we are the Data Processor; but which excludes Personal Data processed by us when acting as a Data Controller;<\/p>\n\n\n\n

Data Breach <\/strong>means any accidental or unlawful acquisition, destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data;<\/p>\n\n\n\n

Data Controller<\/strong> means the entity which alone or jointly with others determines the purposes and means of processing of Personal Data, it will be interpreted in accordance with the GDPR and the UK GDPR;<\/p>\n\n\n\n

Data Processor<\/strong> means an entity which processes Personal Data on behalf of a Data Controller, it will be interpreted in accordance with the GDPR and the UK GDPR;<\/p>\n\n\n\n

Data Protection Law<\/strong> means the GDPR, the UK GDPR, Directive 2002\/58\/EC concerning the processing of Personal Data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), any national laws or regulations implementing the foregoing Directives, any other privacy and data protection laws that may be applicable to the parties (including data privacy laws that are specific to the region in which you or our relevant Affiliate entity is based like Australia, Canada, and New Zealand), and any amendments to or replacements of such laws and regulations;<\/p>\n\n\n\n

Data Subject<\/strong> has the meaning given to it in the GDPR and the UK GDPR;<\/p>\n\n\n\n

EEA<\/strong> means the European Economic Area;<\/p>\n\n\n\n

GDPR<\/strong> means in each case to the extent applicable to the processing activities: (i) Regulation (EU) 2016\/679; and (ii) Regulation (EU) 2016\/679 as amended by any legislation arising out of the withdrawal of the UK from the European Union;<\/p>\n\n\n\n

91爆料<\/strong> means 91爆料 Pty Ltd, 91爆料 (UK) Ltd or the relevant 91爆料 Affiliate in your region (like New Zealand or Canada) which has entered into the Agreement with you for the provision of the Services;<\/p>\n\n\n\n

Personal Data<\/strong> means any information relating to an identified or identifiable natural person and an identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;<\/p>\n\n\n\n

Processing<\/strong> has the meaning given to it in Data Protection Law (the \u2018GDPR\u2019 and the \u2018UK GDPR\u2019) and \u2018process\u2019, \u2018processes\u2019 and \u2018processed\u2019 will be interpreted accordingly;<\/p>\n\n\n\n

Relevant Country<\/strong> means all countries other than those (a) within the EEA and (b) countries in respect of which an adequacy finding under Article 25(6) of the European Data Protection Directive or Article 45 of the GDPR has been given;<\/p>\n\n\n\n

Services<\/strong> means the provision of cloud-based and artificial intelligence powered human resources and payroll software services, workforce management (including time and attendance, employee tracking, and workforce insights and analytics), Managed Payroll services, AI Recruitment Agent, Applicant Tracking System (ATS), Implementation services, and\/or other products and services provided by us and\/or our Affiliates under the Agreement through our websites, platforms and apps where we act in the capacity of a Data Processor;<\/p>\n\n\n\n

Standard Contractual Clauses mean:<\/strong><\/p>\n\n\n\n

    \n
  1. in respect of EU Personal Data, the EU Standard Contractual Clauses<\/a> for the transfer of Personal Data to third countries pursuant to the GDPR, adopted by the European Commission under Commission Implementing Decision (EU) 2021\/914 and made available on the European Commission website (or any replacement publication made on the website), including the text from modules two and three of such clauses and not including any clauses marked as optional (\u2018EU Standard Contractual Clauses\u2019<\/strong>);<\/li>\n\n\n\n
  2. in respect of UK Personal Data:\n