{"id":25032,"date":"2025-03-27T03:44:21","date_gmt":"2025-03-27T03:44:21","guid":{"rendered":"https:\/\/employmenthero.com\/sg\/legals\/data-processing\/"},"modified":"2026-05-15T03:49:07","modified_gmt":"2026-05-15T03:49:07","slug":"data-processing","status":"publish","type":"legals","link":"https:\/\/employmenthero.com\/sg\/legals\/privacy-policy\/data-processing\/","title":{"rendered":"Data Processing Addendum"},"content":{"rendered":"\n
These are our data processing terms that apply between 91爆料 and the Customer<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n
Contents<\/p>\n\n\n\n
Overview<\/a><\/strong><\/p>\n\n\n\n Background<\/a><\/strong><\/p>\n\n\n\n 1.1 Clarifications for this DPA<\/a><\/strong><\/p>\n<\/details>\n\n\n\n 2.1 General data processing terms<\/a><\/strong><\/p>\n\n\n\n 2.2 Sub-Processors<\/a><\/strong><\/p>\n\n\n\n 2.3 International transfer mechanisms<\/a><\/strong><\/p>\n\n\n\n 2.4 Data Breach<\/a><\/strong><\/p>\n\n\n\n 2.5 Audits and inspections<\/a><\/strong><\/p>\n\n\n\n 2.6 Return or deletion of Personal Data<\/a><\/strong><\/p>\n\n\n\n 2.7 Limitation on liability<\/a><\/strong><\/p>\n\n\n\n 2.8 Other general terms<\/a><\/strong><\/p>\n<\/details>\n\n\n\n Nature and purpose of processing operations<\/a><\/strong><\/p>\n\n\n\n Categories of data subject<\/a><\/strong><\/p>\n\n\n\n Categories of data<\/a><\/strong><\/p>\n\n\n\n Categories of Personal Data<\/a><\/strong><\/p>\n\n\n\n Special Categories of Personal Data<\/a><\/strong><\/p>\n\n\n\n Duration of Processing<\/a><\/strong><\/p>\n<\/details>\n\n\n\n Nature and purpose of processing operations<\/a><\/strong><\/p>\n\n\n\n Categories of data subject<\/a><\/strong><\/p>\n\n\n\n Categories of data<\/a><\/strong><\/p>\n\n\n\n Categories of Personal Data<\/a><\/strong><\/p>\n\n\n\n Special Categories of Personal Data<\/a><\/strong><\/p>\n\n\n\n Duration of Processing<\/a><\/strong><\/p>\n<\/details>\n\n\n\n Schedule 2 \u2013 Technical and Organisational Measures<\/a><\/strong><\/p>\n\n\n\n Annex I\/ Appendix 1:<\/a><\/strong><\/p>\n\n\n\n A: List of parties<\/a><\/strong><\/p>\n\n\n\n B: Description of transfers<\/a><\/strong><\/p>\n\n\n\n C: Competent supervisory authority<\/a><\/strong><\/p>\n\n\n\n Annex II\/ Appendix 2: Technical and organisational measures<\/a><\/strong><\/p>\n\n\n\n Annex III of the EU Standard Contractual Clauses<\/a><\/p>\n<\/details>\n<\/div>\n<\/div>\n\n\n\n This Data Processing Addendum explains our data processing activities carried out as a Data Processor on behalf of our Customers.<\/p>\n\n\n\n Previous versions of this document can be found here<\/strong><\/a>.<\/strong><\/p>\n<\/div>\n\n\n\n This Data Processing Addendum (\u2018DPA<\/strong>\u2018) forms part of the agreement between 91爆料 (and its Affiliates including Employment Innovations entities) (\u2018us<\/strong>\u2018, \u2018we<\/strong>\u2018, or \u2018our<\/strong>\u2018) and our Customers (\u2018you\u2019 <\/strong>or \u2018your<\/strong>\u2018). It reflects our agreement with you regarding the processing of your Customer Personal Data and acts as an addendum to the 91爆料 Platform Terms and Conditions<\/a>, and\/or any other terms and conditions that you agree to when receiving Services from us (the \u2018Agreement<\/strong>\u2018).<\/p>\n\n\n\n When you enter into the Agreement, including this DPA, you do so to receive our Services, including the use of the 91爆料 Platform and\/or the 91爆料 Work app.<\/p>\n<\/div>\n\n\n\n In this DPA:<\/p>\n\n\n\n Affiliates<\/strong> means any corporation or other business entity controlling, controlled by or under common control with 91爆料 Pty Ltd. A current list of Affiliates is available here<\/a>;<\/p>\n\n\n\n Applicable Law <\/strong>means all laws, regulations, orders, rules, judgments, directives, industry agreements or determinations in force from time to time applicable to a party and relevant to the Agreement or this DPA, including, without limitation the GDPR, the UK GDPR, Privacy Act 1988 (Cth), Personal Information Protection and Electronic Documents Act (PIPEDA), and Privacy Act 2020;<\/p>\n\n\n\n Customer<\/strong> means you, the specific party which has entered into the Agreement with us;<\/p>\n\n\n\n Customer Personal Data<\/strong> means Personal Data in respect of which you are the Data Controller, and we are the Data Processor; but which excludes Personal Data processed by us when acting as a Data Controller;<\/p>\n\n\n\n Data Breach <\/strong>means any accidental or unlawful acquisition, destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data;<\/p>\n\n\n\n Data Controller<\/strong> means the entity which alone or jointly with others determines the purposes and means of processing of Personal Data, it will be interpreted in accordance with the GDPR and the UK GDPR;<\/p>\n\n\n\n Data Processor<\/strong> means an entity which processes Personal Data on behalf of a Data Controller, it will be interpreted in accordance with the GDPR and the UK GDPR;<\/p>\n\n\n\n Data Protection Law<\/strong> means the GDPR, the UK GDPR, Directive 2002\/58\/EC concerning the processing of Personal Data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), any national laws or regulations implementing the foregoing Directives, any other privacy and data protection laws that may be applicable to the parties (including data privacy laws that are specific to the region in which you or our relevant Affiliate entity is based like Australia, Canada, and New Zealand), and any amendments to or replacements of such laws and regulations;<\/p>\n\n\n\n Data Subject<\/strong> has the meaning given to it in the GDPR and the UK GDPR;<\/p>\n\n\n\n EEA<\/strong> means the European Economic Area;<\/p>\n\n\n\n GDPR<\/strong> means in each case to the extent applicable to the processing activities: (i) Regulation (EU) 2016\/679; and (ii) Regulation (EU) 2016\/679 as amended by any legislation arising out of the withdrawal of the UK from the European Union;<\/p>\n\n\n\n 91爆料<\/strong> means 91爆料 Pty Ltd, 91爆料 (UK) Ltd or the relevant 91爆料 Affiliate in your region (like New Zealand or Canada) which has entered into the Agreement with you for the provision of the Services;<\/p>\n\n\n\n Personal Data<\/strong> means any information relating to an identified or identifiable natural person and an identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;<\/p>\n\n\n\n Processing<\/strong> has the meaning given to it in Data Protection Law (the \u2018GDPR\u2019 and the \u2018UK GDPR\u2019) and \u2018process\u2019, \u2018processes\u2019 and \u2018processed\u2019 will be interpreted accordingly;<\/p>\n\n\n\n Relevant Country<\/strong> means all countries other than those (a) within the EEA and (b) countries in respect of which an adequacy finding under Article 25(6) of the European Data Protection Directive or Article 45 of the GDPR has been given;<\/p>\n\n\n\n Services<\/strong> means the provision of cloud-based and artificial intelligence powered human resources and payroll software services, EH Jobs app, Managed Payroll services, HeroForce EoR where we act on behalf of our Customer, Applicant Tracking System (ATS), financial services products, and\/or other products and services provided by us and\/or our Affiliates under the Agreement through our websites, platforms and apps where we act in the capacity of a Data Processor;<\/p>\n\n\n\n Standard Contractual Clauses mean:<\/strong><\/p>\n\n\n\n 91爆料 Work app<\/strong> means the mobile application and its services provided to you (Customers and Users).<\/p>\n\n\n\n Sub-Processor<\/strong> means any entity which is engaged by us or by any other sub-processor of ours who may access or process Customer Personal Data;<\/p>\n\n\n\n UK GDPR<\/strong> means the GDPR as applicable as part of UK domestic law by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (as amended);<\/p>\n\n\n\n User<\/strong> means individual users of the Services including employees of your organisation.<\/p>\n\n\n\n 1.1.1 any words following the terms \u201clike\u201d, \u201cinclude\u201d, \u201cfor example\u201d or any similar expression will be construed as illustrative and will not limit the sense of the words, description, definition, phrase or term preceding those terms;<\/p>\n\n\n\n 1.1.2 references to Clauses and Schedules are, unless otherwise stated, references to the clauses of, and schedules to, this DPA; and<\/p>\n\n\n\n 1.1.3 references to this DPA or any other agreement or document are to this DPA or such other agreement or document as it may be varied, amended, supplemented, restated, renewed, novated, or replaced from time to time.<\/p>\n<\/div>\n\n\n\n 2.1.1 Roles of the parties: <\/strong>You are the Data Controller and we are the Data Processor of the Customer Personal Data. We require certain Personal Data to set up and manage your account on our platforms and apps and to provide Services under the Agreement. We may also provide specific services and support relating to individuals where we determine the purposes for which, and means in which, the Personal Data is processed, and in these cases, we will process Personal Data as a Data Controller.<\/p>\n\n\n\n 2.1.2 Scope of this DPA: <\/strong>This DPA only applies to the processing of Customer Personal Data by us in connection with the Services under the Agreement. The categories of Data Subjects and types of Customer Personal Data processed are set out in Schedule 1 of this DPA. Customer Personal Data is processed for the purpose of providing the Services and other purposes as identified in Schedule 1 of this DPA. We may process Customer Personal Data for the duration of the Agreement (or longer to the extent permitted by Applicable Law).<\/p>\n\n\n\n 2.1.3 Legal compliance obligation: <\/strong>Each party agrees that in relation to this DPA, it is compliant with, and will remain compliant with all Applicable Law. You will make sure that you have provided notice to Data Subjects of the data processing activities carried out under this DPA. If you are based in UK and\/or EU, then you will make sure that there is a valid lawful basis under the UK GDPR and\/or GDPR for all Customer Personal Data that is disclosed in connection with the Agreement for the data processing activities envisaged by the Agreement.<\/p>\n\n\n\n 2.1.4 Our rights and responsibilities: <\/strong>Other than for anything to the contrary in the Agreement, in relation to Customer Personal Data, we will:<\/p>\n\n\n\n 2.1.5 Data storage<\/strong>: The Personal Data that we hold within our platform will be stored and managed on secure data centres by our third-party storage provider. The locations of our data centres are set out in the table below.<\/p>\n\n\n\n1. Definition<\/a><\/strong><\/summary>\n
2. Data processing terms<\/a><\/strong><\/summary>\n
Schedule 1 \u2013 Data Processing Information<\/a><\/strong><\/summary>\n
Schedule 1 \u2013 Data Processing Information<\/a><\/strong><\/summary>\n
Schedule 3 \u2013 Annexes to the EU SCCs and Appendices to the UK SCCs<\/a><\/strong><\/summary>\n
Overview<\/strong><\/h2>\n\n\n\n
\n
Background<\/strong><\/h2>\n\n\n\n
1. Definition<\/strong><\/h2>\n\n\n\n
\n
\n
\n
1.1 Clarifications for this DPA<\/strong><\/h3>\n\n\n\n
2.Data processing terms<\/strong><\/h2>\n\n\n\n
2.1 General data processing terms<\/strong><\/h3>\n\n\n\n
\n
\n