Data Processing
Agreement

Parties and scope

This Data Processing Agreement concerns Customer Personal Data controlled by a Customer or Customer Affiliate and processed by Grouper Technology Limited in connection with the Services. The Customer acts as controller and appoints Grouper as processor to process that data as necessary to provide the Services and in accordance with the Customer's written instructions.

The parties must each comply with the data protection legislation applicable to their processing. In the supplied template, “Customer Personal Data” means personal data controlled by the Customer or its Affiliate that Grouper processes in connection with the Services. Terms such as personal data, processing, controller, processor and data subject have the meanings given by applicable data protection law.

BambooHR LLC is the technology provider. Its processing of Customer Personal Data for the platform is addressed in the BambooHR data processing agreement referenced below; Grouper's obligations on this page concern its own processing and its engagement of other processors.

Instructions and permitted processing

Grouper processes Customer Personal Data only on the Customer's documented instructions, including instructions concerning transfers, unless EU or Member State law requires otherwise. Where legally permitted, Grouper informs the Customer before processing on that alternative legal basis.

Grouper must not process Customer Personal Data in a way that causes or is likely to cause the Customer or a Customer Affiliate to breach applicable data protection obligations. The categories of data and processing activities are outlined in the Processing details section below.

Security and confidentiality

Grouper must implement appropriate technical and organisational measures to protect Customer Personal Data against unauthorised or unlawful processing and accidental loss, destruction, disclosure, damage or alteration.

Access is limited to Grouper personnel who need the data to perform the agreement. Those personnel must be bound by appropriate confidentiality obligations, and Grouper must take reasonable steps to ensure their reliability.

Cooperation and data subject rights

Grouper cooperates with and assists the Customer and its Affiliates, at no additional cost, in meeting controller obligations. This includes data security, breach notification, data protection impact assessments, prior consultation with supervisory authorities, fulfilment of data subject rights and responses to supervisory authority enquiries, notices or investigations.

Subprocessors and BambooHR

Grouper may not appoint another party to process Customer Personal Data without the Customer's prior written consent. Grouper must provide reasonable advance notice of the proposed subprocessor's identity, location and intended processing so the Customer can evaluate the risks.

Grouper must impose legally binding data-processing terms equivalent to those in the agreement and remains liable to the Customer for a subprocessor's breach. BambooHR LLC provides the technology platform and is addressed separately in its own data processing agreement.

Security breaches

Grouper must notify the Customer as quickly as the circumstances permit and, in any event, within 48 hours of becoming aware of an actual or suspected accidental, unauthorised or unlawful destruction, loss, alteration, disclosure of or access to Customer Personal Data.

As information becomes available, Grouper must provide a detailed description of the breach, the type of data involved, the identities of affected people to the extent known, and other information and cooperation reasonably requested by the Customer.

Grouper must immediately investigate and take steps to identify, prevent and mitigate the effects of the breach, and, with the Customer's prior agreement, carry out necessary recovery or remediation. It may not issue a public communication about a breach without the Customer's prior approval.

International transfers

Customer Personal Data is processed within the EEA or another territory where applicable law does not restrict the transfer, except in limited scenarios involving the technology provider's Ireland data centre: an emergency, a support request requiring access from a US team with the Customer's written confirmation, or the Customer's verified request to move hosting.

A transfer outside the EEA is subject to a lawful transfer mechanism, a transfer impact assessment and any necessary supplementary measures. The EU Standard Contractual Clauses (SCCs) may apply to relevant transfers. If a transfer ceases to be lawful, Grouper will, with the Customer's consent, implement an alternative lawful mechanism or allow termination at no additional cost.

Processing details

Subject matter: HR information stored in the BambooHR platform and Grouper's related implementation, maintenance and support services. The supplied transfer description specifies a 24-month duration and describes processing throughout the period in which Grouper provides the relevant services.

Data subjects include employees and other staff (past, present and prospective), contractors, volunteers and temporary workers, candidates and employment referees. Processing may be ongoing as instructed by the Customer.

• Identity and contact information, photographs, birth dates, family and emergency contacts, CVs, qualifications and employment history.
• Work information, reporting lines, contracts, hours, evaluations, disciplinary history, training, benefits and time-off records.
• Payroll and compensation information, tax and social-security details, bank details, pensions and bonuses.
• Where applicable, special-category information such as health or disability data, subject to additional appropriate restrictions and safeguards.

Return, deletion and audit

At the Customer's request and option, during or after termination, Grouper must promptly return or destroy Customer Personal Data in its possession or control as the Customer specifies.

Grouper must make available information necessary to demonstrate compliance and allow for and contribute to audits, including inspections, by the Customer or its representatives subject to appropriate confidentiality obligations. This includes relevant information from the technology provider.

Related documents

The EU Standard Contractual Clauses and BambooHR's separate data processing agreement are linked below for reference. Grouper's processing terms on this page do not include the separate partner/API terms supplied with the source material.