Data Processing Agreement (DPA) - Template

Last updated: 6 August 2026

This DPA template is for informational purposes only. It is not automatically applicable to customers using BuddiesHR. A signed version can be provided upon request.

This Data Processing Agreement ("DPA") forms part of the Terms of Service between The Jeffrey Company, doing business as BuddiesHR ("Processor", "we", "us"), and the customer using BuddiesHR services ("Controller", "you").

1. Purpose

This DPA governs the processing of personal data that we perform on your behalf while providing our SaaS products. Each party agrees to comply with its respective obligations under the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").

2. Roles of the Parties

• • You act as the data controller for the data you upload or generate in our apps.
• • We act as the data processor, processing such data only to provide and improve the service.

3. Scope of Processing

We process customer data solely to:

• • Provide, maintain, and secure the service.
• • Prevent or address service or technical issues.
• • Comply with applicable law.

We never sell, rent, or use customer data for marketing purposes.

4. Security

We maintain appropriate technical and organizational measures to protect data against loss, unauthorized access, or disclosure. These include (at minimum):

• • Hosting on secure, GDPR-compliant infrastructure: AWS in Paris (eu-west-3) for databases and file storage, and Hetzner in Germany for load balancers and application servers.
• • Encrypted data transmission (HTTPS/TLS).
• • Encryption of stored third-party access tokens - for messaging platforms, calendars and HR integrations - using AES-256 with an authentication tag.
• • Cryptographic verification of webhooks received from Slack and Microsoft Teams.
• • Least-privilege OAuth scopes, requesting only the platform permissions each app needs.
• • Sessions that expire after 30 days.
• • Access control limited to authorized personnel, with support access to a customer workspace logged.
• • Regular backups and monitoring.

5. Sub-processors

We use a limited number of trusted sub-processors to deliver our services (for example, hosting, email delivery, and analytics). Each sub-processor is bound by equivalent data protection obligations.
The current list of sub-processors, with their purpose, location and transfer safeguard, is published on our security page.

6. International Transfers

Customer Data is stored in the European Union. Where a Sub-processor processes Customer Data outside the European Economic Area, such transfer is governed by the European Commission's Standard Contractual Clauses (Decision 2021/914), which are incorporated into this Agreement by reference, together with any supplementary measures required by applicable law.

7. Data Subject Requests

If we receive a request directly from a data subject (for example, an employee) concerning their personal data, we will redirect the request to you unless otherwise required by law.

8. Data Breach Notification

In case of a confirmed data breach affecting personal data, we will notify you without undue delay and provide information to help you comply with your legal obligations.

9. Data Retention & Deletion

Upon termination of your account, customer data is deleted within a reasonable period (usually within 90 days), unless retention is required by law (for example, billing records). You may request earlier deletion through our support channel.

10. Limitation of Liability

Each party's liability under this DPA is subject to the limitation of liability set out in the main Terms of Service.

11. Governing Law

This DPA is governed by the same law and jurisdiction as the main Terms of Service.

Annex 1 - Details of processing

Subject matter and duration. Provision of the BuddiesHR apps for the term of the subscription, plus the retention period set out in Section 9.

Nature and purpose. Hosting, storing, organising and transmitting employee data so the Customer can run internal connections (Alfy), celebrations (Billy), recognition (Clappy), a directory (Linky), leave management (Palmy), surveys (Pulsy), check-ins (Stany) and performance reviews (SimplePerf), in Slack, Microsoft Teams, Pumble or the dashboard at dashboard.buddieshr.com.

Categories of data subjects. The Customer's employees, contractors and other workspace members; the Customer's administrators.

Categories of personal data.

• • Identity and contact data: name, work email, profile picture, job title, timezone, platform user id.
• • Organisational data: department, manager, start and end dates, org chart position.
• • Dates of birth and work anniversaries.
• • Leave records: dates, type, notes, approvals, balances.
• • Performance review content.
• • Survey, poll and check-in responses, including free text.
• • Recognition messages and points.
• • Calendar availability, where a user connects a calendar.
• • Message identifiers for messages the apps post.

Special categories. None intended. The Customer undertakes not to submit special category data; where it does so, it does so as controller and on its own responsibility.

Annex 2 - Technical and organisational measures

The measures below implement Article 32 GDPR and correspond to those listed in Section 4.

Pseudonymisation and encryption of personal data.

• • Encryption in transit for all traffic (HTTPS/TLS), with HSTS.
• • Encryption at rest for databases and file storage.
• • AES-256 with an authentication tag for stored third-party access tokens (messaging platforms, calendars, HR integrations).

Ongoing confidentiality, integrity, availability and resilience of processing systems.

• • Access limited to the personnel who need it to do their job; support access to a customer workspace is logged and used only to resolve a reported issue.
• • Least-privilege OAuth scopes, requesting only the platform permissions each app needs.
• • Single-use login links and sessions that expire after 30 days.
• • Cryptographic verification of webhooks received from Slack and Microsoft Teams.
• • Rate limiting and protections against server-side request forgery.
• • Hosting on AWS (Paris, eu-west-3) and Hetzner (Germany), both in the EU.

Ability to restore availability and access to personal data after an incident.

• • Regular automated backups of databases and file storage.
• • Documented incident response and business continuity procedures.

Regular testing and evaluation of the effectiveness of these measures.

• • Application error and availability monitoring.
• • Dependency and vulnerability patching.
• • Secure development practices following OWASP guidance.
• • Periodic review of access rights and sub-processors.