Loading
Last updated · Nextkin Life LLC
In plain language: when your organization uses OneclickHR, you decide what employee data goes in and why; we process it only to run the service for you, on your instructions. This document records that split, the security measures we apply, the providers we use, how we handle a data subject request or a breach, and what happens to your data at the end.
This addendum forms part of the agreement between Nextkin Life LLC ("Processor") and the customer organization ("Controller") for use of OneclickHR, and applies to personal data the Processor processes on the Controller’s behalf.
The Controller determines the purposes and means of processing employee and candidate personal data in its workspace. The Processor processes that data only to provide the service and only on documented instructions from the Controller, which include the agreement, this addendum and the Controller’s use of the product’s features.
Where the Processor acts as a controller in its own right — for example in relation to its own business contacts and website visitors — the privacy policy applies rather than this addendum.
The subject matter of processing is the provision of HR and organization management software. Processing continues for the duration of the agreement and for the limited period afterwards described in section 10.
The Processor hosts, stores, transmits, displays, backs up and deletes personal data as necessary to operate the modules the Controller uses. In practice this includes:
Data subjects: the Controller’s administrators and team members, its employees, recruiters it grants access to, and candidates who apply through its job board.
Categories of personal data, to the extent the Controller chooses to store them: identity and contact details; employment details including department, role, start date and status; attendance, leave and timesheet records; salary, currency, pay schedule and payslip data; work authorization records and expiry dates; uploaded documents and HR letters; task and project assignments; calendar entries and meeting invitations; support ticket content; notification preferences; authentication identifiers; and application materials submitted by candidates.
The Controller determines whether any of this constitutes a special category of data under applicable law and is responsible for having an appropriate basis for processing it.
The Processor will:
The Processor applies the following measures. They are described specifically rather than generically, because a list of adjectives is not an assurance.
The Processor holds no security certifications or attestations at this time and makes no representation of SOC 2, ISO 27001, HIPAA or GDPR certification. The measures above are what it does, and they are verifiable.
The Controller authorizes the Processor to engage the subprocessors listed on the subprocessors page, each of which processes a defined category of data under a written contract imposing data protection obligations no less protective than this addendum.
The Processor will give the Controller reasonable notice before adding or replacing a subprocessor. If the Controller has a reasonable objection on data protection grounds, the parties will discuss it in good faith; if it cannot be resolved, the Controller may terminate the affected part of the service.
The Processor remains responsible for its subprocessors’ performance of these obligations.
The Controller is responsible for responding to requests from its employees and candidates. Much of what a request asks for can be served directly by the Controller through the product: employee records, attendance and leave history, payslips, documents and profile data are all accessible and editable in the workspace, and the employee self-service portal already exposes each employee’s own data to them.
Where a request cannot be satisfied through the product, the Processor will provide reasonable assistance. If the Processor receives a request directly from a data subject relating to a Controller workspace, it will not respond substantively and will refer the request to the Controller.
The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller’s personal data, and in any event within 72 hours of becoming aware. The notification will describe what is known: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point for further information.
Where full information is not available at the time, the Processor will provide it in phases rather than delaying the initial notification. The Processor will cooperate with the Controller in investigating and remediating the breach. Notification is not an admission of fault.
On termination of the agreement, the Processor will on request make the Controller’s personal data available for export within a reasonable period, and will then delete it from active systems. Backups age out on their ordinary cycle. The Processor may retain personal data where required by law, in which case it will continue to protect it under this addendum and process it only for that purpose.
Where processing involves a transfer of personal data from a jurisdiction that restricts such transfers, the parties rely on the transfer mechanisms available through the Processor’s subprocessors, including standard contractual clauses. Data residency region is chosen per deployment; the Controller should raise any residency requirement before the service begins.
On reasonable written request, and no more than once in a twelve-month period unless required by a supervisory authority, the Processor will provide information reasonably necessary to demonstrate compliance with this addendum. The parties will agree the scope, timing and confidentiality terms in advance, and will conduct any audit in a way that does not compromise other customers’ data or the security of the service.
In the event of a conflict between this addendum and the terms of service on the subject of processing personal data on the Controller’s behalf, this addendum prevails. Questions: privacy@oneclickhr.app.