Data Processing Addendum

A draft framework for customer data processing terms. Processing details and the final agreement must be completed for each customer before it is signed.

1. Parties and roles

This draft is intended to accompany a written PeopleArc customer agreement between the customer and Tripistapa Services India (OPC) Private Limited (“PeopleArc”). The customer determines the purposes and means of processing its workforce information. PeopleArc processes that information only to provide the agreed services and in accordance with documented customer instructions. The parties’ roles may differ for particular processing activities and must be recorded in the customer agreement.

2. Processing details

The applicable order form or processing schedule must identify the subject matter and duration of processing, its nature and purpose, the categories of personal data and individuals, and the customer’s rights and obligations. For an HCM and payroll service, data may relate to employees, applicants, managers and other workforce contacts, and may include identity, contact, employment, compensation, payroll, time, leave and document information, as selected by the customer.

3. Documented instructions and confidentiality

PeopleArc will process customer personal data only on documented instructions, including instructions about international transfers, unless applicable law requires otherwise. PeopleArc will ensure that people authorized to process the data are bound by confidentiality obligations.

4. Security measures

PeopleArc will maintain appropriate technical and organizational measures for the agreed service and processing risks. The specific measures, access controls, hosting arrangements, retention settings and security responsibilities must be described in the customer’s completed security schedule. This draft does not claim a certification or a particular independent security assessment.

5. Subprocessors

PeopleArc will use subprocessors only under the customer authorization and change-notice process set out in the signed agreement. The agreement must include the current subprocessor list and the processing performed by each provider. PeopleArc will bind subprocessors to data protection obligations appropriate to their services and remain responsible for the obligations assigned to it under the customer agreement.

6. Individual rights and compliance assistance

Taking account of the service and information available to it, PeopleArc will provide reasonable assistance for customer requests concerning individuals’ rights, security obligations, impact assessments and regulator consultations. The customer remains responsible for deciding how to respond to requests and notices it receives.

7. Security incidents

PeopleArc will notify the customer of a personal data breach affecting customer data without undue delay after becoming aware of it, and will share information reasonably available to support the customer’s response. The signed agreement must specify the notification channel, operational contacts and any applicable notification timing.

8. International transfers

PeopleArc will make international transfers of customer personal data only on documented instructions and using transfer safeguards required by the applicable data protection law. The customer agreement must identify relevant processing locations and any required transfer mechanism.

9. Return, deletion and audits

At the end of the services, PeopleArc will return or delete customer personal data at the customer’s choice, subject to retention required by law and the agreed deletion schedule. PeopleArc will provide information reasonably needed to demonstrate its agreed processing obligations and support proportionate audits under the signed contract.

10. Contract terms and contact

This draft does not set liability limits, governing law, dispute resolution or service-specific security commitments. Those terms must be agreed in the customer contract. Contact PeopleArc at care@peoplearcsystems.com to discuss a customer-specific data processing addendum.

This draft follows the general controller-processor contract topics described in official UK ICO guidance. It requires legal review for each applicable jurisdiction and customer configuration.