Data Processing Addendum

Roles

For HR datasets you upload, your organization is the data controller and HRlytix is the data processor. HRlytix processes that data only on your documented instructions (i.e. to run the analytics features).

Security

Data in transit is encrypted with TLS. Data at rest is encrypted by our infrastructure provider. Access is restricted by row-level security so each organization sees only its own data.

Security-relevant actions are recorded in an audit log.

Subprocessors

Supabase (EU region) for database, auth and storage; Paddle for payment processing. We will give notice of new subprocessors.

International transfers

Primary processing is in the EU. Where a subprocessor transfers data outside the EEA, Standard Contractual Clauses apply.

Assistance and deletion

We assist with data-subject requests and, on termination, delete or return organization data within 30 days except where retention is legally required.