← Back to home

Data Processing Agreement (DPA)

Version 1.1 · Last updated: 19 June 2026 · UK GDPR Article 28 compliant

1. Parties

2. Definitions

Words have the meaning given by UK GDPR (the General Data Protection Regulation as retained in UK law) and the Data Protection Act 2018:

• UK GDPR — Regulation (EU) 2016/679 as it has effect in UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018.
• Personal Data — any data relating to an identified or identifiable natural person processed under this DPA.
• Sub-processor — any entity engaged by us to process personal data on behalf of the Controller.
• Data Subject — the individual to whom the personal data relates (typically the Controller's staff).

3. Subject matter, duration, nature and purpose

Subject matter: personal data of the Controller's staff and applicants, processed via the WorkHive workforce-management software.

Duration: for the term of the WorkHive service contract, plus a data export period after termination.

Nature: hosting, storing, retrieving, transmitting, displaying, encrypting, backing up, audit-logging and (for orgs that enable HR Helper) AI-summarising the personal data.

Purpose: delivering the WorkHive workforce-management service as set out in the Terms of Service.

4. Categories of data subjects and personal data

5. Obligations of the Processor (us)

We:

1. process Personal Data only on documented instructions from the Controller, including transfers, unless required by UK law (in which case we will inform the Controller before processing, unless prohibited by law on important grounds of public interest);
2. ensure all our personnel authorised to process Personal Data are bound by confidentiality obligations;
3. implement appropriate technical and organisational measures (see Schedule A);
4. only engage Sub-processors with the Controller's general written authorisation, and update the public Sub-processor list with reasonable prior notice of new ones;
5. assist the Controller in responding to Data Subject requests (access, rectification, erasure, restriction, portability, objection) within reasonable timeframes;
6. assist the Controller in complying with their obligations under UK GDPR Articles 32–36 (security, breach, DPIA, prior consultation);
7. at the Controller's choice, delete or return all Personal Data after the end of the service contract, and delete existing copies unless UK law requires storage (e.g. PAYE retention);
8. make available the information necessary to demonstrate compliance, and allow for and contribute to audits on reasonable notice.

6. Obligations of the Controller (you)

You:

1. establish a lawful basis for processing (typically contract performance, legal obligation under HMRC PAYE / Right to Work / pension auto-enrolment);
2. provide a Privacy Notice to your staff at the start of employment;
3. have authority to upload the personal data you upload, and to instruct us to process it;
4. set retention rules consistent with UK law;
5. do not upload Special Category data outside of the legitimate workforce purposes (e.g. sickness records);
6. configure access controls (roles, sites) appropriately for your organisation;
7. secure your own user credentials and devices; promptly remove access for staff who leave.

7. Sub-processors

The Controller authorises us to engage the Sub-processors listed at /sub-processors.html. We notify the Controller of new Sub-processors before they begin processing, giving the Controller a right to object reasonably. We have a written contract with each Sub-processor that imposes data protection obligations no less protective than those in this DPA.

8. International transfers

Customer data is hosted in the UK (Supabase, London region). The main international transfer is to Anthropic (US) for AI inference, and only when the Controller enables HR Helper. Where data is transferred outside the UK/EEA, an appropriate safeguard is in place (UK adequacy, the UK International Data Transfer Addendum, or Standard Contractual Clauses).

9. Security

We maintain appropriate technical and organisational measures (full detail in Schedule A). In summary:

• Encryption in transit (TLS/HTTPS) and at rest
• Additional application-layer encryption of sensitive fields (NI number, bank details, home address, date of birth)
• Per-organisation isolation enforced by database Row Level Security on every table
• Role-based access (owner / HR / manager / staff); staff PIN access scoped to their site
• Two-factor authentication available for manager / HR / owner accounts; rate-limiting and lockout on repeated failed logins
• Immutable (append-only) audit log of sensitive actions
• Automated daily backups; data hosted in the UK region

We continually improve our security posture and are working towards formal certification (e.g. Cyber Essentials).

10. Personal data breaches

We notify the Controller without undue delay (and within 72 hours where feasible) of any Personal Data breach affecting their data. Notification will include the information required under UK GDPR Article 33(3) so far as known.

11. Liability

Each party's liability under this DPA is governed by the WorkHive Terms of Service, except that nothing in this DPA limits liability for breach of UK GDPR (Article 82).

12. Governing law and jurisdiction

This DPA is governed by the laws of England and Wales. Disputes are subject to the exclusive jurisdiction of the English courts.

13. Contact

Data protection contact: hello@workhive.co.uk
ICO complaints: ico.org.uk · 0303 123 1113

Schedule A — Technical & Organisational Measures

1. Encryption — TLS/HTTPS in transit; encryption at rest; additional application-layer encryption on sensitive fields (NI number, bank details, address, date of birth) using a separately managed key.
2. Confidentiality, integrity, availability & resilience — Row Level Security on every table; per-organisation data isolation; immutable audit log; automated daily backups; data hosted in the UK (London) region.
3. Access management — Role-based permissions (owner / HR / manager / staff); two-factor authentication available for privileged roles; staff PIN access scoped to site; rate-limiting and account lockout on repeated failed logins; access revoked when staff leave.
4. Monitoring & logging — Platform logs (Supabase, Netlify); append-only audit log on sensitive actions (contracts, payroll, data export/deletion) recording timestamp and actor; automated security alerts.
5. Data minimisation & retention — Only data needed for the service is collected; retention and purge schedules apply; the Controller can export or delete data at any time from the dashboard.
6. Personnel — Authorised personnel are bound by confidentiality obligations; documented onboarding/offboarding of access.
7. Sub-processor management — Written data-protection terms with each sub-processor; current list published at /sub-processors.html; prior notice of changes.