Data Processing Agreement (DPA)

Version of 26 October 2026

For companies that keep data about their employees and candidates in PapaHR.

1. Roles. The company owns the data and decides what data to enter and why. PapaHR processes it on behalf of the company, only to make the HR system work.
2. What we process. Employee and candidate data from the "Whose data" section of the Policy.
3. PapaHR's obligations.
   • process data only to run the service and on the company's instructions;
   • access by the PapaHR team — only for support and fixing errors;
   • protection — see the "Security" page;
   • notify the company of a security breach that affected its data without undue delay — no later than 72 hours after becoming aware of it;
   • help the company respond to employee requests (access, correction, deletion);
   • after the account is deleted, delete the company's data within 30 days, and from backups — no later than 90 days.
4. The company's obligations. Have a basis for processing employee data; obtain the employee's consent for a photo and other optional data; not enter anything unnecessary (passport details, etc.).
5. Subprocessors. The list from the "Who we share it with" section of the Policy. We announce a new subprocessor on this page at least 14 days in advance.
6. Where it is stored. In Europe: database and backups — Frankfurt (Germany), files — Cloudflare R2, region "Eastern Europe".
7. Questions and requests. [email protected].