Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the PayGap Pro Terms of Service between the customer ("Controller") and [COMPANY LEGAL NAME, e.g. Example Software Ltd], [REGISTERED OFFICE ADDRESS, IRELAND] ("Processor"). It meets the requirements of Article 28 of Regulation (EU) 2016/679 (GDPR).

1. Subject matter, duration, nature and purpose

• Subject matter: processing of employee payroll data uploaded by the Controller to PayGap Pro.
• Purpose and nature: calculating gender pay gap figures and generating a draft report for the Controller. Processing consists of receiving, reading and calculating in memory, and returning results. No storage.
• Duration: the duration of each request (typically seconds). This DPA applies for as long as the Controller uses the service.

2. Data subjects and categories of data

• Data subjects: the Controller's employees (and any other individuals the Controller includes as relevant employees).
• Personal data: employee identifier, gender, ordinary pay, bonus pay and bonus period, hours worked, hourly pay, and whether the employee received benefits in kind, works part-time or is on a temporary contract. Names are not required and should not be uploaded.
• Special categories: none intended. The Controller must not upload special category data (Art. 9 GDPR).

3. Processor obligations

The Processor shall:

1. process the personal data only on the Controller's documented instructions (these Terms and the Controller's use of the service), unless EU or Irish law requires otherwise, in which case it will inform the Controller unless the law prohibits this;
2. ensure that anyone authorised to process the data is bound by confidentiality;
3. implement the technical and organisational measures in Annex 1 (Art. 32);
4. not engage another processor (sub-processor) without the Controller's general written authorisation. The Controller authorises the sub-processors in Annex 2. The Processor will give at least [30] days' notice of changes, during which the Controller may object; if the objection can't be resolved, the Controller may stop using the service. Each sub-processor is bound by data protection terms at least as protective as this DPA, and the Processor remains liable for its sub-processors;
5. assist the Controller, taking into account the nature of processing, in responding to data subject requests and in meeting its obligations under Arts. 32–36 (security, breach notification, impact assessments, prior consultation). Because payroll data is not retained, the Processor will normally hold no data to which such a request could relate;
6. notify the Controller without undue delay, and in any event within [48] hours, after becoming aware of a personal data breach affecting the Controller's data, with the information reasonably available;
7. delete the personal data at the end of each processing request. No copies are retained, subject to section 5;
8. make available all information necessary to demonstrate compliance with Art. 28 and allow for and contribute to audits, including inspections, by the Controller or its appointed auditor, on reasonable notice, at the Controller's cost and no more than once a year unless required by a supervisory authority or following a breach.

4. International transfers

Personal data is processed only within the European Economic Area. The Processor will not transfer it outside the EEA without the Controller's prior written consent and an appropriate transfer mechanism under Chapter V GDPR.

5. Logs and backups

Request bodies containing payroll data are excluded from application and hosting logs and from backups. If payroll data is ever captured inadvertently, the Processor will delete it promptly and treat the incident under section 3.6 where it amounts to a breach.

6. Controller obligations

The Controller warrants that it has a lawful basis for processing its employees' data for gender pay gap reporting, has given employees any required information, and that its instructions comply with data protection law.

7. Liability and law

Liability under this DPA is subject to the limitation of liability in the Terms of Service to the extent permitted by law. This DPA is governed by the laws of Ireland and the courts of Ireland have exclusive jurisdiction. If this DPA conflicts with the Terms regarding personal data, this DPA prevails.

Annex 1: Technical and organisational measures

• Encryption in transit (TLS/HTTPS) for all traffic.
• Payroll files processed in memory only. Never written to disk, database or logs, and not retained after the request.
• No payroll data shared with payment providers or any third party.
• Upload size limits and input validation. Download tokens stored only as SHA-256 hashes.
• Hosting in the EU with a provider holding recognised security certifications [CONFIRM, e.g. ISO 27001].
• Production access limited to named personnel with multi-factor authentication. Dependencies updated regularly.
• An incident response procedure for breach assessment and notification.

Annex 2: Authorised sub-processors

Stripe is not a sub-processor of payroll data: it never receives it. Stripe processes only purchaser payment data, as described in the Privacy Policy.

Version draft-2026-10-04 · last updated 4 October 2026