Data Processing Addendum

This addendum forms part of the Terms of Service between Hatton Technologies (operating as Softra) and the customer. A customer administrator accepts this addendum for the organization; ordinary employees do not. Acceptance is recorded electronically. Contract enquiries may be sent to legal@softraglobal.com.

1. Roles

The customer is the controller of personal data in its workspace. Softra is the processor and processes that data only on the customer's documented instructions, including the instructions expressed through use of platform features. Hatton Technologies separately controls its own account, security and marketing records. Softra tells the customer if an instruction appears to conflict with applicable data protection law.

2. Subject matter and duration

“Personal Data”, “Controller”, “Processor” and “Personal Data Breach” have the meanings given by applicable data protection law. Customer Personal Data means personal data processed on the customer’s behalf. If these processing terms conflict with the general service terms, these terms control for that processing.

Processing lasts for the subscription term plus the retention periods described below. The subject matter is the provision of HR, payroll, and recruitment software.

3. Categories of data subjects

• Customer administrators and platform users.
• Employees and contractors of the customer.
• Job applicants and candidates.
• Emergency contacts and dependants where the customer records them.

4. Types of personal data

• Identity and contact details, national and tax identifiers, and employment records.
• Compensation, deductions, reliefs, benefits, banking details for pay, and payslip history.
• Time, attendance, leave, and performance data.
• Application materials, interview schedules, scorecards, and hiring outcomes.
• Authentication, access, and audit records.

Optional customer-entered sensitive records are not covered by blanket signup consent; the controller must establish the specific lawful basis and safeguards before supplying such data.

5. Softra obligations

Processing includes collecting, organizing, storing, retrieving, calculating, transmitting, exporting and deleting records to provide the customer-selected service. The customer must give lawful instructions, maintain an appropriate legal basis, inform individuals and control authorized access. Softra does not determine hiring, promotion or employment outcomes.

• Process personal data only on documented instructions.
• Bind personnel with access to duties of confidentiality and grant access on a least-privilege basis.
• Implement and maintain the technical and organizational measures in section 6.
• Assist the customer with data subject requests, impact assessments, and regulator consultations, taking into account the nature of the processing.
• Make available the information needed to demonstrate compliance and allow audits as described in section 10.

6. Security measures

• Encryption in transit (TLS) and at rest for stored data and backups.
• Workspace separation and role-based authorization for customer records and exports.
• Role-based access control, optional multi-factor authentication, and session inactivity timeout.
• Audit history of privileged and payroll-affecting actions.
• Access limited according to role and the authorized operational purpose.
• Dependency checks, monitored error reporting and change review.
• Encrypted, access-controlled backups with a documented restore procedure.

7. Sub-processors

The customer gives general authorization for Softra to engage the sub-processors listed on the sub-processor page. Softra remains responsible for its sub-processors’ performance of the processing obligations it delegates. Customers may request processing particulars through the privacy contact. We aim to give at least 30 days' notice before a new sub-processor begins processing, so the customer can raise a reasonable objection.

8. International transfers

Additional transfer terms and regional provisions apply where required by the law relevant to the customer and the processing.

Service delivery and recovery may involve processing outside your country, including cloud processing and off-site backup storage in the United States. International transfers are subject to applicable data protection law and the safeguards required for the relevant processing.

Customers are responsible for record-keeping and location requirements that apply to their operations. International hosting does not automatically meet local record-location requirements. Authorized exports assist customer record keeping but do not replace the customer’s legal obligations.

9. Personal data breaches

Softra notifies the customer without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting that customer's data, with the nature of the breach, categories and approximate volume of records, likely consequences, and remediation steps taken or planned.

The 72-hour term above is a customer-contract commitment, not a universal statutory deadline. Notifications to relevant authorities and affected individuals follow applicable laws in the jurisdiction relevant to the customer and the processing.

Initial breach information may be provided in stages as the assessment progresses. Softra assists with containment and information reasonably needed for the customer’s lawful notifications; the customer remains responsible for its controller duties.

10. Audit and evidence

On reasonable written request, and no more than once a year unless a regulator or a breach requires otherwise, Softra provides its security documentation and responds to a security questionnaire. On-site audits are available where legally required, at reasonable times, subject to confidentiality and to not disrupting the service.

11. Return and deletion

Authorized exports are available during the subscription through existing report and record tools. For categories outside those tools, the customer may request an authorized export through the privacy contact.

Personal data is kept only as long as necessary for its lawful purpose under applicable laws in the jurisdiction relevant to the customer and the processing. Required legal records, documented contractual purposes, consent and lawful holds can justify longer retention. At expiry, records must be securely deleted or de-identified so they cannot be reconstructed in intelligible form.

Customers may request an authorized export for 30 days after termination. Subscription access may end before that period; contact privacy@softraglobal.com for assistance. After the export period, return, deletion or de-identification is handled through a controlled review of customer instructions and applicable record-keeping duties. Records may remain pending that review. Required financial evidence and lawful holds are treated separately; termination does not itself erase records.

For expired trials, contact privacy@softraglobal.com about recovery or export of the account records. No fixed trial recovery period or additional paid read-only retention term is promised.

These periods describe our retention policy, not an automatic deletion deadline for every record. Requests are reviewed against the record’s purpose, customer instructions and applicable legal holds. Archiving, offboarding and access expiry do not by themselves delete records.

Optional OnShift granular location traces follow the customer’s configured period, with a 90-day fallback for raw traces and a 30-day fallback for exports, capped by the underlying period. Tracking is optional and time-limited. Granular location is distinct from payroll-supporting attendance and does not inherit its financial retention period. Applicable holds may extend retention.

Recovery copies are access-controlled and may remain subject to provider lifecycle periods and retention locks after deletion from the active service. No fixed backup-erasure deadline is promised. Restoration must account for applicable deletion instructions and lawful holds before recovered records are returned to use.

Company-specific lawful holds take precedence over expiry. Necessary financial evidence and ordinary diagnostic logs are treated separately.

Category-specific periods, including at least six years for applicable statutory financial/tax records, or longer where applicable law requires, are set out in section 8 of the Privacy Notice. The same policy version applies here.

12. Assistance with data subject requests

The platform provides authorized access, correction, report exports and record-specific deletion tools. Requests involving other records, legal holds or complete workspace erasure require controlled review. Where a data subject contacts Softra directly, we route the request to the customer and support their response.

13. Contact

Data protection contact: privacy@softraglobal.com. Related pages: Privacy Notice, Sub-processors, Security.