.svg){kind=small}
Employee Management
Performance
Shift
This Data Processing Agreement ("DPA") is entered into by and between [Customer Company Name], a company registered in [Country/England], with its registered office at [Customer Address] ("Controller") and Kolay IK Limited, a company registered in England and Wales (Company No. 16968866), with its registered office at Capital Office, 124-128 City Road, London, EC1V 2NX ("Processor").
This DPA forms part of the Master Subscription Agreement or other written or electronic agreement between the Parties for the provision of the Kolay IK SaaS platform ("Principal Agreement").
1.1. "Data Protection Laws" means all applicable data protection and privacy legislation in force from time to time in the UK including the UK GDPR; the Data Protection Act 2018; the Privacy and Electronic Communications Regulations 2003 (as amended); and any other applicable data protection legislation including the Data (Use and Access) Act 2025 as amended or replaced from time to time. 1.2. "UK GDPR" has the meaning given to it in section 3(10) (as supplemented by section 2054) of the Data Protection Act 2018. 1.3. The terms "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", and "Processing" shall have the meaning given to them in the UK GDPR.
2.1. The Parties acknowledge and agree that about the Processing of Personal Data under the Principal Agreement, the Customer is the Controller and Kolay IK Limited is the Processor.
2.2. The subject-matter, nature, purpose, and duration of the processing, as well as the types of Personal Data and categories of Data Subjects, are set out in Annex 1 to this DPA.
3.1. Documented Instructions: The Processor shall only process Personal Data on the documented instructions of the Controller, unless required to do so by UK law to which the Processor is subject. In such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. 3.2. Confidentiality: The Processor shall ensure that all personnel authorised to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. 3.3. Security: Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, the Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the UK GDPR. 3.4. Data Subject Rights: The Processor shall, taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller’s obligation to respond to requests for exercising the Data Subject's rights laid down in Chapter III of the UK GDPR. 3.5. Assistance: The Processor shall assist the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the UK GDPR (Security, Breach Notifications, Data Protection Impact Assessments, and Prior Consultation), taking into account the nature of processing and the information available to the Processor.
4.1. General Authorisation: The Controller provides a general written authorisation for the Processor to engage the Sub-processors listed in Annex 2. 4.2. Notification of Changes: The Processor shall inform the Controller of any intended changes concerning the addition or replacement of other Sub-processors, thereby allowing the Controller to object to such changes. If the Controller objects on reasonable data protection grounds within 14 days, the Parties shall discuss the concern in good faith. 4.3. Flow-down Obligations: The Processor shall ensure that data protection obligations materially similar to those set out in this DPA are imposed on any Sub-processor by way of a contract or other legal act under UK law. 4.4. Liability: The Processor remains fully liable to the Controller for the performance of the Sub-processor's data protection obligations.
5.1. The Processor shall not transfer Customer Personal Data outside the UK unless the transfer is made to a country, territory, or sector covered by an adequacy regulation (such as the EEA) or is subject to appropriate safeguards in accordance with Chapter V of the UK GDPR. 5.2. The Parties acknowledge that Customer Personal Data will be hosted primarily in the EEA (Frankfurt, Germany), which benefits from UK adequacy regulations.
6.1. The Processor shall notify the Controller without undue delay and, where feasible, not later than 48 hours after becoming aware of a Personal Data Breach affecting the Controller's Personal Data. 6.2. The Processor shall provide the Controller with sufficient information to allow the Controller to meet any obligations to report the breach to the Information Commissioner's Office (ICO) or notify Data Subjects.
7.1. The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the UK GDPR. 7.2. The Processor shall allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller, provided that such audits are conducted upon reasonable prior written notice, during normal business hours, and subject to appropriate confidentiality undertakings. The Controller shall bear the costs of any audit unless the audit reveals a material breach by the Processor.
8.1. Upon termination or expiry of the Principal Agreement, the Processor shall, at theController's choice, delete or return all Personal Data to the Controller and delete any existing copies,s unless UK law requires storage of the Personal Data.
For any privacy or data protection inquiries, notices, or data breach reports, the Processor's contact is: privacy@kolayik.co.uk
The laws of England and Wales shall govern this DPA. Each Party irrevocably submits to the exclusive jurisdiction of the courts of England and Wales.
This DPA and any amendments may be executed electronically (including via Google Workspace eSignature), and such electronic signatures shall have the same legal effect as wet-ink signatures.
A. Subject matter and duration of the processing: The subject matter of the processing is the provision of the Kolay IK cloud-based HR SaaS platform to the Controller. The processing will be carried out for the duration of the Principal Agreement.
B. Nature and purpose of the processing: To provide human resources management software services, including employee record keeping, payroll data preparation, absence tracking, and related HR administrative functions.
C. Categories of Data Subjects: The Controller’s current, past, and prospective employees, independent contractors, workers, and their nominated emergency contacts.
D. Types of Personal Data: Standard HR and employment-related data, specifically limited to: First and last name, residential address, gender, job title/role, start date, basic salary information, bank account number, phone number, email address, emergency contact details, education history, marital/family status, career history, and company-related financial transactions/advances.
E. Special Categories of Data (Article 9 UK GDPR): The Controller shall not upload or instruct the Processor to process any Special Categories of Personal Data unless the Parties have expressly agreed in writing (via a separate addendum) and appropriate additional safeguards are in place.
The Controller authorises the engagement of the following Sub-processors. All hosting of Customer Personal Data is strictly confined to the European Economic Area (EEA) and the UK, ensuring lawful data processing without the need for an International Data Transfer Agreement (IDTA).
(Note for Controller: Internal business administration tools used by Kolay IK that do not process Controller's employee data, such as CRM and accounting software, are excluded from this list.)
Start using it without any setup or credit card required.
TRY IT FREEHiçbir kurulum ve kredi kartı gerektirmeden, personel yönetim yazılımını hemen 15 gün boyunca ücretsiz deneyin.
