Effective 1 November 2026
These Terms govern access to and use of the HRStuff website and application. “HRStuff”,
“we”, “us” and “our” mean Clearworks Pte. Ltd., the Singapore company operating
the HRStuff service, contactable at
info@hrstuff.io. “Customer”, “you” and “your” mean
the organization named during sign-up and the person accepting these Terms for it.
1. Business use and authority
HRStuff is offered for business and professional use. By creating an account, accepting
an order, or using the service, you agree to these Terms for the Customer. You confirm
that you are at least 18 years old and authorized to bind the Customer. If you do not
have that authority, do not create the account or use the service.
2. The service
HRStuff is self-service software for employee records, leave, claims, payroll
calculations, payslips, reports and related administration. Available features depend
on the Customer’s plan and settings. The service applies data, policies and calculation
rules entered or approved by the Customer. The compliance Disclaimer shown at sign-up
forms part of these Terms.
We may maintain, repair, secure and improve the service. We may change a feature where
reasonably necessary for security, law, reliability or product improvement. Where a
planned change materially reduces paid functionality, we will give reasonable notice
when practicable.
3. The Customer’s responsibilities
The Customer is responsible for:
- deciding whether HRStuff is suitable for its organization and each place where its
workers are hired, employed, resident or working;
- providing lawful, complete and accurate data, policies, rules, opening balances and
instructions, and keeping them current;
- reviewing calculations, reports, payslips and scheduled actions before relying on or
publishing them;
- meeting its employment, payroll, tax, leave, benefits, privacy, record-keeping,
filing, payment and other legal obligations;
- giving workers and other individuals any required notices and obtaining any required
permissions or other lawful basis for their data; and
- assigning appropriate access roles and ensuring that its users follow these Terms.
4. Accounts and security
Account information must be accurate. Each user must keep their password and device
secure, must not share a login, and must tell the Customer and HRStuff promptly about
suspected unauthorized access. The Customer is responsible for activity carried out
through its accounts unless it resulted from HRStuff’s breach of these Terms or failure
to use reasonable care.
5. Customer Data
“Customer Data” means information, files and instructions submitted to the service by
or for the Customer. As between the parties, the Customer retains its rights in Customer
Data. The Customer gives HRStuff a limited right to host, copy, transmit, back up and
otherwise process Customer Data only as needed to provide, secure, support and maintain
the service, follow lawful Customer instructions, and comply with law.
The Customer confirms that it has the authority and lawful basis needed to provide and
use Customer Data, including sensitive employee information. The
Data Processing Agreement in section 18
forms part of these Terms and governs HRStuff’s processing of personal data on the
Customer’s behalf. Required international-transfer arrangements are addressed in that DPA.
6. Acceptable use
You must not use HRStuff to break the law or another person’s rights; upload malicious,
unlawful or infringing material; access another customer’s data; bypass permissions or
security controls; probe or disrupt the service; overwhelm it with automated requests;
share, resell or provide the service to an unauthorized third party; or reverse engineer
it except where applicable law expressly permits that activity.
7. Plans, renewal, cancellation, fees, refunds and taxes
The plan, price, billing period and minimum quantity shown at sign-up or in a written
order form part of the agreement. Fees are charged in advance through Stripe. The
subscription renews automatically for the same billing period until the Customer
cancels it before the next charge date. The Customer authorizes Stripe to charge the
saved payment method for each renewal. The next charge date is shown on the Billing
page.
If the Customer starts with a free trial, no card is required during the trial. Unless
HRStuff has made the trial ongoing, ordinary access pauses at the recorded trial end.
Where a Stripe subscription is linked, Stripe issues the invoice for continued monthly
service. Full access resumes only after Stripe confirms that invoice is paid. Otherwise,
the Customer must contact HRStuff to arrange continued access.
The first payment uses the quantity confirmed at sign-up. After that, the billable
quantity is at least three and otherwise counts active employee records, whether or not
the employee has logged in. Before additional employees are activated, HRStuff shows the
administrator the new paid headcount and the amount Stripe will charge for the rest of
the current billing period. The extra employees remain pending unless that
payment succeeds.
When active employee records are made inactive, the lower quantity applies at the next
renewal without a mid-period refund or credit. Changes between the Monthly and Yearly
Plans also take effect at the next renewal without mid-period proration or credit.
An authorized Customer administrator may cancel through the Billing page and Stripe's
secure customer portal. Cancellation takes effect at the end of the current paid billing
period. The Customer may continue using the service until then, and no further renewal
will be charged. Cancellation does not remove amounts already due.
Paid fees are non-refundable except where applicable law requires a refund or HRStuff
confirms a billing error. HRStuff does not give a refund or credit for an unused part of
a billing period, a mid-period cancellation, a reduction in billable employees, or a
plan change. A suspected billing error should be reported promptly through the Contact
page or to info@hrstuff.io.
If a monthly or yearly renewal payment fails, Stripe may retry it and HRStuff may ask
the Customer to update the payment method. If Stripe then cancels the subscription for
that unresolved payment failure, employee, manager and Assistant Administrator access
pauses. A full HR Administrator may still sign in to Billing, support and essential
account pages to recover the subscription.
Recovery keeps the previous plan and uses the current billable headcount, subject to
the minimum quantity. Because the service period began on the first unpaid date, Stripe
may charge from that date rather than begin a new billing period on the recovery date.
Full access resumes only after Stripe confirms that the replacement subscription is
active and its first invoice is paid. Voluntary cancellation, company deletion and an
unresolved cancellation reason are reviewed separately and do not automatically use
this payment-lapse restriction.
The Customer must pay applicable taxes. We will give reasonable advance notice of a
price change that affects a future renewal period.
8. Ownership and feedback
HRStuff and its licensors own the service, software, design, documentation, trade marks
and related intellectual property. These Terms give the Customer a limited,
non-exclusive, non-transferable right to use the service during its subscription. If you
provide suggestions, we may use them without restriction or payment, but we will not
identify you publicly without permission.
9. Service providers and third-party services
We may use reputable service providers for hosting, databases, communications and other
infrastructure. A third-party service that the Customer chooses to connect to HRStuff is
governed by that provider’s terms. We are not responsible for a third party’s service,
but we remain responsible for our own obligations when we appoint a provider to process
data for us.
When the Customer enables an integration, it instructs HRStuff to send the selected
event or calendar information to that destination. The Customer is responsible for
choosing appropriate destinations and recipients, protecting private calendar links and
webhook addresses, and disconnecting access that is no longer needed.
10. Availability, support and security
We will use reasonable care and skill to operate the service and reasonable technical
and organizational measures to protect it. Internet and software services can still be
interrupted or contain faults. Unless a separate written service-level agreement says
otherwise, HRStuff does not promise uninterrupted availability or a particular response
or recovery time. Support explains how the software works; it does not provide legal,
tax, payroll, accounting or compliance advice.
11. Suspension and termination
We may suspend access where reasonably necessary to address a security risk, unlawful
use, material breach, non-payment, or harm to the service or another person. Where
practicable, we will explain the reason and allow a reasonable opportunity to correct
it. The Customer may cancel its subscription as described in section 7. We may end the
service for a material breach that is not corrected within a reasonable time, or where
continuing the service would be unlawful. Before access ends, the Customer should export
records it must retain.
After termination, return and deletion of personal data are governed by the Customer’s
choice under the DPA and applicable law. Provisions that by their nature should continue, including ownership,
confidentiality, accrued payment obligations, liability and dispute provisions, survive
termination.
12. Confidentiality
Each party must protect the other’s non-public information with reasonable care and use
it only for the agreement. This does not cover information that is already public without
breach, was lawfully known without restriction, was independently developed, or was
lawfully received from another source. A party may disclose information where law
requires it, after giving notice when legally permitted.
13. Warranties and responsibility for results
HRStuff will provide the service with reasonable care and skill. Except for that promise
and rights that cannot lawfully be excluded, the service is provided without additional
warranties. We do not warrant that Customer-entered rules are legally correct, that an
output satisfies a particular authority, or that the service is suitable for every
country or circumstance.
HRStuff is not responsible for an incorrect result caused by inaccurate or incomplete
Customer Data, Customer-configured rules, unauthorized use, failure to review an output,
or instructions contrary to our documentation, except to the extent that HRStuff caused
or contributed to the loss.
14. Liability
Nothing in these Terms excludes or limits liability for fraud, fraudulent
misrepresentation, wilful misconduct, death or personal injury caused by negligence, or
any other liability that law does not allow to be excluded or limited.
Subject to that sentence and to any different limit in a signed agreement, neither party
is liable for indirect or consequential loss, or for loss of profit, revenue, goodwill or
anticipated savings that was not reasonably foreseeable when the agreement was made.
HRStuff’s total aggregate liability arising from or relating to the service is limited to
the fees the Customer paid for its most recent paid month of service before the event
giving rise to the claim. If the Customer is billed yearly, this limit is one-twelfth of
the yearly fees paid for the subscription year in which the event occurred. This limit
does not reduce any mandatory statutory remedy.
15. Changes to these Terms
We may update these Terms for legal, security or service changes. We will identify the
effective date and give reasonable notice of a material change. If a material change is
unacceptable, the Customer may stop using the service before it takes effect, subject to
any existing order and mandatory law.
16. General
If a provision cannot be enforced, the remaining provisions continue. A delay in
enforcing a right is not a waiver. The Customer may not transfer the agreement without
our consent, except as part of a genuine sale or reorganization of its business. We may
transfer it as part of a sale or reorganization of HRStuff if the transfer does not
materially reduce the Customer’s rights.
The governing law and courts are those stated in a written order or separate agreement.
If none is stated, applicable conflict-of-laws rules determine the governing law and
forum. Mandatory rights and the jurisdiction of a competent regulator are not affected.
17. Contact
Questions about these Terms may be sent through the
Contact page or to
info@hrstuff.io.
18. Data Processing Agreement (DPA)
This DPA forms part of the Terms between Clearworks Pte. Ltd., the Singapore company
operating HRStuff, and the Customer identified in the account or applicable order.
Accepting the Terms includes accepting this DPA; a separate signature is not required
for that electronic acceptance. An existing Customer must accept this version or
otherwise validly agree to its incorporation under the parties’ agreement. Earlier
acceptance records are not treated as acceptance of wording that did not then exist.
18.1 Scope and roles. “Customer Personal Data” means personal data
within Customer Data that HRStuff processes on the Customer’s behalf. The Customer is
the controller or equivalent responsible organization; HRStuff is its processor or
data intermediary. If the Customer is itself a processor, it confirms that its controller
has authorized these instructions and HRStuff’s appointment. “Data Protection Law” means
the Singapore Personal Data Protection Act, the EU General Data Protection Regulation
(GDPR), the UK GDPR and other personal-data protection laws to the extent they apply to
the relevant processing. HRStuff’s separate controller activities, including its own
billing administration and public enquiries, are described in the
Privacy Notice. This distinction does not authorize HRStuff to
repurpose Customer workforce records for its own advertising.
18.2 Processing description and duration. The subject matter is
providing the HRStuff services selected by the Customer: workforce administration,
leave, claims, payroll calculations, payslips, reports, support and enabled integrations.
Processing includes receiving, recording, organizing, storing, retrieving, calculating,
displaying, exporting, transmitting, backing up, correcting and deleting information.
It continues while those processing services are provided and for the limited period
needed to carry out the Customer’s return or deletion instructions under section 18.10.
Data subjects may include current and former workers, applicants entered by the
Customer, account users, dependants, emergency contacts, claimants, approvers and people
mentioned in Customer documents or communications. Data may include identity and contact
details, government identifiers, employment and demographic information, salary and
bank details, payroll calculations, leave and claim records, uploaded files, communications,
access permissions and activity records. Depending on the Customer’s configuration and
submissions, it may include health or disability information, race, religion and other
special-category or sensitive data. The Customer determines which fields and records
are necessary and establishes the required legal basis and any special-category condition.
Accepting this DPA does not itself provide an employee’s consent or another legal basis.
18.3 Instructions and permitted use. HRStuff will process Customer
Personal Data only on the Customer’s documented instructions, including the Terms,
this DPA, the applicable order, authorized account settings and requests from authorized
Customer representatives. This includes instructions about disclosures and international
transfers, subject to section 18.8. HRStuff will not sell Customer Personal Data, use it
for third-party advertising or disclose it for purposes unrelated to those instructions.
The Customer remains responsible for the lawfulness, accuracy, necessity and content of
its instructions and for notices to individuals.
If HRStuff considers an instruction to infringe Data Protection Law, it will immediately
inform the Customer and may pause the affected processing while the issue is resolved.
Processing required by law will be handled only as permitted by Data Protection Law,
including the limits in GDPR Article 28(3)(a) where applicable. HRStuff will inform the
Customer before legally required processing unless that law prohibits notice on important
grounds of public interest. A third-country demand does not by itself replace any
safeguard required for a restricted international transfer.
18.4 Confidentiality and access. HRStuff will ensure that people
authorized to process Customer Personal Data are bound by confidentiality commitments
or an appropriate statutory confidentiality obligation. Access will be limited to
what is needed for their duties. Customer users receive access according to the
Customer’s roles and permissions. HRStuff’s in-application customer support access is
read-only, reason-based, time-limited and recorded; necessary infrastructure access
remains subject to access restrictions and confidentiality.
18.5 Technical and organizational security measures. HRStuff will
maintain measures appropriate to the risks and required by Data Protection Law,
including GDPR Article 32 where applicable. The assessment takes account of the nature,
scope, context and purposes of processing, the state of the art, implementation costs
and risks to individuals. Measures include:
- role-based permissions, separation between customer organizations, protected login
sessions, salted password hashing and restricted administrative access;
- production HTTPS and protected provider connections, private file storage,
application-level encryption of identity and bank-account numbers, and separately
encrypted company backup archives;
- protection of credentials and encryption keys, request-forgery protection,
validation of uploaded files and bounded processing of files and requests;
- activity records, controlled support access, incident handling and secure deletion
processes;
- measures to preserve confidentiality, integrity, availability and resilience,
restore access after incidents and regularly assess and test the effectiveness of
relevant security and recovery controls.
HRStuff may improve or replace individual controls while maintaining an appropriate
overall level of protection. The Customer manages its users, permissions, devices,
exports, selected recipients and integration destinations. These allocations do not
remove either party’s own legal duties. No certification or audit standard is implied
unless it is expressly identified in a separate written agreement.
18.6 Subprocessors. The Customer gives general written authorization
for HRStuff to use the subprocessors identified below to provide their stated functions.
HRStuff will bind each appointed subprocessor to data-protection obligations equivalent
to those required of HRStuff for the work it performs, including appropriate security
and confidentiality. HRStuff remains responsible to the Customer for the performance
of its subprocessors’ data-protection obligations.
- Render: application and PostgreSQL hosting in Singapore, including
related infrastructure and recovery services.
- Cloudflare: private R2 storage of receipts, documents and encrypted
company backups. Storage locations depend on the bucket configuration; a location
hint is not a guarantee of Singapore-only storage.
- Resend: transactional email delivery, including employee and
administrator messages where enabled; processing is primarily in the United States.
Before adding or replacing a subprocessor for Customer Personal Data, HRStuff will
give at least 30 days’ advance notice to the Customer’s administrator email address on
record, identifying the proposed provider, function and relevant processing location.
The Customer may object during that period on reasonable data-protection grounds by
contacting info@hrstuff.io. The parties will seek a
suitable alternative or resolution. HRStuff will not begin the affected processing with
the proposed subprocessor while such an objection remains unresolved; affected processing
may instead be suspended or ended under the Terms and applicable law.
Providers appointed directly by the Customer, such as a selected Slack, Teams,
Telegram, Zapier, Make or calendar destination, are governed by the Customer’s arrangements
with those providers to the extent they act independently of HRStuff’s appointment.
This does not exclude any provider HRStuff itself appoints from this section. Stripe’s
handling of subscription and payment information for HRStuff’s own billing purposes is
described separately in the Privacy Notice.
18.7 Assistance with individual rights. Taking account of the
nature of processing, HRStuff will assist the Customer through appropriate technical
and organizational measures, insofar as possible, with applicable requests to access,
correct, restrict, erase, object to or receive portable Customer Personal Data. If
HRStuff receives a request about Customer-controlled records directly, it will inform
the Customer without undue delay unless legally prohibited and will not decide the
request on the Customer’s behalf without authorization or a legal requirement. The
parties will verify identity and authority and protect other individuals’ information.
18.8 International transfers. The processing locations described
above and in the Privacy Notice do not remove transfer restrictions imposed by Data
Protection Law. HRStuff will maintain the applicable safeguards for transfers it
carries out, including comparable protection where required by Singapore law. For a
restricted EU/EEA or UK transfer, section 19 incorporates the applicable EU Standard
Contractual Clauses and UK Addendum where those instruments can lawfully be used.
The parties must complete the required particulars, annexes and assessments and
implement necessary supplementary safeguards before the affected processing begins,
or establish another legally valid transfer mechanism.
The incorporated instruments do not represent that Singapore has an EU or UK adequacy
decision. An advertising-cookie choice, a Customer instruction or acceptance of the
Terms does not replace a required transfer assessment or missing safeguards. Until the
required arrangements are in place, the Customer must not submit the affected data
and HRStuff will not carry out the affected restricted processing. Each party will
assist the other with the information needed to establish and assess lawful transfers.
18.9 Breaches and regulatory assistance. HRStuff will notify the
Customer without undue delay after becoming aware of a personal-data breach affecting
Customer Personal Data. It will provide available information about the nature of the
breach, affected data and individuals, likely consequences, contact point, containment
and remedial measures, and further information as it becomes available. Initial notice
will not be delayed solely because the investigation is incomplete.
Taking account of the nature of processing and information available to it, HRStuff
will assist the Customer with security obligations, breach assessment and notifications,
data protection impact assessments and prior consultation with regulators, including
GDPR Articles 32 to 36 where applicable. The Customer determines and makes its required
notifications unless the parties agree otherwise in writing; HRStuff remains responsible
for any notification or cooperation duty imposed directly on it by law.
18.10 Return, deletion and remaining copies. At the Customer’s
choice, HRStuff will return or delete Customer Personal Data after the end of the
relevant processing services and delete its existing copies, except where retention
is required by law as permitted by Data Protection Law. The Customer may request a
secure export through an authorized administrator or
info@hrstuff.io and should arrange the return before
confirming permanent deletion. HRStuff will reasonably assist with return requests
and will not treat a request for return as permission to destroy the only available copy.
Cancelling billing is separate from instructing permanent account deletion. Any
storage while return or closure is being arranged remains subject to documented
instructions, purpose limitation and the applicable retention requirements. Once
company deletion is confirmed, live records are removed and app-managed backup archives
are blocked from download or restore and queued for removal, normally within a
24-hour completion target. Removal failures are retried and reported to platform
administrators; the target is not an unconditional guarantee.
Where immediate removal from hosting-provider infrastructure snapshots is not
technically possible, remaining copies must be kept beyond ordinary use and expire
under a documented, justified retention schedule. HRStuff will provide available
retention details on request and ensure that recovery procedures reapply deletions
before restored data is made available. Backups are not a basis for indefinite
retention. Any legally required retention must be limited to the data, purpose and
period required, with protection maintained and other use prohibited. On request,
HRStuff will provide reasonable confirmation of completed return or deletion.
18.11 Compliance information and audits. HRStuff will make
available information needed to demonstrate compliance with this DPA and applicable
processor obligations, and will allow and contribute to audits, including inspections,
by the Customer or an auditor it appoints. The parties will first use relevant existing
documentation where that can meet the need. Reasonable notice, confidentiality,
security arrangements and protection of other customers’ data may be agreed, but must
not prevent an audit required by law or a competent regulator. Urgent incidents or
reasonable evidence of non-compliance may require expedited arrangements.
18.12 Priority, contact and continuing duties. If this DPA conflicts
with another part of the Terms about processing Customer Personal Data, this DPA
prevails. A binding international-transfer instrument prevails to the extent required
by that instrument. Commercial terms otherwise continue to apply, subject to mandatory
law; nothing limits individuals’ statutory rights, regulatory powers or obligations
that cannot lawfully be excluded. Confidentiality, protection, assistance and deletion
obligations continue for as long as HRStuff retains Customer Personal Data. Send DPA
instructions, objections and privacy enquiries to
info@hrstuff.io.
19. International Transfer Addendum
This addendum forms part of the DPA in section 18. It addresses transfers of
Customer Personal Data from the Customer to Clearworks Pte. Ltd. operating HRStuff.
It does not cover HRStuff's separate controller activities or replace the safeguards
required for onward transfers to subprocessors. Section 19.7 applies before the
parties rely on these arrangements for a restricted transfer.
19.1 EU/EEA transfer clauses. Where a transfer requires safeguards
under GDPR Article 46, falls within the permitted scope of the clauses below and
is not covered by another valid transfer mechanism agreed by the parties, the
Standard Contractual
Clauses in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June
2021 (the “EU SCCs”) are incorporated by reference in full into this agreement,
with the applicable module, options and appendix information specified here.
Their approved wording is not otherwise amended.
Module Two (controller to processor) applies when the Customer is a controller.
Module Three (processor to processor) applies when the Customer is a processor
engaging HRStuff as its subprocessor with the relevant controller's authorization.
Only the module appropriate to the actual transfer applies. These EU SCCs are not
represented as a valid mechanism for a transfer outside their legal scope, including
where the relevant processing by the importer is already directly subject to the
GDPR and these clauses cannot lawfully be used for that transfer.
19.2 Selected EU SCC options. For the applicable module:
- the optional docking clause in Clause 7 is not included;
- Clause 9(a), Option 2 (general written authorization), applies with at least
30 days' advance notice of an intended addition or replacement, as described in
section 18.6;
- the optional independent dispute-resolution provision in Clause 11(a) is not
included; the remaining redress provisions apply;
- Clause 17, Option 1, selects the law of Ireland; and
- Clause 18(b) selects the courts of Ireland, without restricting an individual's
rights to bring proceedings in another court permitted by the EU SCCs.
19.3 Annex I.A — parties and acceptance. The data exporter is the
Customer identified by its full legal name and relevant contact particulars in the
applicable account, billing record, order or other agreed written particulars. Its
contact is the authorized Customer administrator or its separately designated privacy
contact. Its role is controller under Module Two or processor under Module Three.
Its relevant activity is using HRStuff for the workforce processing described in
section 18.2.
The data importer is Clearworks Pte. Ltd., trading as HRStuff, in Singapore. Its
privacy contact is info@hrstuff.io. It acts as
processor under Module Two or subprocessor under Module Three to provide those services.
The parties agree that their legally binding electronic acceptance of this agreement
also executes the incorporated EU SCCs, including Annex I.A. The applicable date is
the date of that acceptance or a separately recorded written agreement. This does not
treat an earlier acceptance as agreement to a later version. Required party particulars
not already recorded must be completed under section 19.7.
19.4 Annex I.B — description of transfers. The data subjects,
categories of personal data, processing operations, purposes and subject matter are
those described in section 18.2 for the services and settings the Customer actually
selects. Transfers occur on an ongoing basis as the Customer and its users use those
services, including scheduled processing, authorized support and backups. The
destination is HRStuff's processing in Singapore, with onward processing by the
subprocessors described in section 18.6 subject to the applicable onward-transfer
requirements. Processing duration and retention follow sections 18.2 and 18.10.
Where sensitive or special-category data is submitted, the safeguards include
Customer-controlled permissions, separation between customer organizations, private
file storage, encryption of identity and bank-account numbers, encrypted company backup
archives and controlled support access, as described in sections 18.4 and 18.5.
The Customer must limit submissions and access to what is necessary and lawful.
Any additional restrictions or safeguards required for the particular sensitive-data
transfer must be documented and implemented before that transfer.
19.5 Annex I.C, Annex II and subprocessors. The competent
supervisory authority for Annex I.C is determined under Clause 13: the authority
responsible for the Customer's relevant establishment, its applicable Article 27
representative, or, where the Clause 13 conditions permit, an authority in a Member
State where affected individuals are located. The parties must identify the applicable
authority in their transfer particulars before relying on the EU SCCs.
For Annex II, the technical and organizational measures are those described in
sections 18.4 and 18.5, including access controls, tenant separation, protected sessions,
password hashing, production HTTPS, protected provider connections, private storage,
field and backup encryption, key protection, validation, activity records, controlled
support access, recovery and security testing. Sections 18.7, 18.9, 18.10 and 18.11
describe the measures and procedures for assisting with rights requests, incidents,
assessments, return, deletion and audits. These descriptions must be supplemented with
the specific measures needed for the actual transfer under section 19.7; no unverified
certification, storage location or end-to-end encryption guarantee is implied.
The authorized subprocessor list and functions are in section 18.6. Annex III is not
required for the selected general-authorization option; the subprocessor information,
notice, objection and onward-transfer obligations still apply. A provider's agreement
with HRStuff does not itself replace the safeguards for the Customer's transfer to
HRStuff.
19.6 UK transfers. For a restricted transfer subject to UK GDPR,
where these arrangements are a legally available safeguard and no other valid mechanism
agreed by the parties covers it, the
ICO
International Data Transfer Addendum to the EU Commission Standard Contractual Clauses,
version B1.0, in force 21 March 2022 (the “UK Addendum”), including its Part 2
Mandatory Clauses as revised under its Section 18, is incorporated by reference.
The EU SCCs specified above form the Addendum EU SCCs with the following Part 1 entries:
- Table 1: the parties, roles, key contacts and acceptance are as
described in section 19.3, supplemented with the required party particulars. The
start date is the date the parties validly agree to the UK Addendum.
- Table 2: the EU SCCs identified in section 19.1 apply with Module
Two or Three according to the actual roles and the options in section 19.2.
- Table 3: the appendix information is in sections 19.3 to 19.5
and any required agreed transfer particulars and supplementary measures.
- Table 4: both the importer and exporter may end the UK Addendum
under its Section 19 when the conditions in that section are met.
The Mandatory Clauses make the required UK adaptations, including the ICO as the
competent authority and the laws and courts of England and Wales, subject to the
rights preserved by the UK Addendum. They govern any conflict as specified in their
hierarchy provisions. The parties must complete the applicable UK transfer risk
assessment and any necessary additional protections before relying on this safeguard.
19.7 Preconditions, assessment and continuing protection. Inclusion
of the standard instruments does not certify that all required party particulars,
transfer-specific appendix information, provider arrangements or assessments are
already complete. Before the affected restricted processing begins, the parties must
complete and agree the required particulars, document the applicable transfer
assessment, and implement any necessary supplementary safeguards. Existing account,
billing and order information may be used where accurate and sufficient. Missing
information can be completed through the existing privacy contact; a new sign-up
form or a separate paper signature is not required merely by this addendum.
The assessment must address the particular transfer, relevant destination-country
laws and practices, access by public authorities and the effectiveness of the actual
protections. The parties will provide necessary information, keep the assessment
under review and respond to changes affecting protection. Until the required
arrangements are in place, the Customer must not submit the affected data and HRStuff
will not carry out the affected restricted processing. If the required protection
cannot be maintained, the affected transfers must be suspended or ended as required
by the applicable instrument. Acceptance of these Terms alone does not complete that
assessment or establish that a country has adequate protection.
19.8 Priority and enforceable rights. The applicable EU SCCs and UK
Addendum prevail as required by their own hierarchy provisions, including over
conflicting governing-law, forum, audit and liability provisions elsewhere in the
Terms or DPA. No commercial limitation excludes or restricts rights or liabilities
that cannot be limited under those instruments. Nothing here removes data subjects'
third-party beneficiary rights or the powers of a competent regulator.
