Terms of Service

Effective 1 November 2026

These Terms govern access to and use of the HRStuff website and application. “HRStuff”, “we”, “us” and “our” mean Clearworks Pte. Ltd., the Singapore company operating the HRStuff service, contactable at info@hrstuff.io. “Customer”, “you” and “your” mean the organization named during sign-up and the person accepting these Terms for it.

1. Business use and authority

HRStuff is offered for business and professional use. By creating an account, accepting an order, or using the service, you agree to these Terms for the Customer. You confirm that you are at least 18 years old and authorized to bind the Customer. If you do not have that authority, do not create the account or use the service.

2. The service

HRStuff is self-service software for employee records, leave, claims, payroll calculations, payslips, reports and related administration. Available features depend on the Customer’s plan and settings. The service applies data, policies and calculation rules entered or approved by the Customer. The compliance Disclaimer shown at sign-up forms part of these Terms.

We may maintain, repair, secure and improve the service. We may change a feature where reasonably necessary for security, law, reliability or product improvement. Where a planned change materially reduces paid functionality, we will give reasonable notice when practicable.

3. The Customer’s responsibilities

The Customer is responsible for:

• deciding whether HRStuff is suitable for its organization and each place where its workers are hired, employed, resident or working;
• providing lawful, complete and accurate data, policies, rules, opening balances and instructions, and keeping them current;
• reviewing calculations, reports, payslips and scheduled actions before relying on or publishing them;
• meeting its employment, payroll, tax, leave, benefits, privacy, record-keeping, filing, payment and other legal obligations;
• giving workers and other individuals any required notices and obtaining any required permissions or other lawful basis for their data; and
• assigning appropriate access roles and ensuring that its users follow these Terms.

4. Accounts and security

Account information must be accurate. Each user must keep their password and device secure, must not share a login, and must tell the Customer and HRStuff promptly about suspected unauthorized access. The Customer is responsible for activity carried out through its accounts unless it resulted from HRStuff’s breach of these Terms or failure to use reasonable care.

5. Customer Data

“Customer Data” means information, files and instructions submitted to the service by or for the Customer. As between the parties, the Customer retains its rights in Customer Data. The Customer gives HRStuff a limited right to host, copy, transmit, back up and otherwise process Customer Data only as needed to provide, secure, support and maintain the service, follow lawful Customer instructions, and comply with law.

The Customer confirms that it has the authority and lawful basis needed to provide and use Customer Data, including sensitive employee information. The Data Processing Agreement in section 18 forms part of these Terms and governs HRStuff’s processing of personal data on the Customer’s behalf. Required international-transfer arrangements are addressed in that DPA.

6. Acceptable use

You must not use HRStuff to break the law or another person’s rights; upload malicious, unlawful or infringing material; access another customer’s data; bypass permissions or security controls; probe or disrupt the service; overwhelm it with automated requests; share, resell or provide the service to an unauthorized third party; or reverse engineer it except where applicable law expressly permits that activity.

7. Plans, renewal, cancellation, fees, refunds and taxes

The plan, price, billing period and minimum quantity shown at sign-up or in a written order form part of the agreement. Fees are charged in advance through Stripe. The subscription renews automatically for the same billing period until the Customer cancels it before the next charge date. The Customer authorizes Stripe to charge the saved payment method for each renewal. The next charge date is shown on the Billing page.

If the Customer starts with a free trial, no card is required during the trial. Unless HRStuff has made the trial ongoing, ordinary access pauses at the recorded trial end. Where a Stripe subscription is linked, Stripe issues the invoice for continued monthly service. Full access resumes only after Stripe confirms that invoice is paid. Otherwise, the Customer must contact HRStuff to arrange continued access.

The first payment uses the quantity confirmed at sign-up. After that, the billable quantity is at least three and otherwise counts active employee records, whether or not the employee has logged in. Before additional employees are activated, HRStuff shows the administrator the new paid headcount and the amount Stripe will charge for the rest of the current billing period. The extra employees remain pending unless that payment succeeds.

When active employee records are made inactive, the lower quantity applies at the next renewal without a mid-period refund or credit. Changes between the Monthly and Yearly Plans also take effect at the next renewal without mid-period proration or credit.

An authorized Customer administrator may cancel through the Billing page and Stripe's secure customer portal. Cancellation takes effect at the end of the current paid billing period. The Customer may continue using the service until then, and no further renewal will be charged. Cancellation does not remove amounts already due.

Paid fees are non-refundable except where applicable law requires a refund or HRStuff confirms a billing error. HRStuff does not give a refund or credit for an unused part of a billing period, a mid-period cancellation, a reduction in billable employees, or a plan change. A suspected billing error should be reported promptly through the Contact page or to info@hrstuff.io.

If a monthly or yearly renewal payment fails, Stripe may retry it and HRStuff may ask the Customer to update the payment method. If Stripe then cancels the subscription for that unresolved payment failure, employee, manager and Assistant Administrator access pauses. A full HR Administrator may still sign in to Billing, support and essential account pages to recover the subscription.

Recovery keeps the previous plan and uses the current billable headcount, subject to the minimum quantity. Because the service period began on the first unpaid date, Stripe may charge from that date rather than begin a new billing period on the recovery date. Full access resumes only after Stripe confirms that the replacement subscription is active and its first invoice is paid. Voluntary cancellation, company deletion and an unresolved cancellation reason are reviewed separately and do not automatically use this payment-lapse restriction.

The Customer must pay applicable taxes. We will give reasonable advance notice of a price change that affects a future renewal period.

8. Ownership and feedback

HRStuff and its licensors own the service, software, design, documentation, trade marks and related intellectual property. These Terms give the Customer a limited, non-exclusive, non-transferable right to use the service during its subscription. If you provide suggestions, we may use them without restriction or payment, but we will not identify you publicly without permission.

9. Service providers and third-party services

We may use reputable service providers for hosting, databases, communications and other infrastructure. A third-party service that the Customer chooses to connect to HRStuff is governed by that provider’s terms. We are not responsible for a third party’s service, but we remain responsible for our own obligations when we appoint a provider to process data for us.

When the Customer enables an integration, it instructs HRStuff to send the selected event or calendar information to that destination. The Customer is responsible for choosing appropriate destinations and recipients, protecting private calendar links and webhook addresses, and disconnecting access that is no longer needed.

10. Availability, support and security

We will use reasonable care and skill to operate the service and reasonable technical and organizational measures to protect it. Internet and software services can still be interrupted or contain faults. Unless a separate written service-level agreement says otherwise, HRStuff does not promise uninterrupted availability or a particular response or recovery time. Support explains how the software works; it does not provide legal, tax, payroll, accounting or compliance advice.

11. Suspension and termination

We may suspend access where reasonably necessary to address a security risk, unlawful use, material breach, non-payment, or harm to the service or another person. Where practicable, we will explain the reason and allow a reasonable opportunity to correct it. The Customer may cancel its subscription as described in section 7. We may end the service for a material breach that is not corrected within a reasonable time, or where continuing the service would be unlawful. Before access ends, the Customer should export records it must retain.

After termination, return and deletion of personal data are governed by the Customer’s choice under the DPA and applicable law. Provisions that by their nature should continue, including ownership, confidentiality, accrued payment obligations, liability and dispute provisions, survive termination.

12. Confidentiality

Each party must protect the other’s non-public information with reasonable care and use it only for the agreement. This does not cover information that is already public without breach, was lawfully known without restriction, was independently developed, or was lawfully received from another source. A party may disclose information where law requires it, after giving notice when legally permitted.

13. Warranties and responsibility for results

HRStuff will provide the service with reasonable care and skill. Except for that promise and rights that cannot lawfully be excluded, the service is provided without additional warranties. We do not warrant that Customer-entered rules are legally correct, that an output satisfies a particular authority, or that the service is suitable for every country or circumstance.

HRStuff is not responsible for an incorrect result caused by inaccurate or incomplete Customer Data, Customer-configured rules, unauthorized use, failure to review an output, or instructions contrary to our documentation, except to the extent that HRStuff caused or contributed to the loss.

14. Liability

Nothing in these Terms excludes or limits liability for fraud, fraudulent misrepresentation, wilful misconduct, death or personal injury caused by negligence, or any other liability that law does not allow to be excluded or limited.

Subject to that sentence and to any different limit in a signed agreement, neither party is liable for indirect or consequential loss, or for loss of profit, revenue, goodwill or anticipated savings that was not reasonably foreseeable when the agreement was made. HRStuff’s total aggregate liability arising from or relating to the service is limited to the fees the Customer paid for its most recent paid month of service before the event giving rise to the claim. If the Customer is billed yearly, this limit is one-twelfth of the yearly fees paid for the subscription year in which the event occurred. This limit does not reduce any mandatory statutory remedy.

15. Changes to these Terms

We may update these Terms for legal, security or service changes. We will identify the effective date and give reasonable notice of a material change. If a material change is unacceptable, the Customer may stop using the service before it takes effect, subject to any existing order and mandatory law.

16. General

If a provision cannot be enforced, the remaining provisions continue. A delay in enforcing a right is not a waiver. The Customer may not transfer the agreement without our consent, except as part of a genuine sale or reorganization of its business. We may transfer it as part of a sale or reorganization of HRStuff if the transfer does not materially reduce the Customer’s rights.

The governing law and courts are those stated in a written order or separate agreement. If none is stated, applicable conflict-of-laws rules determine the governing law and forum. Mandatory rights and the jurisdiction of a competent regulator are not affected.

17. Contact

Questions about these Terms may be sent through the Contact page or to info@hrstuff.io.

18. Data Processing Agreement (DPA)

This DPA forms part of the Terms between Clearworks Pte. Ltd., the Singapore company operating HRStuff, and the Customer identified in the account or applicable order. Accepting the Terms includes accepting this DPA; a separate signature is not required for that electronic acceptance. An existing Customer must accept this version or otherwise validly agree to its incorporation under the parties’ agreement. Earlier acceptance records are not treated as acceptance of wording that did not then exist.

18.1 Scope and roles. “Customer Personal Data” means personal data within Customer Data that HRStuff processes on the Customer’s behalf. The Customer is the controller or equivalent responsible organization; HRStuff is its processor or data intermediary. If the Customer is itself a processor, it confirms that its controller has authorized these instructions and HRStuff’s appointment. “Data Protection Law” means the Singapore Personal Data Protection Act, the EU General Data Protection Regulation (GDPR), the UK GDPR and other personal-data protection laws to the extent they apply to the relevant processing. HRStuff’s separate controller activities, including its own billing administration and public enquiries, are described in the Privacy Notice. This distinction does not authorize HRStuff to repurpose Customer workforce records for its own advertising.

18.2 Processing description and duration. The subject matter is providing the HRStuff services selected by the Customer: workforce administration, leave, claims, payroll calculations, payslips, reports, support and enabled integrations. Processing includes receiving, recording, organizing, storing, retrieving, calculating, displaying, exporting, transmitting, backing up, correcting and deleting information. It continues while those processing services are provided and for the limited period needed to carry out the Customer’s return or deletion instructions under section 18.10.

Data subjects may include current and former workers, applicants entered by the Customer, account users, dependants, emergency contacts, claimants, approvers and people mentioned in Customer documents or communications. Data may include identity and contact details, government identifiers, employment and demographic information, salary and bank details, payroll calculations, leave and claim records, uploaded files, communications, access permissions and activity records. Depending on the Customer’s configuration and submissions, it may include health or disability information, race, religion and other special-category or sensitive data. The Customer determines which fields and records are necessary and establishes the required legal basis and any special-category condition. Accepting this DPA does not itself provide an employee’s consent or another legal basis.

18.3 Instructions and permitted use. HRStuff will process Customer Personal Data only on the Customer’s documented instructions, including the Terms, this DPA, the applicable order, authorized account settings and requests from authorized Customer representatives. This includes instructions about disclosures and international transfers, subject to section 18.8. HRStuff will not sell Customer Personal Data, use it for third-party advertising or disclose it for purposes unrelated to those instructions. The Customer remains responsible for the lawfulness, accuracy, necessity and content of its instructions and for notices to individuals.

If HRStuff considers an instruction to infringe Data Protection Law, it will immediately inform the Customer and may pause the affected processing while the issue is resolved. Processing required by law will be handled only as permitted by Data Protection Law, including the limits in GDPR Article 28(3)(a) where applicable. HRStuff will inform the Customer before legally required processing unless that law prohibits notice on important grounds of public interest. A third-country demand does not by itself replace any safeguard required for a restricted international transfer.

18.4 Confidentiality and access. HRStuff will ensure that people authorized to process Customer Personal Data are bound by confidentiality commitments or an appropriate statutory confidentiality obligation. Access will be limited to what is needed for their duties. Customer users receive access according to the Customer’s roles and permissions. HRStuff’s in-application customer support access is read-only, reason-based, time-limited and recorded; necessary infrastructure access remains subject to access restrictions and confidentiality.

18.5 Technical and organizational security measures. HRStuff will maintain measures appropriate to the risks and required by Data Protection Law, including GDPR Article 32 where applicable. The assessment takes account of the nature, scope, context and purposes of processing, the state of the art, implementation costs and risks to individuals. Measures include:

• role-based permissions, separation between customer organizations, protected login sessions, salted password hashing and restricted administrative access;
• production HTTPS and protected provider connections, private file storage, application-level encryption of identity and bank-account numbers, and separately encrypted company backup archives;
• protection of credentials and encryption keys, request-forgery protection, validation of uploaded files and bounded processing of files and requests;
• activity records, controlled support access, incident handling and secure deletion processes;
• measures to preserve confidentiality, integrity, availability and resilience, restore access after incidents and regularly assess and test the effectiveness of relevant security and recovery controls.

HRStuff may improve or replace individual controls while maintaining an appropriate overall level of protection. The Customer manages its users, permissions, devices, exports, selected recipients and integration destinations. These allocations do not remove either party’s own legal duties. No certification or audit standard is implied unless it is expressly identified in a separate written agreement.

18.6 Subprocessors. The Customer gives general written authorization for HRStuff to use the subprocessors identified below to provide their stated functions. HRStuff will bind each appointed subprocessor to data-protection obligations equivalent to those required of HRStuff for the work it performs, including appropriate security and confidentiality. HRStuff remains responsible to the Customer for the performance of its subprocessors’ data-protection obligations.

• Render: application and PostgreSQL hosting in Singapore, including related infrastructure and recovery services.
• Cloudflare: private R2 storage of receipts, documents and encrypted company backups. Storage locations depend on the bucket configuration; a location hint is not a guarantee of Singapore-only storage.
• Resend: transactional email delivery, including employee and administrator messages where enabled; processing is primarily in the United States.

Before adding or replacing a subprocessor for Customer Personal Data, HRStuff will give at least 30 days’ advance notice to the Customer’s administrator email address on record, identifying the proposed provider, function and relevant processing location. The Customer may object during that period on reasonable data-protection grounds by contacting info@hrstuff.io. The parties will seek a suitable alternative or resolution. HRStuff will not begin the affected processing with the proposed subprocessor while such an objection remains unresolved; affected processing may instead be suspended or ended under the Terms and applicable law.

Providers appointed directly by the Customer, such as a selected Slack, Teams, Telegram, Zapier, Make or calendar destination, are governed by the Customer’s arrangements with those providers to the extent they act independently of HRStuff’s appointment. This does not exclude any provider HRStuff itself appoints from this section. Stripe’s handling of subscription and payment information for HRStuff’s own billing purposes is described separately in the Privacy Notice.

18.7 Assistance with individual rights. Taking account of the nature of processing, HRStuff will assist the Customer through appropriate technical and organizational measures, insofar as possible, with applicable requests to access, correct, restrict, erase, object to or receive portable Customer Personal Data. If HRStuff receives a request about Customer-controlled records directly, it will inform the Customer without undue delay unless legally prohibited and will not decide the request on the Customer’s behalf without authorization or a legal requirement. The parties will verify identity and authority and protect other individuals’ information.

18.8 International transfers. The processing locations described above and in the Privacy Notice do not remove transfer restrictions imposed by Data Protection Law. HRStuff will maintain the applicable safeguards for transfers it carries out, including comparable protection where required by Singapore law. For a restricted EU/EEA or UK transfer, section 19 incorporates the applicable EU Standard Contractual Clauses and UK Addendum where those instruments can lawfully be used. The parties must complete the required particulars, annexes and assessments and implement necessary supplementary safeguards before the affected processing begins, or establish another legally valid transfer mechanism.

The incorporated instruments do not represent that Singapore has an EU or UK adequacy decision. An advertising-cookie choice, a Customer instruction or acceptance of the Terms does not replace a required transfer assessment or missing safeguards. Until the required arrangements are in place, the Customer must not submit the affected data and HRStuff will not carry out the affected restricted processing. Each party will assist the other with the information needed to establish and assess lawful transfers.

18.9 Breaches and regulatory assistance. HRStuff will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data. It will provide available information about the nature of the breach, affected data and individuals, likely consequences, contact point, containment and remedial measures, and further information as it becomes available. Initial notice will not be delayed solely because the investigation is incomplete.

Taking account of the nature of processing and information available to it, HRStuff will assist the Customer with security obligations, breach assessment and notifications, data protection impact assessments and prior consultation with regulators, including GDPR Articles 32 to 36 where applicable. The Customer determines and makes its required notifications unless the parties agree otherwise in writing; HRStuff remains responsible for any notification or cooperation duty imposed directly on it by law.

18.10 Return, deletion and remaining copies. At the Customer’s choice, HRStuff will return or delete Customer Personal Data after the end of the relevant processing services and delete its existing copies, except where retention is required by law as permitted by Data Protection Law. The Customer may request a secure export through an authorized administrator or info@hrstuff.io and should arrange the return before confirming permanent deletion. HRStuff will reasonably assist with return requests and will not treat a request for return as permission to destroy the only available copy.

Cancelling billing is separate from instructing permanent account deletion. Any storage while return or closure is being arranged remains subject to documented instructions, purpose limitation and the applicable retention requirements. Once company deletion is confirmed, live records are removed and app-managed backup archives are blocked from download or restore and queued for removal, normally within a 24-hour completion target. Removal failures are retried and reported to platform administrators; the target is not an unconditional guarantee.

Where immediate removal from hosting-provider infrastructure snapshots is not technically possible, remaining copies must be kept beyond ordinary use and expire under a documented, justified retention schedule. HRStuff will provide available retention details on request and ensure that recovery procedures reapply deletions before restored data is made available. Backups are not a basis for indefinite retention. Any legally required retention must be limited to the data, purpose and period required, with protection maintained and other use prohibited. On request, HRStuff will provide reasonable confirmation of completed return or deletion.

18.11 Compliance information and audits. HRStuff will make available information needed to demonstrate compliance with this DPA and applicable processor obligations, and will allow and contribute to audits, including inspections, by the Customer or an auditor it appoints. The parties will first use relevant existing documentation where that can meet the need. Reasonable notice, confidentiality, security arrangements and protection of other customers’ data may be agreed, but must not prevent an audit required by law or a competent regulator. Urgent incidents or reasonable evidence of non-compliance may require expedited arrangements.

18.12 Priority, contact and continuing duties. If this DPA conflicts with another part of the Terms about processing Customer Personal Data, this DPA prevails. A binding international-transfer instrument prevails to the extent required by that instrument. Commercial terms otherwise continue to apply, subject to mandatory law; nothing limits individuals’ statutory rights, regulatory powers or obligations that cannot lawfully be excluded. Confidentiality, protection, assistance and deletion obligations continue for as long as HRStuff retains Customer Personal Data. Send DPA instructions, objections and privacy enquiries to info@hrstuff.io.

19. International Transfer Addendum

This addendum forms part of the DPA in section 18. It addresses transfers of Customer Personal Data from the Customer to Clearworks Pte. Ltd. operating HRStuff. It does not cover HRStuff's separate controller activities or replace the safeguards required for onward transfers to subprocessors. Section 19.7 applies before the parties rely on these arrangements for a restricted transfer.

19.1 EU/EEA transfer clauses. Where a transfer requires safeguards under GDPR Article 46, falls within the permitted scope of the clauses below and is not covered by another valid transfer mechanism agreed by the parties, the Standard Contractual Clauses in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the “EU SCCs”) are incorporated by reference in full into this agreement, with the applicable module, options and appendix information specified here. Their approved wording is not otherwise amended.

Module Two (controller to processor) applies when the Customer is a controller. Module Three (processor to processor) applies when the Customer is a processor engaging HRStuff as its subprocessor with the relevant controller's authorization. Only the module appropriate to the actual transfer applies. These EU SCCs are not represented as a valid mechanism for a transfer outside their legal scope, including where the relevant processing by the importer is already directly subject to the GDPR and these clauses cannot lawfully be used for that transfer.

19.2 Selected EU SCC options. For the applicable module:

• the optional docking clause in Clause 7 is not included;
• Clause 9(a), Option 2 (general written authorization), applies with at least 30 days' advance notice of an intended addition or replacement, as described in section 18.6;
• the optional independent dispute-resolution provision in Clause 11(a) is not included; the remaining redress provisions apply;
• Clause 17, Option 1, selects the law of Ireland; and
• Clause 18(b) selects the courts of Ireland, without restricting an individual's rights to bring proceedings in another court permitted by the EU SCCs.

19.3 Annex I.A — parties and acceptance. The data exporter is the Customer identified by its full legal name and relevant contact particulars in the applicable account, billing record, order or other agreed written particulars. Its contact is the authorized Customer administrator or its separately designated privacy contact. Its role is controller under Module Two or processor under Module Three. Its relevant activity is using HRStuff for the workforce processing described in section 18.2.

The data importer is Clearworks Pte. Ltd., trading as HRStuff, in Singapore. Its privacy contact is info@hrstuff.io. It acts as processor under Module Two or subprocessor under Module Three to provide those services. The parties agree that their legally binding electronic acceptance of this agreement also executes the incorporated EU SCCs, including Annex I.A. The applicable date is the date of that acceptance or a separately recorded written agreement. This does not treat an earlier acceptance as agreement to a later version. Required party particulars not already recorded must be completed under section 19.7.

19.4 Annex I.B — description of transfers. The data subjects, categories of personal data, processing operations, purposes and subject matter are those described in section 18.2 for the services and settings the Customer actually selects. Transfers occur on an ongoing basis as the Customer and its users use those services, including scheduled processing, authorized support and backups. The destination is HRStuff's processing in Singapore, with onward processing by the subprocessors described in section 18.6 subject to the applicable onward-transfer requirements. Processing duration and retention follow sections 18.2 and 18.10.

Where sensitive or special-category data is submitted, the safeguards include Customer-controlled permissions, separation between customer organizations, private file storage, encryption of identity and bank-account numbers, encrypted company backup archives and controlled support access, as described in sections 18.4 and 18.5. The Customer must limit submissions and access to what is necessary and lawful. Any additional restrictions or safeguards required for the particular sensitive-data transfer must be documented and implemented before that transfer.

19.5 Annex I.C, Annex II and subprocessors. The competent supervisory authority for Annex I.C is determined under Clause 13: the authority responsible for the Customer's relevant establishment, its applicable Article 27 representative, or, where the Clause 13 conditions permit, an authority in a Member State where affected individuals are located. The parties must identify the applicable authority in their transfer particulars before relying on the EU SCCs.

For Annex II, the technical and organizational measures are those described in sections 18.4 and 18.5, including access controls, tenant separation, protected sessions, password hashing, production HTTPS, protected provider connections, private storage, field and backup encryption, key protection, validation, activity records, controlled support access, recovery and security testing. Sections 18.7, 18.9, 18.10 and 18.11 describe the measures and procedures for assisting with rights requests, incidents, assessments, return, deletion and audits. These descriptions must be supplemented with the specific measures needed for the actual transfer under section 19.7; no unverified certification, storage location or end-to-end encryption guarantee is implied.

The authorized subprocessor list and functions are in section 18.6. Annex III is not required for the selected general-authorization option; the subprocessor information, notice, objection and onward-transfer obligations still apply. A provider's agreement with HRStuff does not itself replace the safeguards for the Customer's transfer to HRStuff.

19.6 UK transfers. For a restricted transfer subject to UK GDPR, where these arrangements are a legally available safeguard and no other valid mechanism agreed by the parties covers it, the ICO International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, in force 21 March 2022 (the “UK Addendum”), including its Part 2 Mandatory Clauses as revised under its Section 18, is incorporated by reference. The EU SCCs specified above form the Addendum EU SCCs with the following Part 1 entries:

• Table 1: the parties, roles, key contacts and acceptance are as described in section 19.3, supplemented with the required party particulars. The start date is the date the parties validly agree to the UK Addendum.
• Table 2: the EU SCCs identified in section 19.1 apply with Module Two or Three according to the actual roles and the options in section 19.2.
• Table 3: the appendix information is in sections 19.3 to 19.5 and any required agreed transfer particulars and supplementary measures.
• Table 4: both the importer and exporter may end the UK Addendum under its Section 19 when the conditions in that section are met.

The Mandatory Clauses make the required UK adaptations, including the ICO as the competent authority and the laws and courts of England and Wales, subject to the rights preserved by the UK Addendum. They govern any conflict as specified in their hierarchy provisions. The parties must complete the applicable UK transfer risk assessment and any necessary additional protections before relying on this safeguard.

19.7 Preconditions, assessment and continuing protection. Inclusion of the standard instruments does not certify that all required party particulars, transfer-specific appendix information, provider arrangements or assessments are already complete. Before the affected restricted processing begins, the parties must complete and agree the required particulars, document the applicable transfer assessment, and implement any necessary supplementary safeguards. Existing account, billing and order information may be used where accurate and sufficient. Missing information can be completed through the existing privacy contact; a new sign-up form or a separate paper signature is not required merely by this addendum.

The assessment must address the particular transfer, relevant destination-country laws and practices, access by public authorities and the effectiveness of the actual protections. The parties will provide necessary information, keep the assessment under review and respond to changes affecting protection. Until the required arrangements are in place, the Customer must not submit the affected data and HRStuff will not carry out the affected restricted processing. If the required protection cannot be maintained, the affected transfers must be suspended or ended as required by the applicable instrument. Acceptance of these Terms alone does not complete that assessment or establish that a country has adequate protection.

19.8 Priority and enforceable rights. The applicable EU SCCs and UK Addendum prevail as required by their own hierarchy provisions, including over conflicting governing-law, forum, audit and liability provisions elsewhere in the Terms or DPA. No commercial limitation excludes or restricts rights or liabilities that cannot be limited under those instruments. Nothing here removes data subjects' third-party beneficiary rights or the powers of a competent regulator.