Data processing arrangements
This page explains the intended roles. It is not a data processing agreement or a substitute for signed customer terms.
Roles
The customer generally acts as controller for employee HR records it enters into BrimHR. DELAXNET LTD provides BrimHR as a processor for those records, acting on documented customer instructions. Each party may be a controller for its own business contacts and account administration.
Customer agreement
Before customer employee data is processed, a written agreement must set out the processing subject, duration, nature, purposes, data categories, controller rights and duties, and the processor commitments required by UK GDPR Article 28. The contract should also address confidentiality, security, subprocessors, assistance with rights and incidents, end-of-service data handling and audits.
Information still to confirm
The current public draft does not specify hosting location, subprocessors, transfer arrangements, retention periods or a final customer data processing agreement. Those details require operational and legal review before customer terms are issued. See subprocessor information.