top of page
2328fd84-508c-497e-8953-64c0954e371e.png

Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of and is incorporated into the Master Services Agreement, Terms of Service, Service Agreement, or other written agreement (the "Agreement") between:

SHS Contracts Ltd, a company incorporated in United Kingdom with registered office at Suite 9, Unit C Transport Way, Cowley, Oxford, England, OX4 6HD ("Processor", "we", "us", or "our"); and

The Customer identified in the Agreement ("Controller", "you", or "your").

This DPA governs the Processing of Personal Data by the Processor on behalf of the Controller in connection with the Services.

1. DEFINITIONS

For the purposes of this DPA:

Applicable Data Protection Laws means all laws and regulations applicable to the Processing of Personal Data, including but not limited to:

  • UK General Data Protection Regulation ("UK GDPR")

  • Data Protection Act 2018

  • EU General Data Protection Regulation (EU) 2016/679 ("EU GDPR")

  • Any national laws implementing or supplementing the GDPR

  • Any successor legislation

Controller means the entity that determines the purposes and means of Processing Personal Data.

Processor means the entity that Processes Personal Data on behalf of the Controller.

Data Subject means an identified or identifiable natural person.

Personal Data shall have the meaning given under Applicable Data Protection Laws.

Processing means any operation performed on Personal Data including collection, recording, storage, organisation, retrieval, use, disclosure, transfer, deletion, or destruction.

Sub-Processor means any third party engaged by the Processor to Process Personal Data on behalf of the Controller.

Personal Data Breach means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data.

Capitalised terms not defined in this DPA shall have the meaning assigned to them in the Agreement.

2. SCOPE AND PURPOSE

2.1 This DPA applies whenever the Processor Processes Personal Data on behalf of the Controller in connection with the Services.

2.2 The Processor shall Process Personal Data solely:

  • For the purpose of providing the Services;

  • In accordance with documented instructions from the Controller;

  • As required by Applicable Law.

2.3 The Controller remains responsible for determining the lawful basis for Processing Personal Data.

3. PROCESSING DETAILS

Subject Matter

Provision of payroll, workforce management, compliance, reporting, payment coordination, employee administration, and related services.

Duration

For the duration of the Agreement and any agreed retention periods.

Nature and Purpose

Processing necessary to:

  • Deliver payroll services

  • Administer employee records

  • Manage statutory filings

  • Produce payroll reports

  • Support workforce management

  • Facilitate compliance activities

  • Provide customer support

Categories of Data Subjects

May include:

  • Employees

  • Contractors

  • Temporary workers

  • Agency workers

  • Job applicants

  • Former employees

  • Authorised customer representatives

Categories of Personal Data

May include:

  • Name

  • Date of birth

  • Contact information

  • Employee ID numbers

  • Payroll information

  • Salary details

  • Tax identifiers

  • National Insurance numbers

  • Banking information

  • Employment information

  • Attendance information

  • Benefits information

  • Pension information

  • Performance-related data

Special Category Data

Where necessary and lawful:

  • Health-related data

  • Trade union information

  • Diversity and equality data

  • Statutory absence information

4. CONTROLLER OBLIGATIONS

The Controller shall:

4.1 Ensure that all Personal Data has been collected and disclosed lawfully.

4.2 Provide all necessary notices to Data Subjects.

4.3 Obtain all necessary consents where required.

4.4 Ensure its instructions comply with Applicable Data Protection Laws.

4.5 Remain responsible for the accuracy, quality, and legality of Personal Data provided.

5. PROCESSOR OBLIGATIONS

The Processor shall:

5.1 Process Personal Data only on documented instructions from the Controller unless required by law.

5.2 Promptly inform the Controller if an instruction appears to violate Applicable Data Protection Laws.

5.3 Maintain records of Processing activities where required by law.

5.4 Ensure that personnel authorised to Process Personal Data:

  • Are subject to confidentiality obligations;

  • Receive appropriate training;

  • Have access only where necessary.

6. SECURITY MEASURES

The Processor shall implement appropriate technical and organisational measures including:

Access Controls

  • Role-based access management

  • Multi-factor authentication where appropriate

  • User access reviews

Data Protection

  • Encryption in transit

  • Encryption at rest where appropriate

  • Secure backups

Infrastructure Security

  • Network monitoring

  • Vulnerability management

  • Security patching

  • Endpoint protection

Operational Security

  • Staff security training

  • Confidentiality obligations

  • Incident management procedures

Physical Security

  • Controlled facility access

  • Environmental safeguards

  • Asset management procedures

The Processor shall regularly review and update security measures.

7. SUB-PROCESSORS

7.1 The Controller authorises the Processor to engage Sub-Processors.

7.2 Current authorised Sub-Processors may include providers of:

  • Cloud hosting

  • Data storage

  • Payment services

  • Security monitoring

  • Customer support platforms

  • Analytics services

7.3 The Processor shall ensure Sub-Processors are subject to contractual obligations substantially equivalent to those contained in this DPA.

7.4 The Processor remains responsible for the performance of its Sub-Processors.

7.5 An up-to-date list of Sub-Processors shall be made available upon request or published on the Processor's website.

8. INTERNATIONAL DATA TRANSFERS

8.1 Personal Data may be transferred internationally where necessary to provide the Services.

8.2 Where transfers occur outside the UK or EEA, the Processor shall ensure appropriate safeguards are implemented, including:

  • UK International Data Transfer Agreement (IDTA)

  • UK Addendum to EU SCCs

  • European Commission Standard Contractual Clauses

  • Adequacy decisions

  • Other lawful transfer mechanisms

8.3 The Processor shall maintain records of such transfer mechanisms where applicable.

9. DATA SUBJECT RIGHTS

The Processor shall assist the Controller, taking into account the nature of Processing, in responding to requests concerning:

  • Access

  • Rectification

  • Erasure

  • Restriction

  • Portability

  • Objection

  • Automated decision-making

Where the Processor receives a request directly from a Data Subject, it shall:

  • Not respond except where legally required;

  • Promptly forward the request to the Controller.

10. PERSONAL DATA BREACHES

10.1 The Processor shall maintain incident response procedures.

10.2 Upon becoming aware of a Personal Data Breach, the Processor shall:

  • Investigate the incident;

  • Take reasonable steps to contain and remediate the breach;

  • Notify the Controller without undue delay.

10.3 Notification shall include, where available:

  • Nature of the breach;

  • Categories of affected individuals;

  • Categories of affected data;

  • Likely consequences;

  • Remediation actions taken.

11. AUDITS

11.1 The Processor shall make available information reasonably necessary to demonstrate compliance with this DPA.

11.2 The Controller may conduct audits:

  • No more than once annually unless required by law or following a security incident;

  • Upon reasonable prior written notice;

  • During normal business hours.

11.3 Audits must not unreasonably interfere with business operations.

11.4 Independent certifications and third-party audit reports may satisfy audit obligations where appropriate.

12. CONFIDENTIALITY

The Processor shall ensure all personnel with access to Personal Data are bound by confidentiality obligations that survive termination of employment or engagement.

13. DATA RETENTION AND DELETION

13.1 Upon termination of the Services, the Processor shall, at the Controller's choice:

  • Return Personal Data; or

  • Securely delete Personal Data.

13.2 The Processor may retain Personal Data where required by law.

13.3 Backup systems may retain archived copies until overwritten in accordance with normal retention cycles.

14. LIABILITY

14.1 Liability under this DPA shall be subject to the limitations of liability contained within the Agreement unless prohibited by Applicable Law.

14.2 Nothing in this DPA excludes liability that cannot lawfully be excluded.

15. GOVERNING LAW

This DPA shall be governed by and construed in accordance with the laws specified in the Agreement.

Where no governing law is specified, this DPA shall be governed by the laws of England and Wales.

APPENDIX 1 – PROCESSING DETAILS

Controller

Customer using the Services.

Processor

SHS Contracts Ltd

Processing Activities

  • Payroll administration

  • Employee record management

  • Tax administration

  • Statutory reporting

  • Workforce management

  • Payment processing support

  • Compliance monitoring

  • Customer support

Data Subjects

  • Employees

  • Contractors

  • Former employees

  • Customer representatives

Personal Data

  • Identification data

  • Contact data

  • Employment data

  • Payroll data

  • Financial data

  • Tax information

  • Benefits information

Special Category Data

Where necessary and legally permitted.

Duration

For the term of the Agreement and any applicable retention period.

APPENDIX 2 – TECHNICAL AND ORGANISATIONAL SECURITY MEASURES

The Processor maintains a security programme that includes:

  • Information security governance

  • Access control policies

  • Encryption standards

  • Backup and recovery procedures

  • Security monitoring

  • Vulnerability management

  • Incident response planning

  • Supplier risk management

  • Staff security awareness training

  • Data retention and destruction controls

  • Business continuity and disaster recovery measures

The Processor may update these measures from time to time provided such changes do not materially reduce the overall level of protection.

bottom of page