Data processing agreement

In effect from 1 October 2026.

This agreement governs our processing of personal data on your behalf. It forms part of the terms of service and applies automatically from the moment your account is created — you do not need to ask us for it or sign it separately. If your organisation requires a signed counterpart, write to trust@smplr.co.uk and we will provide one on these terms.

In this agreement, "you" are the controller and Smplr LTD is the processor. "UK GDPR" means the UK General Data Protection Regulation and the Data Protection Act 2018.

1. Subject matter and duration

We process personal data so that we can provide smplr to you. The processing lasts as long as your account does, plus the short wind-down period in clause 9.

2. Nature and purpose

Hosting, storing, organising, displaying, transmitting, analysing, backing up and — where you have configured it — anonymising or deleting employee personal data, so that you can administer leave and sickness absence, employee records, contracts and their signature, onboarding and offboarding, policies, right-to-work, probation and qualification checks, objectives, one-to-ones and reviews, equality monitoring, your month-end payroll pack, and reporting.

Where you buy HR Services from us, we also process the personal data that work needs, for that work only. The HR Services terms of business shown with each quote describe the work itself.

3. Categories of data subject

Your employees, workers, contractors, job candidates you invite into the system, the individuals you nominate as account administrators, and outside advisers you invite, such as your accountant. Where you record them, also your staff's emergency contacts.

4. Types of personal data

As set out in Annex A.

5. Our obligations

We will:

Process personal data only on your documented instructions, including on transfers, unless we are required to do otherwise by law — in which case we will tell you first unless the law prohibits it. Your use of smplr, and these terms, are your documented instructions.
Ensure that everyone we authorise to process the data is under a duty of confidentiality.
Implement the technical and organisational measures in Annex B, as required by Article 32.
Engage sub-processors only in accordance with clause 6.
Taking into account the nature of the processing, assist you with responding to data subjects exercising their rights, by providing the features in smplr that let you find, export, correct, anonymise and delete a person's record, and by helping you directly where those are not enough.
Assist you with your obligations under Articles 32 to 36 — security, breach notification, data protection impact assessments and prior consultation — taking into account the nature of processing and the information available to us.
Notify you without undue delay, and in any event within 24 hours, after becoming aware of a personal data breach affecting your data, with the information we have, and update you as we learn more.
Delete or return the data at the end, as set out in clause 9.
Make available the information necessary to demonstrate compliance with Article 28 and allow for audits, as set out in clause 10.
Tell you promptly if, in our opinion, an instruction you give us would infringe data protection law.

6. Sub-processors

You give us general authorisation to engage sub-processors. The current list is published at smplr's sub-processors page, and it is the authoritative list.

Before we add or replace one, we will give you at least 30 days' notice by email to your account administrators. If you reasonably object on data protection grounds within that period, tell us and we will work with you to find a solution; if we cannot, you may terminate the affected part of the service without penalty and we will refund fees for any period paid for and not used.

We impose data protection obligations on every sub-processor that are no less protective than those in this agreement, and we remain fully liable to you for their performance.

7. International transfers

We do not transfer your data outside the UK except as recorded on the sub-processors page. Where a transfer does occur, it is covered by UK adequacy regulations or by the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.

8. Your obligations

You warrant that you have a lawful basis for the personal data you put into smplr, that where it includes special category data — sickness and other health data in particular — you have identified an Article 9 condition, that you have given your staff the information Articles 13 and 14 require, and that your instructions to us comply with data protection law.

9. Deletion and return

On termination, and at your choice, we will return your data or delete it.

For 30 days after your account closes we retain it so that you can request a complete export. After that period we delete it from live systems within 30 days, and it ages out of encrypted backups within a further 90 days. We will confirm deletion in writing on request.

We will keep data for longer only where UK law requires it, and only for as long as it requires.

What automatic anonymisation does and does not clear. A leaver's record is anonymised once it reaches the retention period published in our privacy policy, counted from the day their access ends. Anonymising clears their sign-in, contact details, home address, emergency contacts, date of birth, National Insurance number, nationality, job title, pay and gender; deletes their salary history and any equality monitoring answers; and redacts the values in their audit history, leaving only which field changed, when and by whom. Their employment dates, department, location, working hours and reason for leaving are kept, so your headcount and turnover history still add up.

Three things are deliberately kept: right-to-work evidence, because UK employers must retain it for a statutory period that can outlive the retention period; free-text absence and probation notes, because they are the record you would need to defend a disability discrimination or unfair dismissal claim — brought, as a rule, by the very people whose records would otherwise have been wiped; and signed contracts and reviews, with the typed name, time and fingerprint of each signature, because they are your evidence of what was agreed. The signature loses the IP address and browser it was made from.

A leaver who managed people. What a leaver wrote about somebody still employed is kept, with the leaver's name removed from it: objective and one-to-one notes, the manager's half of a review, and their name as the person who made a change on somebody's record. Those entries are the remaining employee's record as much as the leaver's, and deleting them would erase a team's performance history because one person left.

Everything kept is encrypted at rest and reachable only with the permission that already governs employee detail. If your own assessment says a note should go, clear it before the retention sweep runs — deleting your evidence for you is not a decision we will make on your behalf.

10. Audit

We will make available the information reasonably necessary to demonstrate compliance with this agreement, and respond to reasonable security questionnaires, at no charge and within 30 days.

You may audit our compliance no more than once a year, on 30 days' written notice, during business hours, without unreasonably disrupting our business, and subject to confidentiality. If an audit requires more than two working days of our time, we may charge our reasonable costs. Where a supervisory authority requires an audit, these limits do not apply.

11. Liability

Liability under this agreement is subject to the limitations in the terms of service.

Annex A — Details of the processing

Categories of personal data. Which of these apply depends on the parts of smplr you use:

Identity and contact: name, preferred name and pronouns, work email, personal email and phone number where you record them, home address, date of birth, National Insurance number and nationality; emergency contacts and their relationship to the person.
Employment: job title, department, manager, employment type, working pattern and hours, start date, continuous service date, notice period, leaving date, reason and destination, probation dates and outcomes, and qualifications with their expiry dates.
Leave: leave requests and their dates, types, statuses, approvers and balances; sickness absence records, including category.
Documents: contracts, offer letters, policies, and any other file you or your staff upload, together with e-signature records.
Compliance: right-to-work check outcomes, document types, expiry dates; policy acknowledgements and their versions and timestamps.
Performance: objectives and the notes written against them; one-to-one agendas, dates and notes, including notes drafted and not yet shared; review answers written by the employee and by their manager, earlier versions of a review that was reopened, and what the employee said when they signed it off.
Pay: pay rate, pay frequency and salary history; and gender, which the gender pay gap and equal pay reports rely on. A month-end pack for your accountant draws pay, starters, leavers, sickness days and unpaid leave from these.
Equality monitoring: ethnicity, disability, religion, sexual orientation and gender identity, entered only by the person themselves, with the time they consented and the version of the statement they agreed to.
HR Services: requests you make of our HR team, and the correspondence and documents that go with them.
Calendar feeds: who is away and when, in a feed a person can add to their own calendar app, limited to the people they can already see in smplr. Sickness is never included.
System: sign-in timestamps, IP addresses, and the audit trail of changes to a person's record.

Special category data. Sickness absence records are data concerning health, and equality monitoring answers reveal racial or ethnic origin, religious belief, health and sexual orientation (Article 9(1)). You are responsible for identifying the Article 9 condition you rely on for each. Gender, used for pay gap reporting, is not special category data in itself but is treated with the same protections.

Equality monitoring answers are protected beyond the rest. Only the person can enter or change their own, the product shows no one else what one person said, aggregate figures are withheld whole when the group is small enough to identify someone, and withdrawing consent deletes the answers. Their changes are deliberately not written to the audit trail, because the existence of an entry would itself disclose that someone had answered.

Frequency. Continuous, for as long as your account is open.

Annex B — Technical and organisational measures

These are the measures in place, as required by Article 32:

Measure	What is actually done
Encryption in transit	TLS on every connection, HSTS enforced, no plaintext fallback
Encryption at rest	Personal data fields encrypted in the database with keys held and backed up separately from it; backups encrypted
Tenant separation	Per-customer subdomain; every database query bound to one organisation; a session is valid only on the organisation it was issued for
Access control	Access to an existing customer's organisation is by invitation only — nobody can add themselves to one; role-based permissions, explicit grants, and management-chain scoping within an account
Authentication	Passwords hashed with bcrypt; sign-in throttled and locked out after repeated failures; two-factor authentication available to every user and required for accounts that can reach every record in an organisation
Our own access	Restricted to named personnel, only for support you have requested, fault investigation, or where law requires; every access recorded
Auditability	Changes to a person's record recorded automatically — field, old and new value, actor and timestamp
Resilience	Automated database backups with point-in-time recovery; restores rehearsed; continuous health and uptime monitoring with alerting
Secure development	Automated dependency vulnerability scanning and static security analysis on every change, blocking release on a finding
Logging hygiene	Personal data filtered out of application logs and error reports before they leave the system

Annex C — Sub-processors

The current list, with each sub-processor's purpose and location, is published at smplr's sub-processors page and forms part of this annex.