Data Processing Agreement
Review AccoNova HRMS data-processing terms, customer instructions, security measures, subprocessors, incident handling, deletion and audit support.
For customer-controlled employee data, the employer determines the processing purposes and AccoNova provides processing services on its documented instructions. Website enquiries and subscription administration are separate activities described in the Privacy Policy.
Jump to Clause (6 Clauses)
1. Roles and documented instructions
For customer-controlled employee data, the employer determines the processing purposes and AccoNova provides processing services on its documented instructions. Website enquiries and subscription administration are separate activities described in the Privacy Policy.
This public processing summary accompanies the service terms. Any signed customer DPA or order should identify the parties, processing scope, duration and applicable legal obligations.
2. Data and purpose
Depending on enabled workflows, customers may provide employee identity, contact, employment, attendance, leave, payroll, tax identifiers, payment details and uploaded documents. Location or selfie attendance data is relevant only where that workflow is used.
The customer must determine the appropriate notice, lawful basis, collection scope and user permissions. Do not upload unnecessary identity documents or unrelated sensitive information.
3. Confidentiality and safeguards
Access permissions, protected connections and review of account roles help restrict access to employee records. Customers should remove access promptly when duties change or employment ends.
Security measures and any required processing-location disclosures should be agreed through the customer security review. Public pages do not disclose database identifiers, regions or deployment topology.
4. Incidents and assistance
Report suspected unauthorised access promptly through the contact page. Include the affected workspace, approximate time and a description without exposing passwords or employee files.
Incident notification, assistance with requests and audit cooperation follow applicable law and the agreed DPA. This page does not substitute a generic 72-hour promise for the actual obligation.
5. Subprocessors, return and deletion
Request current, relevant subprocessor disclosures for your procurement or data-protection review. Required processing disclosures can be provided through the contractual process without publishing infrastructure secrets.
Before termination, agree an export, return and deletion process with support. Retention depends on the data purpose, customer instructions and applicable obligations; there is no universal 3/5/8-year rule for every record.
6. DPDP Act, 2023 roles and breach
Under the Digital Personal Data Protection Act, 2023, for employee personal data entered by a customer organisation, the customer is the Data Fiduciary and AccoNova acts as the Data Processor on the customer's documented instructions. For website and business-contact data, AccoNova is the Data Fiduciary.
On becoming aware of a personal data breach affecting customer data, AccoNova will notify the affected customer without undue delay and assist with the customer's own obligations. Where AccoNova is the Data Fiduciary, it will notify the Data Protection Board of India and the affected Data Principals as required by the Act.
Customers are responsible for providing a valid consent notice to their employees and for determining the lawful basis, retention and scope of processing.