Data Processing Addendum

1. Definitions

Terms such as personal data, processing, controller, processor, data subject and personal data breach have the meanings given in the applicable data protection laws, such as the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended (CCPA) and similar laws (together, “Data Protection Laws”). “Customer Personal Data” means personal data in Customer Data that we process on your behalf when providing the Service. Other capitalised terms have the meanings given in the Terms of Service.

2. Subject matter, duration, nature and purpose

Subject matter

Providing the BMS Prime Service to you under the Terms of Service.

Duration

For as long as we provide the Service, and afterwards until Customer Personal Data is deleted or returned under section 10.

Nature of processing

Hosting, storage, backup, retrieval, calculation (for example of payroll, attendance and accounts), display, transmission (for example email and push notifications you trigger), export and deletion.

Purpose

Solely to provide, secure and support the Service for you, as instructed by you through your use and configuration of the Service, and as set out in this DPA.

3. Categories of data subjects and personal data

You decide what personal data to put into the Service. Typically it covers:

• Data subjects: your employees, former employees, job applicants and contractors; your Authorised Users; your customers, vendors and their contact persons.
• Personal data: identification and contact details; employment details such as position, department, dates, contracts, documents and their expiry dates; pay, allowances, deductions, provident fund, loans, tax and bank account details; attendance punches, working hours, leave and medical allowance balances; training and test results, including any test camera snapshots you choose to require; appraisals and HR letters; invoices, payments and other business records that name individuals; and audit-log records of user actions.
• Special categories: the Service is not designed for special categories of personal data (such as health or biometric data). Do not store such data unless you have a lawful basis to do so and it is necessary, for example a medical leave certificate. You are responsible for that decision. Biometric attendance devices send us punch times, not fingerprints or face templates.

4. Your instructions

We process Customer Personal Data only on your documented instructions. The Terms of Service, this DPA and your use and configuration of the Service are your complete instructions. We process it otherwise only where the law requires us to, and in that case we tell you first, unless the law forbids it. We tell you if we believe an instruction breaks Data Protection Laws. You confirm that you have a lawful basis for the processing and have given any notices required to your data subjects.

5. Our obligations

• Confidentiality: everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality.
• No other use: we do not sell Customer Personal Data, do not use it for advertising, and do not use or combine it for any purpose other than providing the Service to you. Where the CCPA applies, we act as your service provider and do not retain, use or disclose it outside our direct business relationship with you.
• Assistance: taking into account the nature of the processing, we help you, by appropriate technical and organisational measures, to answer data subjects’ requests to exercise their rights, including through the Service’s own tools to view, correct, export and delete records. If a data subject contacts us directly, we refer them to you.
• Compliance support: we give you reasonable help with data protection impact assessments and consultations with authorities, as far as they relate to the Service and the information is available to us.

6. Subprocessors

You give general authorisation for us to use subprocessors. The current list is in our Privacy Policy. We bind every subprocessor by written contract to data protection obligations no less protective than those in this DPA, and we remain responsible for its performance.

We update the list before a new subprocessor starts processing Customer Personal Data. If you ask us to, we will also email you about changes. You may object on reasonable data protection grounds within 30 days of the update. We will then discuss the objection in good faith; if we cannot resolve it, you may terminate the affected Service, and we will refund any prepaid fees for the period after termination.

7. Security

We implement appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. They include separating each customer’s data, role-based permissions checked on the server for every request, encryption in transit, password hashing, two-step sign-in, audit logging, monitoring and tested backups, as described on our Security page. We may update these measures over time, provided they do not reduce the overall level of protection.

8. Personal data breaches

We notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We notify the administrators of your workspace by email. The notice describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We add information as it becomes available, take reasonable steps to contain and remedy the breach, and help you meet your own obligations to notify authorities and data subjects. Notifying you is not an admission of fault.

9. International transfers

We and our subprocessors may process Customer Personal Data outside your country. Where Data Protection Laws require a transfer mechanism, such as for transfers out of the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the Standard Contractual Clauses approved by the European Commission (with the UK addendum where relevant) apply and are incorporated by reference, with you as data exporter and us as data importer, using module two (controller to processor) or module three (processor to processor) as applicable.

10. Deletion and return

You can export Customer Personal Data at any time during the subscription using the Service’s export and backup tools. After the Service ends, we keep the data for 30 days so that an export can be requested, then delete it from our live systems within a further 30 days. Backup copies are overwritten in the normal backup cycle, normally within 90 days. We may keep data for longer only where the law requires it, and then only as required, protected under this DPA.

11. Audits

On written request, and no more than once a year (or after a personal data breach or at an authority’s request), we provide the information reasonably necessary to demonstrate our compliance with this DPA, in the form of written answers to your security questionnaire and relevant documentation of our measures. If that information is not sufficient to show compliance under Data Protection Laws, we will discuss with you in good faith any further reasonable steps, at your cost, on reasonable notice, during business hours, without access to other customers’ data and subject to confidentiality.

12. Liability and precedence

Each party’s liability under this DPA is subject to the limitations and exclusions of the Terms of Service, as far as the law allows. If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses prevail.

13. Contact

Data protection questions and requests about this DPA: info@bmsprime.com.

DPA version 2026-10-22. Last updated: 22 October 2026.