This Data Processing Agreement ("DPA") forms part of the PayrollMaster Terms of Service and the customer’s order or subscription. The customer is the "Controller" and Batanai Digital Ventures of 158 Harare Street, Harare, Zimbabwe, operating PayrollMaster, is the "Processor". Capitalised terms relating to personal information have the meaning given by applicable data-protection law.
1. Scope and instructions
The Processor will process employee and authorised-user personal information only to provide, secure, support, back up and improve the contracted PayrollMaster service; comply with the Controller’s documented instructions; or comply with law. The Terms, configured service use, support requests and this DPA constitute documented instructions.
2. Controller obligations
The Controller confirms that it has lawful grounds and authority to collect and instruct processing of the personal information, gives required notices, responds to data subjects, configures appropriate access, and ensures its instructions comply with employment, tax, privacy and other applicable law.
3. Confidentiality and personnel
The Processor will limit access to personnel and contractors who need it to perform the service and who are bound by confidentiality obligations. Access permissions will follow least-privilege and role-based principles.
4. Security measures
The Processor will maintain measures appropriate to the risk, including encrypted network transport, access controls, protected sessions, audit logging, vulnerability and error monitoring, encrypted backups, restoration procedures, tenant separation and incident response. The Controller is responsible for endpoint security, authorised-user conduct and credential protection.
5. Sub-processors
The Controller authorises use of hosting, encrypted backup, email-delivery and payment-service providers needed to operate PayrollMaster. The Processor will require providers that process personal information to protect it consistently with applicable obligations. Material new categories of processing will be communicated where reasonably practicable.
6. Cross-border transfers
Where a provider or backup location is outside Zimbabwe, the parties will assess the transfer and use appropriate contractual, organisational and technical safeguards. The Controller authorises such protected transfers where necessary to provide the service, subject to applicable law.
7. Data-subject requests
The Processor will provide reasonable assistance, taking account of the nature of processing, to enable the Controller to respond to lawful requests for access, correction, deletion, restriction or related rights. If a request concerning Controller data is received directly, it will ordinarily be referred to the Controller.
8. Personal-information incidents
The Processor will notify the Controller without undue delay after confirming an incident affecting Controller personal information and provide available information reasonably needed for assessment, containment and notification. The Controller determines and performs notifications required of it as data controller.
9. Assistance and compliance information
The Processor will provide information reasonably necessary to demonstrate compliance with this DPA and cooperate with proportionate assessments. Reviews must protect other customers, security controls and confidential information and must not unreasonably disrupt the service.
10. Return, export and deletion
During active access, the Controller may export supported payroll records and reports. On termination, the Processor will delete or render inaccessible Controller data after the agreed recovery and legal-retention periods, unless continued retention is required by law. Backup copies expire through the documented retention cycle.
11. Priority and liability
If this DPA conflicts with the Terms on processing of personal information, this DPA prevails to that extent. Liability is governed by the Terms except where applicable law requires otherwise.
Schedule A: Processing details
| Subject matter | Hosted HR, payroll, attendance, leave, statutory calculation, reporting, support, billing and security services. |
|---|---|
| Duration | The subscription term plus agreed export, recovery, backup and legal-retention periods. |
| Data subjects | Employees, former employees, applicants where entered, authorised users, customer contacts and relevant beneficiaries or dependants recorded by the Controller. |
| Personal information | Identity and contact data; employment, attendance and leave records; compensation, banking, tax, pension, medical-aid and statutory identifiers; account, audit, device and security records. |
| Sensitive information | Financial and employment history, health or disability information where entered, identity numbers and other information treated as sensitive by applicable law. |
| Operations | Collection, recording, organisation, calculation, storage, retrieval, consultation, reporting, transmission, backup, restoration, restriction and deletion. |
Schedule B: Contact
Processor privacy and security notices: info@payrollmaster.co.zw. Controller contacts are the administrators and contact details registered in the customer account.