Business Data Processing Agreement

This agreement is between the business customer whose owner accepts it in Hiruu (the Controller) and Christos Papoukas, trading as Hiruu, Adroutsou, 551 32 Kalamaria, Thessaloniki, Greece (the Processor). It forms part of the Hiruu Terms and applies while Hiruu processes personal data of the Controller's workforce.

Hiruu hosts, stores, organises, displays, transmits and deletes workforce data so the Controller can use employment records, scheduling, shift requests, attendance (distance-only GPS check-in), leave, documents and contracts, team chat and calls, notifications and optional scheduling assistance. Processing lasts while the Controller uses Hiruu, plus the return and deletion period in section 10.

Hiruu processes the data only on the Controller's documented instructions. This agreement, the Terms and the Controller's use of Hiruu's features and settings are those instructions, including for transfers outside the EEA, unless EU or member-state law requires otherwise; Hiruu will then inform the Controller first unless the law forbids it. Hiruu will tell the Controller if it believes an instruction breaks data-protection law.

Everyone Hiruu authorises to process the data is bound by confidentiality.

Hiruu applies the technical and organisational measures in Annex 2 (GDPR Article 32). It may improve them but will not reduce the overall level of protection.

The Controller authorises the sub-processors in Annex 3. Hiruu announces any addition or replacement at least 30 days in advance in the app or by email to the business owner. The Controller may object on reasonable data-protection grounds; if the objection cannot be resolved, the Controller may stop using the affected service. Each sub-processor is bound by obligations at least as protective as this agreement, and Hiruu remains responsible for them.

Where a sub-processor processes the data outside the EEA, Hiruu ensures a valid transfer mechanism: an adequacy decision, including the EU–US Data Privacy Framework for certified providers, or the European Commission's Standard Contractual Clauses.

• Hiruu helps the Controller respond to requests from people to access, correct, erase, restrict, port or object to their data, through product features where available and otherwise on request.
• Hiruu helps with security, breach notification, data protection impact assessments and prior consultation (GDPR Articles 32 to 36).

Hiruu notifies the Controller without undue delay, and in any case within 48 hours of becoming aware of a breach affecting the data, with what is known about its nature, the categories and approximate numbers concerned, likely consequences, measures taken and a contact point. Further information follows as it becomes available.

When the service ends, the Controller can export its records first. The data is then no longer shown anywhere and is kept in restricted form only for the retention periods in the Privacy Policy (employment records at most 10 years after employment ends), and is then deleted. The Controller may ask for earlier deletion. Backups expire on their normal cycle of at most 35 days.

Hiruu makes available the information needed to demonstrate compliance with GDPR Article 28 and answers audit requests with written documentation, such as a questionnaire, a description of its measures and sub-processor audit reports. An on-site audit takes place only where a supervisory authority requires it or after a breach affecting the Controller, with 30 days' notice, at most once a year, at the Controller's cost and under confidentiality.

Hiruu may update this agreement and publishes each version at a dated address. Minor changes, such as sub-processor updates under section 6, apply after notice; for a material change the owner accepts the new version again in the app. Liability follows the Terms. If this agreement conflicts with the Terms on data protection, this agreement prevails.

• Hosting on Hetzner servers in the EU, encrypted transport for all traffic and Cloudflare network protection.
• Field-level encryption of banking, ID and tax fields, strong password hashing and short-lived access tokens with rotation.
• Role-based access within each business. Hiruu staff tools require multi-factor authentication and fresh re-authentication for sensitive actions; staff views of user records and phone reveals are logged.
• Malware scanning of chat and shift-report attachments, and private access to chat media.
• Daily automated retention and deletion, and verified account erasure across providers.
• Encrypted off-site backups with a 35-day cycle, monitoring and a documented breach-response procedure.