Data Processing Agreement

In the context of this DPA:

• Customer (you) is the Data Controller: you determine the purposes and means of processing personal data belonging to your employees, contractors, and applicants.
• FabHR is the Data Processor: we process personal data only on your documented instructions and in accordance with this DPA.

FabHR will not process personal data for any purpose other than delivering the contracted service, unless required to do so by applicable law, in which case we will notify you unless legally prohibited from doing so.

Subject matter: Provision of the FabHR HRMS and HCM cloud services.

Duration: For the term of the subscription agreement and for the post-termination retention period specified in Section 9.

Categories of data subjects: Your employees, contractors, interns, applicants, and authorised platform administrators.

Categories of personal data: Identity and contact information, employment records, compensation and payroll data, attendance and leave records, performance and learning records, disciplinary records, and any other HR data you choose to store within the platform.

FabHR relies on a limited number of sub-processors (cloud infrastructure, transactional email, support tooling) to deliver the Service. Each sub-processor is bound by a data processing agreement that imposes obligations no less protective than those in this DPA.

We maintain a current, public list of sub-processors available on request at dpa@fabhr.in. We provide 30 days' written notice before adding or replacing any sub-processor. You may object to a new sub-processor on reasonable data-protection grounds within 14 days of the notice; if we cannot accommodate your objection, you may terminate the subscription without penalty.

FabHR implements and maintains the following security measures:

• AES-256 encryption for data at rest
• TLS 1.2 or higher for all data in transit
• ISO 27001 certified information security management system
• SOC 2 Type II controls assessed annually by an independent auditor
• Role-based access control (RBAC) with principle of least privilege
• Multi-factor authentication (MFA) enforced for all admin accounts
• Annual third-party penetration tests; critical findings remediated within 30 days
• Continuous vulnerability scanning and patch management
• Physical security controls at all data centre locations
• Security incident response plan with defined escalation procedures

Personal data is hosted in the region you select (India, EU, or US) and, by default, does not leave that region. Where cross-border transfers are unavoidable — for example, when a sub-processor operates globally — FabHR relies on the EU Standard Contractual Clauses (2021) and, where applicable, supplementary technical measures to ensure an equivalent level of protection.

FabHR provides self-service tools and, where necessary, technical assistance to help you fulfil data subject rights requests (access, rectification, erasure, portability, restriction, and objection) within the timeframes required by applicable law. If you receive a data subject request relating to FabHR-held data, please forward it to dpa@fabhr.in and we will respond within 5 business days.

In the event of a confirmed personal data breach affecting your data, FabHR will notify you without undue delay and within 72 hours of becoming aware of the breach. The notification will include, to the extent known at the time: the nature of the breach, categories and approximate number of data subjects affected, categories and approximate volume of data records affected, likely consequences, and measures taken or proposed to mitigate the impact (as required by GDPR Article 33(3)).

You may request FabHR's latest SOC 2 Type II report and ISO 27001 certificate once per year. Enterprise customers may request on-site audits or third-party assessments with 30 days' reasonable notice; audit costs will be borne by the customer. Audits must not unreasonably disrupt FabHR's operations or compromise the security or confidentiality of other customers' data.

Upon expiry or termination of the agreement, and upon your written request, FabHR will provide a full export of your data in CSV/JSON format within 14 days. Following the export period, personal data will be deleted from production systems within 30 days and from encrypted backups within 90 days, unless applicable law requires longer retention. FabHR will provide written confirmation of deletion on request.

Data Protection Officer: dpa@fabhr.in

Postal: FabHR Data Protection Office, Bengaluru, Karnataka, India

To execute a signed copy of this DPA for your records, contact legal@fabhr.in.