Data processing agreement

1. Roles

The Customer is the controller of the employee data it puts into Mawro. Mawro is the processor and acts only on the Customer's documented instructions, which are the agreement, this DPA and the Customer's use of the service.

2. Data and purposes

Categories of data subjects: the Customer's employees, joiners, candidates and leavers, and its users. Categories of data: identity and contact details, identity and immigration documents, employment, attendance, leave, pay and bank details, performance and training records, and any other data the Customer chooses to store. Purpose: providing the HRMS service.

3. Security measures

Mawro applies the technical and organisational measures described on its security page, including encryption in transit, encryption of identity numbers and credentials at rest, role and field-level access control, maker-checker approvals, an append-only audit trail and nightly backups.

4. Sub-processors

[To be confirmed by the owner before launch.] Based on how the service is built today:

• Hosting (SaaS deployments): our cloud infrastructure provider, named in the data processing agreement.
• Email delivery: [SMTP provider to be confirmed].
• Mobile push notifications: Google Firebase Cloud Messaging.
• AI assistant (only if the Customer enables it): Anthropic.

5. Data location

Mawro is available as SaaS, in a private cloud or on-premise. For SaaS, the hosting region is stated in the order form or data processing agreement; in a private cloud or on-premise, data stays in the environment the customer chooses.

6. Assistance, breaches and audits

[Commitments on assisting with data subject requests, breach notification timelines and audit rights to be drafted by counsel.]

7. Return and deletion

[Return and deletion of Customer data at the end of the agreement to be drafted by counsel.]