Recruit
Data Processing Agreement
Updated
- September 2026
Let RemotePeople handle payroll, compliance, and HR admin worldwide so you can focus on building your team.
Horizons Global Technology Pte. Ltd., a Singapore company d.b.a. Remote People, and/or its subsidiaries and in-country affiliated entities (“Provider”) provides specific services (“Services“) as per its terms and conditions (“Principal Agreement”) to the company that is executing this Principal Agreement (“Company”); where both the Provider and the Company share personal information with each others as independent data controllers.
The present Data Processing Addendum (“Addendum”) forms a part of the Principal Agreement, and governs the processing of Personal Data and is implemented to comply with the requirements of the current legal framework in relation to data processing and with the Regulation (EU) 2016/679 known as the General Data Protection Regulation (GDPR), on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data.
Each of the Provider and the Company are referred to as a “Party” and together as the “Parties”.
The Parties hereby agree on their rights and obligations:
1. Definitions - Interpretation
Unless otherwise defined herein, capitalized terms and expressions used in this Addendum shall have the following meaning:
- Controller, Processor, Data Subject, Personal Data, Processing, Data Breach, and Special Categories of Personal Data shall have the same as in the GDPR, and their cognate terms shall be construed accordingly;
- Data Protection Laws means EU Data Protection Laws and, to the extent applicable, the data protection or privacy laws of any other country;
- EEA means the European Economic Area;
- EU Data Protection Laws means the GDPR, Regulation (EU) 2016/679, together with any applicable national legislation implementing or supplementing it, in each case as amended, replaced or superseded from time to time;
- Professional means any employee, worker, contractor, candidate or other individual in respect of whom the Services are provided under the Principal Agreement;
- Services means the specific Services the Provider provides as per the Principal Agreement.
2. Purpose
The Parties agree that they are considered as independent data controllers where each Party is in capacity to determine the purpose and means of processing the Personal Data held under its control in accordance with its own privacy policy.
Each Party shall be independently responsible for identifying and maintaining an appropriate legal basis for its Processing, providing any notices required under applicable Data Protection Laws and otherwise complying with the obligations applicable to it as a Controller. Neither Party is authorized to make any representation, provide any notice or exercise any right on behalf of the other Party.
Personal Data may be Processed to provide, receive, administer and improve the Services; comply with legal, regulatory, tax, employment and other statutory obligations; prevent fraud and security incidents; and establish, exercise or defend legal claims. Neither Party shall sell Personal Data received from the other Party.
Personal Data collected and shared.
The Parties may disclose Professionals’ Personal Data to each other only to the extent reasonably necessary in connection with the Services or to comply with applicable law. The categories listed below are illustrative and the Personal Data disclosed in each case shall depend on the nature of the Services, applicable legal requirements and the circumstances of the relevant Professional.
The Company may provide the following Professionals’ Personal Data to the Provider:
Identity and contact details as first name and last name, email address,
Country of employment,
Residency status,
Occupational status,
Employment details as work location, job title, main duties, salary, vacations, sick leave,
Approval or refusal of expenses or leave requests.
The Company represents and warrants that any Personal Data disclosed to the Provider has been collected and disclosed lawfully, is accurate in all material respects and is limited to what is reasonably necessary for the Services. The Company shall be responsible for providing all required privacy notices and obtaining any consent or other legal authorization required for such disclosure and Processing. The Provider may rely on the accuracy and lawfulness of the Personal Data and instructions provided by the Company.
Where reasonably necessary for the Services and permitted by applicable Data Protection Laws, the Provider may provide the following categories of Professionals’ Personal Data to the Company:
- Nationality,
- Employment agreement and pay slips,
- Emergency contact persons’ name, phone and relationship with the Professional,
- Address,
- Banking information,
- Requests for expenses reimbursement, annual, sick and other leaves.
Special categories of data.
Depending on applicable labor laws and regulations, personal details contained in the employment agreements or required when hiring an employee may vary from a place of work to another. Depending on the country of hiring, the personal information collected may include the following:
- National ID number & information,
- Social and or health insurance information,
- Special categories of data such as,
- biometric data,
- religion,
- ethnic origin,
- criminal records,
- health certificate or related data.
The Company shall not disclose Special Categories of Personal Data or Personal Data relating to criminal convictions and offenses to the Provider unless expressly requested or approved by the Provider and reasonably necessary for the Services or compliance with applicable law. Before making any such disclosure, the Company shall ensure that it has a valid legal basis and has satisfied all additional requirements applicable to the Processing of such Personal Data.
4. Obligations of the Parties
When processing Personal Data, the Parties undertake to comply with all applicable Data Protection Laws.
Compliance.
The Parties understand and agree that they shall always comply with all applicable Data Protection Laws when processing Personal Data pursuant to, or in connection with this Addendum.
Each Party shall be independently responsible for the lawfulness of its Processing and for the accuracy, quality and legality of the Personal Data it collects or discloses. Each Party shall provide Data Subjects with any notices and exercise any rights or obligations required in relation to the Processing conducted under its control.
Each Party further understands and agrees that it shall promptly inform the other Party if it becomes aware of any material failure to comply with this Addendum or applicable Data Protection Laws that is reasonably likely to affect the other Party or Personal Data received from the other Party.
Security.
Each Party shall have implemented and maintain appropriate security technical and organizational measures (“TOMs”) to ensure protection of the confidentiality, integrity, availability and security of Personal Data against any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed
Each Party is solely responsible to ensure that its TOMs efficiently meet the other Party’s requirements and safeguards, with regard to security as per applicable Data Protection Laws.
Each Party further acknowledges and agrees that its security practices and policies are effectively implemented and maintained in accordance with the requirements relating to its respective mission and duties as data controllers, and provide a level of security appropriate to prevent any unlawful process or access to Personal Data.
Each Party acknowledges that its TOMs are subject to technical progress and development and that they may be updated or modified from time to time, provided that such updates and modifications ensure a better overall security of the Personal Data.
Confidentiality.
Each Party undertakes to preserve the confidentiality of any Personal Data it retains and process during the Principal Agreement and thereafter. Each Party further undertakes that access to Personal Data is strictly limited to the extent necessary to deliver the Services and in accordance with applicable Data Protection Laws.
Minimization.
The Parties agree to comply with the privacy by default & by design and data minimization principles from the EU Data Protection Laws.
Each Party agrees to minimize Personal Data processing to the extent strictly necessary to provide the Services, including, but not limited to: minimization of telemetry data, support data and feedback functionality, minimization of data retention periods, collection of pseudonymized identifiers when necessary, immediate effective and irreversible anonymization when the Service can be performed without Personal Data, end to end encryption when technically feasible, and the implementation and control of strict access controls to Personal Data.
The Parties shall implement relevant applicable policies when collecting new types of Personal Data, and shall ensure such new collection is supervised by a data privacy officer (“DPO”). Both Parties shall perform regular checks on the contents of collected Personal Data to verify the processing lawfulness and minimization principles of EU-GDPR
Data Subject Rights.
Each Party is solely responsible for the execution of its Data Subject rights within its own scope of data and processing and in accordance with all applicable Data Protection Laws. Where a Party receives a request from a Data Subject that relates, in whole or in part, to Personal Data processed by the other Party, the receiving Party shall, without undue delay, notify the other Party of such request and provide any information reasonably necessary for the other Party to respond within the timeframe required by applicable Data Protection Laws. Neither Party shall be obligated to respond to a Data Subject request on behalf of the other Party.
5. Term - Termination
Duration.
This Addendum commences when the Principal Agreement is executed, and remains in full force and effect so long as:
- the Principal Agreement remains in effect; or
- either Party Processes Personal Data received from the other Party in connection with the Services.
Any provision of this Addendum, that, expressly or by legal implication should continue in force on or after termination, shall remain in full force and effect in order to ensure protection of such Personal Data.
Return or deletion of Personal Data.
Following termination of the Principal Agreement, each Party shall retain, return, archive or delete Personal Data under its control in accordance with its own retention policies and applicable Data Protection Laws. Notwithstanding any request from the other Party, a Party may retain Personal Data to the extent necessary to comply with legal, regulatory, tax, employment, audit or record-keeping obligations, or to establish, exercise or defend legal claims. Any Personal Data retained for those purposes shall remain subject to the confidentiality and security obligations of this Addendum for as long as it is retained.
6. Processor
The Company understands that the Provider may use a local in-country affiliated entity and other third-parties (“Processors”) to deliver the Services in connection with the Principal Agreement.
Both Parties authorize each other to engage Processors to process Personal Data. When engaging a Processor, a Party imposes data protection terms and conditions that provide at least the same level of protection for Personal Data as those in this Addendum, to the extent applicable according to the nature of the services provided by each Processor.
Each Party will remain responsible for its Processor’s compliance with the obligations of this Addendum and for any acts or omissions of such Processor that would cause the Party to breach any of its obligations under this Addendum.
The Parties shall ensure that their post-termination obligations are also required from their Processors.
A current list of the Provider’s Processors is set out in Schedule 1 to this Addendum, which the Provider shall keep updated. The Provider shall make any updated list available to the Company, and the Company may object to any addition or replacement of a Processor on reasonable data protection grounds within 30 calendar days after the updated list is made available to the Company . If the Parties cannot resolve the objection, either Party may terminate the affected Services in accordance with the Principal Agreement.
7. Impact Assessment
Data Protection Impact Assessment.
In the event a Party plans to introduce new features, or related software and services (“New Features”) which will or may result in a new type of data processing (i.e. new type or Personal Data and/or new purpose for processing), such Party shall:
Perform a data protection impact assessment (“DPIA”);
Determine if the New Features and such new type of data processing are allowed within the scope of this Addendum;
Ensure that such new type of data processing only occurs with the necessary permissions of the other Party; which can consult a supervisory authority in case the result of the DPIA shows a high risk for the fundamental rights for its Data Subjects.
8. Data breach
If a Party becomes aware of a confirmed Data Breach affecting Personal Data received from the other Party and reasonably likely to affect the other Party’s obligations under applicable Data Protection Laws, that Party shall:
- Notify the other Party without undue delay, and within 3 days when possible, it being understood that this timeframe governs notification between the Parties only and does not affect or extend any shorter notification period either Party may owe to a supervisory authority or Data Subject under applicable Data Protection Laws;
- Provide the other Party with details relating to such Data Breach, to the extent reasonably available at the time, including: (i) the nature of the breach; (ii) the categories and approximate volume of Personal Data and Data Subjects affected; (iii) the likely consequences of the breach; and (iv) the measures taken or proposed to address the breach and mitigate its effects, to allow the other Party to comply with its own notification requirement as per applicable Data Protection Laws;
- Promptly launch an investigation into the data incident and take appropriate remedial steps to prevent and minimize any possible harm, provided that such data incident would compromise the security of Personal Data.
9. International Data Transfer
The Parties understand and acknowledge that as part of the Services, each Party may, upon instruction from the other Party, transfer Personal Data to a third-party Processor that is based outside the EEA; each Party is hence responsible for entering into a separate contractual arrangement with such third-party Processor to ensure they follow all applicable Data Protection Laws.
Standard Contractual Clauses.
In the event any Personal Data stored or processed is to be transferred to a country outside the EEA and which is not an Adequate Country (with the meaning of Art. 45 (1) of EU-GDPR), the Parties shall ensure that the Personal Data are adequately protected. The Parties agree that such international transfers of Personal Data shall be governed by the applicable Standard Contractual Clauses (“SCC”). Furthermore, in the event the Data Subjects are citizens of the EEA, any transfer of their Personal Data to a country outside the EEA, such international transfers of Personal Data shall also be governed by the applicable SCC.
In the event any provision of this Addendum contradicts, directly or indirectly, the SCC, such SCC shall prevail. In the event any provision of this Addendum contradicts, directly or indirectly, the SCC, such SCC shall prevail. If the SCC are deemed invalid or if additional obligations and restrictions are added to them, the Parties shall work in good faith to find an alternative and/or modified approach with respect to the transferred Personal Data, and in compliance with applicable Data Protection Laws.
10. California Consumer Privacy Act
Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), applies to Personal Data Processed under this Addendum, each Party shall act as an independent “business” in relation to the Personal Data under its control, unless otherwise expressly agreed in writing. Each Party shall comply with the obligations applicable to it under the CCPA and shall Process Personal Data received from the other Party only for the purposes described in the Principal Agreement and this Addendum.
Neither Party shall “sell” or “share”, as those terms are defined under the CCPA, Personal Data received from the other Party. The disclosure of Personal Data between the Parties for the purposes of providing or receiving the Services shall not constitute a sale or sharing of Personal Data.
Each Party shall notify the other Party if it determines that it can no longer comply with its obligations under this clause and shall take reasonable and appropriate steps to remediate any unauthorised Processing of Personal Data received from the other Party.
11. Limitation of Liability
12. Governing Law - Dispute
Governing Law: This Addendum is governed by and construed in accordance with the “Governing Law” section of the Principal Agreement, unless otherwise required by applicable Data Protection Laws.
Dispute: Any dispute arising out of or in connection with this Addendum shall be resolved in accordance with the dispute resolution provisions of the Principal Agreement, unless otherwise required by applicable Data Protection Laws or the SCC.
13. Entirety
Entire Agreement: This Addendum supersedes any and all prior addendums or representations, whether written or oral, relating to the subject matter hereof. This Addendum shall form an indivisible and integral part of the Principal Agreement and have equal force with it.
Modification: From time to time, the Provider may modify, amend or enrich this Addendum, to ensure it stays aligned and complies with any change to any applicable laws and regulations. Any such change should become effective without delay. The Provider will use reasonable efforts to notify the Company of any significant changes through communications via the Company Account, email or other means.
14. Miscellaneous
Inconsistency: In the event this Addendum is not consistent with any newly established local mandatory stipulations such as laws, regulations, provisions or policies, the new laws, regulations, provisions or policies shall prevail. Any illegal or unenforceable disposition or part of shall be null and void, without any effect of the remaining part of this Addendum.
Independence: The Parties are independent from each other, and this Addendum will not establish any relationship of partnership, joint venture, employment, franchise or agency between them. Neither Party will have the power to bind the other Party or to incur any obligations on its behalf without the other Party’s prior consent.
Confidentiality: Each Party must keep this Addendum and information it receives about the other Party and its business in connection with the Principal Agreement, including this Addendum (“Confidential Information”) confidential and must not use or disclose such Confidential Information without the prior written consent of the other Party except to the extent that (i) disclosure is required by law; or (ii) the relevant information is already in the public domain.
Notice: All notices and communications given under this Addendum must be in writing and will be delivered through communications via the Company’s email or other means.
Schedule 1
Processor | Processing activity |
|---|---|
Airwallex | Global payment and financial services |
Atlassian | Team collaboration and project management |
AWS | Cloud computing and storage |
Beamer | User engagement / product release comms |
Freshdesk | Customer support and ticketing |
Hubspot | CRM |
PandaDoc | Contract management |
Xero | Accounting/bookkeeping |
Google Workspace | Cloud storage and data management |
+ in-country affiliated entities (ICPs and CPA) | Local employment/payroll delivery |