Last updated: date
1. Who this agreement is between
1.1This data processing agreement (“DPA”) is between Vacaydiary Limited, company number 17322035, The Conductor, 8 Westfield Avenue, London E20 1NW (“we”, “Vacaydiary”), and the business that has agreed to our terms of service (“you”).
1.2It forms part of the terms of service and applies whenever we process personal data for you in providing Vacaydiary.
2. Roles
2.1You are the controller of the personal data you and your users put into Vacaydiary. We are your processor.
2.2For our own billing, account management and website data, we are a controller, and our privacy policy applies.
3. What we will do
3.1We will:
- process personal data only on your documented instructions: these terms, this DPA and your use and settings of Vacaydiary. If the law requires otherwise, we will tell you first unless the law forbids it
- make sure everyone who can access the data is bound by confidentiality
- keep the security measures in Annex 3 in place
- only use sub-processors as set out in section 4
- help you respond to requests from people exercising their rights, mainly through the export and erasure tools in Vacaydiary
- help you with security, breach notifications, data protection impact assessments and consultations with the ICO, where they relate to our processing
- delete or return personal data at the end of the service, as set out in section 7
- give you the information you reasonably need to show that this DPA is being followed, and allow audits as set out in section 8
3.2We will tell you straight away if we think an instruction from you breaks data protection law.
4. Sub-processors
4.1You agree that we can use the sub-processors listed in Annex 2.
4.2We will tell you at least 30 days before we add or replace a sub-processor. If you object on reasonable data protection grounds, we will discuss it with you. If we can’t resolve it, you can end the affected service and we will refund any prepaid fees for the remaining period.
4.3We will put a written contract in place with each sub-processor that protects personal data at least as well as this DPA, and we remain responsible for their work.
5. International transfers
5.1We will only transfer personal data outside the UK where UK adequacy regulations apply or where appropriate safeguards are in place, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
6. Personal data breaches
6.1If we become aware of a personal data breach affecting your data, we will tell you without undue delay and within 48 hours. We will share the information we have about what happened, which data and people are affected, and what we are doing. We will update you as we learn more.
7. At the end of the service
7.1You can export your data at any time while your workspace exists, using the workspace export in Vacaydiary.
7.2After your subscription ends, we will keep your data for 90 days so you can export it, then delete it, unless you ask us to delete it sooner or the law requires us to keep it. Encrypted backups containing the data are overwritten within 6 months in line with our backup schedule. Ask Guy: how long we keep data after a customer cancels. 90 days is a placeholder. The app does not delete workspaces automatically today.
8. Audits
8.1We will answer reasonable written questions about our processing and security. If that isn’t enough to show we are meeting this DPA, you may carry out an audit, at your cost, with at least 30 days' notice, no more than once a year unless a regulator requires it or there has been a breach.
9. Your responsibilities
9.1You are responsible for having a lawful basis for the personal data you put into Vacaydiary and, where needed, a condition for special category data. You are also responsible for giving employees the right privacy information.
9.2You control many settings that affect processing, including who has admin access, whether session recording is on, whether an AI assistant is connected, and which webhooks and calendar links are shared. If you connect an AI assistant or send data to another system, that provider is not our sub-processor. Your agreement with them covers that data.
10. Liability
10.1Each party’s liability under this DPA is subject to the limits in the terms of service. Solicitor to advise.
Annex 1: Details of processing
| Subject matter | Providing Vacaydiary HR software to you |
|---|---|
| Duration | For as long as you use Vacaydiary, plus the period in section 7 |
| Nature of processing | Storing, organising, displaying, calculating (for example leave balances and absence scores), sending notifications and emails, collecting e-signatures, exporting and deleting |
| Purpose | To let you manage your workforce’s HR administration |
| People whose data is processed | Your employees, workers, contractors, interns, new starters before their start date, leavers, and the emergency contacts they give |
| Types of personal data | Name, work and personal email, phone, home address, location, date of birth, gender, photo. Job title, department, line manager, start and leaving dates, leaving reason, contract type, working pattern. Salary. Leave and absence records and balances. Clock in and out times and attendance. Performance reviews, objectives and one-to-one notes. Documents and e-signatures. Emergency contact name and phone. Audit records of changes, including IP address and device |
| Special category and sensitive data | Health information in sickness records and sick notes, maternity and paternity leave, and right to work or immigration documents and status, which may reveal nationality. Gender is held where you record it |
Annex 2: Sub-processors
| Sub-processor | What they do | Where |
|---|---|---|
| Contabo GmbH. Ask the developer to confirm | Hosting of the server that runs the database, files, e-signing service and email | UK. Ask the developer to confirm the region |
| PostHog | Error tracking, click and scroll positions, and session recordings where you switch them on (text, typing and images hidden) | EU |
| Backup storage provider. Ask the developer which one | Encrypted offsite backup copies | confirm |
| Cloudflare. Ask the developer if it is used | Network and security services | confirm |
Annex 3: Security measures
- Separation of customer data: each customer’s data is kept apart in the database using row-level security, so one customer’s users cannot read another’s.
- Access control: role-based access (employee, HR admin or director, Vacaydiary support). Employees see only their own records. Role checks are enforced on the server.
- Support access: Vacaydiary support can view a workspace to help with a problem. This access is read only and logged.
- Authentication: passwords of at least 8 characters including a number. One-time invite links stored as hashes, expiring after 7 days by default. Optional Google or Microsoft sign-in.
- Leavers: access ends on a leaver’s last working day.
- Secrets: access tokens for AI connections are stored as hashes and can be set to expire. Webhooks are signed with HMAC SHA-256 and sent over HTTPS only.
- Audit logging: changes to data are recorded automatically with who made them and when. Audit entries are not deleted. AI assistant requests are logged before they run.
- Backups: daily encrypted backups (AES-256-GCM) of databases and files, keeping 7 daily, 4 weekly and 6 monthly copies. Ask the developer when offsite storage is live, then add it.
- Files: documents are kept in private storage and opened through short-lived links.
- Email: sent from Vacaydiary’s own mail server with DKIM signing.
- Data minimisation: Vacaydiary does not collect bank details or National Insurance numbers. AI assistants never receive individual salaries.
- Retention tools: leaver records show a retention date (six years by default). Right to work evidence is kept for two years after leaving and can be destroyed automatically. Erasure of a leaver’s data is available on request.