Data Processing Agreement (DPA)

Please review the below information relating to our Data Processing Agreement. To protect your data and ensure full compliance with data protection law, That HR Girl has a Data Processing Agreement in place with any third party that handles personal data on our behalf. This agreement is a legal requirement under Article 28(3) of the UK GDPR, ensuring that all partners act only on our instructions and maintain the same high standards of data security. Learn more from the ICO.

The Data Processing Agreement is between:
That HR Girl Ltd (“the Processor”)
and
The Client (“the Controller”)

Effective Date: Upon commencement of services or first payment to That HR Girl Ltd

Acceptance of Agreement

By setting up payment, subscribing to the Backbar HR app, or otherwise commencing HR support services with That HR Girl Ltd, the Client acknowledges that they have read, understood, and agreed to the terms of this Data Processing Agreement.
No physical signature is required for this Agreement to take effect.

This Agreement forms part of That HR Girl’s standard client terms and applies automatically to all HR support, consultancy, and app-based services.

1. Purpose of This Agreement

This Agreement explains how That HR Girl Ltd handles and protects any personal data belonging to your employees or workers that we process on your behalf as part of providing HR and compliance services.

2. Roles and Responsibilities

  • You (the Client) are the Data Controller, meaning you determine what personal data is collected and for what purpose.
  • We (That HR Girl Ltd) act as the Data Processor, meaning we handle that data only to deliver the agreed HR services in line with your instructions.

3. Types of Data We Process

We may process limited personal data such as:

  • Employee names, contact details, and job titles
  • Employment contracts, right-to-work documents, and HR records
  • Absence, performance, and disciplinary information

We do not process special category data (such as health, ethnicity, or criminal history) unless it is essential for the agreed HR service and you have obtained the necessary lawful basis to share it.

4. Purpose of Processing

We process this data solely to:

  • Provide HR advice and support
  • Draft, review, or update employment documentation
  • Conduct HR and compliance checks or audits
  • Manage HR cases or investigations
  • Support record-keeping and reporting through the Backbar HR app

We will never use or share personal data for marketing or unrelated business purposes.

5. Data Security

That HR Girl Ltd will:

  • Store all data securely using password-protected and encrypted systems
  • Restrict access to authorised personnel only
  • Ensure any third-party systems (such as secure cloud storage or app platforms) meet UK GDPR standards
  • Notify the Client promptly in the event of a data breach involving their information

6. Data Retention and Deletion

We will only retain personal data for as long as necessary to provide our services or resolve any ongoing matters.
Unless otherwise agreed, all personal data will be securely deleted within three (3) months of completing the relevant work or service.

7. Sub-Processors

If we use trusted third-party service providers (for example, software platforms or secure cloud storage) to process data on our behalf, we ensure they are GDPR-compliant and bound by the same confidentiality and data protection obligations.

8. Client Responsibilities

As the Data Controller, you agree to:

  • Only share personal data that you have a lawful basis to disclose
  • Inform your employees that their data may be shared with That HR Girl for HR purposes
  • Provide accurate and relevant information to allow us to deliver services effectively

9. Data Breaches and Subject Access Requests

If either party becomes aware of a data breach or receives a subject access request involving shared data, both parties agree to cooperate promptly and in good faith to ensure compliance with applicable data protection laws.

10. Termination

Upon termination of services, all personal data held by That HR Girl Ltd will be securely deleted or returned to the Client within a reasonable timeframe, unless required by law to retain it.

11. Governing Law

This Agreement is governed by and construed in accordance with the laws of England and Wales.

That HR Girl Ltd
ICO Registration: ZB838800
Email: hello@thathrgirl.co.uk
Website: http://www.thathrgirl.co.uk