Skip to content
Zetta HR
Try it free
FeaturesSponsor compliancePricingHow to use Zetta HRFree toolsBlogFAQsSign in

Data Processing Agreement

Last updated 2026-10-22.

This Data Processing Agreement (“DPA”) forms part of the agreement between the customer (“Controller”) and Arise Media Technology Ltd (company number 17153497), registered office Suite RA01, 195-197 Wood Street, London, E17 3NU (“Processor”, “we”) for the Zetta HR service (the “Terms”). It applies to personal data that the Controller or its users enter into the service (“Customer Personal Data”) and reflects Article 28 of the UK GDPR. If the Controller is subject to the EU GDPR for any of that data, references to UK law include the equivalent EU law.

1. Details of the processing

  • Subject matter and duration: provision of the Zetta HR service for the term of the Terms and until deletion under clause 9.
  • Nature and purpose: hosting, storing, retrieving, displaying, exporting, backing up and transmitting HR, right to work and sponsor licence records and related documents; sending notifications the Controller configures; providing support.
  • Categories of data subjects: the Controller’s employees, workers, contractors, job applicants, sponsored workers and their dependants where recorded, and the Controller’s users.
  • Types of personal data: identity and contact details, employment and pay information, leave and working time, right to work and immigration status records, passport and visa documents, sponsorship records, user account data. The Controller decides what to enter and is responsible for entering only what it is lawfully entitled to hold. This may include special category data (for example health-related absence or nationality-related status information); the service is not designed for medical records, and the Controller should not upload them.

2. Our obligations

We will: (a) process Customer Personal Data only on the Controller’s documented instructions, which are these Terms, this DPA, and the Controller’s use of the product’s features; we will tell the Controller if we think an instruction infringes data protection law; (b) ensure that people authorised to process it are bound by confidentiality; (c) implement appropriate technical and organisational measures as described in our security overview; (d) comply with clauses 3 to 9.

3. Sub-processors

The Controller gives general authorisation for the sub-processors listed on our sub-processors page. We bind each by written terms providing the same level of protection as this DPA, and remain responsible for their performance. We will give at least 30 days’ notice of any addition or replacement; the Controller may object on reasonable data protection grounds within that period, and if the parties cannot resolve the objection the Controller may terminate the affected service and receive a pro-rata refund of prepaid fees.

4. International transfers

We will not transfer Customer Personal Data outside the UK except where a UK adequacy regulation applies, or appropriate safeguards are in place (the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses) and, where required, a transfer risk assessment has been carried out.

5. Assisting the Controller

Taking into account the nature of the processing, we will assist the Controller by appropriate measures to respond to requests from data subjects (the product lets the Controller access, correct, export and delete records; if we receive a request directly we will refer it to the Controller without undue delay), and to meet its obligations on security, breach notification, data protection impact assessments and prior consultation. We may charge reasonable costs for assistance that goes beyond the features of the service and normal support.

6. Personal data breach

We will notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information we then have (nature, categories and approximate numbers affected, likely consequences, measures taken) and further details as they become available. Notification is not an admission of fault. The Controller is responsible for deciding whether to notify the ICO and data subjects.

7. Audit

We will make available the information necessary to demonstrate compliance with this DPA, including our security overview and, on request, summaries of relevant independent assurance our providers hold. Where that is not sufficient, we will allow audits by the Controller or its auditor, on reasonable notice (at least 30 days), no more than once a year (unless following a breach), during business hours, subject to confidentiality, without access to other customers’ data, and at the Controller’s cost.

8. Controller responsibilities

The Controller is responsible for having a lawful basis and a condition for processing any special category data, for giving its people the information required by Articles 13 and 14, for keeping its users’ access appropriate, for the accuracy of what it enters, and for its own retention decisions.

9. Return and deletion

During the term the Controller can export its records from the product. On closure of the account, or on the Controller’s written request, we will delete Customer Personal Data (including stored documents and sign-in accounts belonging only to that organisation) within 30 days, unless the law requires us to keep it. Copies in provider backups are overwritten on the provider’s normal rolling cycle and are not used for any other purpose. On request we will confirm deletion in writing.

10. Liability and order of precedence

Liability under this DPA is subject to the limitations in the Terms. If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails.

11. Contact

Data protection enquiries: privacy@zettahr.com. This DPA is governed by the law of England and Wales.