Organisation Data Processing Agreement

The Controller is the organisation identified in its UJobs workspace. The Processor is UOMN VERSE LTD, company number 17214579, registered office 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.

This DPA applies only where the organisation determines the purposes and essential means of processing and UJobs processes the data on its behalf. UJobs remains an independent controller for account identity, billing, security, fraud prevention, legal compliance, support, public-directory operation and other purposes described in the Privacy Policy.

“Data Protection Laws” means the UK GDPR, Data Protection Act 2018, Privacy and Electronic Communications Regulations 2003 and other applicable UK data-protection law, each as amended.

UJobs will process Controller Personal Data only on the Controller's documented instructions, including instructions expressed through authorised use and configuration of the Service, unless UK law requires other processing. If legally permitted, UJobs will tell the Controller before carrying out legally required processing.

UJobs will promptly inform the Controller if, in its reasonable opinion, an instruction infringes Data Protection Laws. UJobs may suspend the affected instruction while the parties resolve the issue.

• Subject matter: recruitment, worker onboarding, organisation membership, site and shift management, attendance, timesheets, wage estimates, messaging, notifications, reporting and related support.
• Duration: the organisation's use of the relevant Service and the return/deletion period described below.
• Nature and purpose: storing, organising, retrieving, displaying, transmitting, restricting, backing up and deleting data to provide the configured UJobs workforce functions.
• Data subjects: applicants, workers, employees, contractors, candidates, organisation members, managers, on-site managers, client contacts and other people whose data the Controller lawfully enters.
• Data types: identity and contact details; work profile and application data; documents; membership and permissions; site, shift, attendance and timesheet records; pay-rate and gross-wage estimates; messages; device/notification identifiers; audit and support data.
• Potential special-category data: only information the Controller lawfully chooses and is permitted to submit, such as limited health-related attendance explanations. The Controller must not submit unnecessary special-category or criminal-offence data.

The Controller must have a lawful basis, provide required privacy information, ensure instructions and data are lawful and proportionate, configure permissions and retention appropriately, respond to workers and other data subjects, and ensure authorised members access data only for legitimate purposes.

The Controller is responsible for employment, recruitment, safeguarding, equality, working-time, payroll, tax, right-to-work and workplace obligations. UJobs does not determine those decisions merely by providing the software.

UJobs ensures that people authorised to process Controller Personal Data are bound by confidentiality and receive appropriate data-protection and security instructions. Access is limited to what is necessary for their role.

Taking account of the state of the art, implementation cost, processing context and risk, UJobs maintains appropriate technical and organisational measures. These include authenticated access, role and scope checks, row-level database security, encryption in transit, protected secrets and credentials, audit logging, backups, rate limiting, service monitoring and incident procedures.

The Controller must protect its credentials and devices, assign least-privilege roles, remove former members promptly and review workspace access and attendance settings.

The Controller gives general written authorisation for UJobs to use subprocessors needed to provide the Service. These may include providers of hosting/database/storage, payments, email, push notifications, cloud infrastructure, identity, device integrity, abuse prevention, diagnostics and support.

UJobs will impose data-protection obligations on subprocessors that provide protection equivalent in substance to this DPA for their processing. UJobs remains responsible for each subprocessor's performance of those obligations to the extent required by law.

UJobs will give reasonable notice of a material new subprocessor through the Service, website or account contact. The Controller may object on reasonable data-protection grounds before the stated change date. The parties will try to resolve the objection; if no reasonable alternative exists, either may end the affected service.

UJobs will not transfer Controller Personal Data outside the UK unless permitted by Data Protection Laws. Where no UK adequacy regulation applies, UJobs will use an appropriate safeguard, such as the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, and implement supplementary measures where appropriate.

Taking account of the nature of processing, UJobs will provide reasonable technical and organisational assistance so the Controller can respond to requests for access, rectification, erasure, restriction, objection, portability and rights relating to automated decisions.

If UJobs receives a request clearly concerning Controller Personal Data processed only on the Controller's behalf, UJobs will redirect it to the Controller where practicable and will not respond substantively except on instruction or where law requires.

UJobs will notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller Personal Data and will provide available information reasonably needed for the Controller's assessment and notification duties. Initial information may be supplied in phases as the investigation develops.

Taking account of the processing and information available, UJobs will reasonably assist with security compliance, breach notifications, data protection impact assessments and prior consultation with the ICO. Assistance beyond ordinary Service functionality may be chargeable where lawful and agreed in advance.

On termination of the affected Service, UJobs will, at the Controller's choice and subject to available controls, return or delete Controller Personal Data and delete existing copies after the applicable operational and backup-rotation period, unless UK law requires retention.

UJobs may retain limited data where independently required for security, fraud prevention, billing, legal claims or compliance. For that retained data, UJobs acts under its own legal obligations or legitimate interests, restricts use to the retention purpose and deletes or anonymises it when no longer required.

UJobs will make available information reasonably necessary to demonstrate compliance with this DPA, initially through policies, security information, certifications or written responses. The Controller may request an audit no more than once annually unless a breach or regulator reasonably requires more.

Audits must be proportionate, preserve other customers' confidentiality and system security, occur on reasonable notice during normal business hours, and use an independent auditor bound by confidentiality. The Controller bears its audit costs unless material non-compliance by UJobs is found.

If this DPA conflicts with the Terms of Use on processor obligations, this DPA prevails for that conflict. Liability under this DPA is subject to the lawful liability provisions of the main agreement; nothing limits liability that cannot lawfully be limited.

This DPA begins when the organisation first uses UJobs to submit Controller Personal Data and ends when UJobs has finished processing it in accordance with section 11.

Data-protection contact: support@ujobs.uomnverse.com. ICO registration reference: ZC236444. This DPA is governed by the law of England and Wales, subject to mandatory rights and supervisory-authority powers under Data Protection Laws.