Data Processing Agreement

This data processing agreement (“DPA”) forms part of the agreement between the customer and Mira HR for the use of the Mira HR service. In this DPA, “Mira HR”, “we” and “us” refer to the operator of the service.

For personal data of employees and other people that the customer enters into the service, the customer is the controller and Mira HR is the processor. Mira HR processes that data only on the documented instructions of the customer, including the instructions given through the settings of the service.

Mira HR hosts, stores, displays and processes the data the customer enters, to provide the features of the service that the customer has switched on. Processing lasts for the term of the agreement, until the deletion described below.

Data subjects are the customer’s employees and other people whose data the customer enters. Depending on the modules the customer uses, the personal data may include:

• Identity and contact details: name, work and personal contact details, date of birth, nationality, identity and residence documents and their copies.
• Employment details: position, department, manager, employment dates, contract terms, working time and attendance, leave and absences.
• Payroll details: salary and allowances, deductions and loans, bank account details, payslips and end-of-service calculations.
• Performance and learning records: goals, reviews, feedback, training assignments and results.
• Documents and files that the customer uploads, messages in the built-in chat and records of actions in the service.

Mira HR applies technical and organizational measures appropriate to the risk, including encryption in transit, role-based access control, protection of user accounts and logging of administrative access. The current measures are described on our Compliance & data security page.

Our subprocessors are listed on our Subprocessors page. We update that page when a subprocessor is added or replaced; the date at the top of that page shows the latest change.

Mira HR assists the customer in responding to requests from data subjects and in meeting its security and data protection obligations, taking into account the nature of the processing and the information available to Mira HR. Requests from employees about their data in the service are directed to the customer as the controller.

When the agreement ends, the customer’s company is deleted from the service together with the data it contains, including uploaded files, unless the law requires Mira HR to keep specific records.

For questions about this DPA or to request the signed version, please get in touch.

You can reach us through the demo request form on this website.