Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between MAKZEE LTD (company number SC877764, registered office 383 High Street, Cowdenbeath, KY4 9QW, United Kingdom), trading as MadyHR.ai ("Processor", "we", "us"), and the customer who has subscribed to the MadyHR service ("Controller", "you").

It is incorporated into, and forms part of, our Terms & Conditions and applies automatically to every customer account. No signature is required. If your company requires a countersigned copy, email support@madyhr.ai.

"UK GDPR" means the UK General Data Protection Regulation as it forms part of UK law, read with the Data Protection Act 2018. Terms such as "personal data", "processing", "data subject", "controller", "processor" and "personal data breach" have the meanings given in that legislation.

1. Roles

You are the Controller of the personal data you and your users enter into, or upload to, MadyHR. You determine the purposes and means of that processing.

We are the Processor. We process that personal data only on your behalf.

We are a separate Controller in respect of your account, billing and support data. That processing is governed by our Privacy Policy, not by this DPA.

You confirm that you have a lawful basis for the personal data you place in MadyHR, that you have given the required privacy information to the individuals concerned, and that where you hold special category data (such as health or sickness records) or criminal offence data (such as DBS results) you have the additional condition required by law.

2. Subject matter, duration, nature and purpose

Subject matter: the provision of the MadyHR human resources, right to work and sponsor compliance platform.

Duration: for as long as your subscription is in effect, plus the deletion period in clause 11.

Nature and purpose: storage, structuring, retrieval, display, alteration, generation of documents, transmission and deletion of personal data, in order to provide the MadyHR service to you.

Types of personal data and categories of data subject: set out in Annex B. Annex B describes the categories of data the MadyHR platform is capable of holding, as required by Article 28(3) UK GDPR. It is not a statement that we access or review your data. What is actually held in your account is determined by you.

3. Processing on documented instructions

We process personal data only on your documented instructions, including in relation to transfers to a third country, unless required to do otherwise by law. Where the law requires it, we will tell you before processing, unless the law prohibits us from doing so.

Your instructions consist of this DPA, the main agreement between us, and the instructions you give through your ordinary use of MadyHR's features.

We will tell you if, in our opinion, an instruction infringes UK GDPR or other data protection law. We may suspend the relevant processing until the instruction is withdrawn or amended.

4. Confidentiality

We ensure that persons authorised to process Controller personal data are bound by appropriate obligations of confidentiality, whether contractual or statutory, and that those obligations survive the end of their engagement.

Access to Controller personal data is limited to personnel who require it in order to provide, operate and support the MadyHR service.

5. Security

We implement appropriate technical and organisational measures under Article 32 UK GDPR, including:

Separation of customer data. Every customer's data is logically separated. Access controls prevent any customer from reading, changing or deleting another customer's data. This separation is verified by automated tests that run on every code change.

Access control. Role-based permissions inside each customer account restrict access to sensitive records such as salary, bank details and identity documents. Administrative access to production systems is limited to the personnel described in clause 4 and is protected by multi-factor authentication.

Encryption. Personal data is encrypted in transit using TLS. Data at rest is encrypted at the storage layer, and particularly sensitive fields receive additional field-level encryption.

Document security. Uploaded documents are held in private, encrypted storage restricted to the European Union and served only through time-limited signed links. They are never accessible at permanent or guessable public addresses.

Audit logging. Access to and changes to personal data records are logged, recording the user, the record, the action and the time.

Backups. Backups are encrypted and held in the same region as the production database. Restore procedures are tested.

Hosting. Production systems run in the European Union (see clause 8).

We may update these measures, provided the level of protection is not reduced.

6. Subprocessors

You give us general authorisation to engage subprocessors. Our current subprocessors are listed at madyhr.ai/legal/subprocessors.

Before engaging a new subprocessor, or replacing an existing one, we will update that page and notify subscribers to our subprocessor notification list at least 30 days in advance. You may subscribe at that page.

If you reasonably object to a new subprocessor on data protection grounds, tell us within the notice period. We will work with you to find an alternative. If we cannot, you may terminate your subscription and receive a pro-rata refund of any prepaid fees for the unused period.

We impose data protection obligations on each subprocessor that are no less protective than those in this DPA, and we remain fully liable to you for their performance.

7. Artificial intelligence

MadyHR's AI features, including the "Ask Mady" assistant, are provided using the Anthropic Claude API. Anthropic is engaged as a subprocessor under a written data processing agreement.

We confirm that:

• we use the Anthropic API under Anthropic's Commercial Terms, which provide that Anthropic does not train its models on customer content submitted through the API
• Anthropic deletes API inputs and outputs from its systems within 30 days by default
• MadyHR does not submit conversation feedback to Anthropic, which is the only route by which submitted content could otherwise be used for model improvement
• personal data sent to the AI service is limited to what the feature requires. National Insurance numbers and bank account details are never sent. When Ask Mady answers a question about one employee, the employee's name is replaced with a label before the question leaves MadyHR
• AI features do not make automated decisions that produce legal effects concerning your employees or similarly significantly affect them. All AI output is a suggestion or an alert for a person to review and act on

8. International transfers

Our production database, application services, cache, document storage and backups are hosted in the European Union. Transfers from the UK to the EEA are covered by UK adequacy regulations and require no further safeguard.

Where a subprocessor processes personal data outside the UK and EEA, we put in place an appropriate transfer mechanism under Chapter V UK GDPR: either the supplier's certification under the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. The mechanism applying to each subprocessor is stated on our Subprocessors page.

9. Assistance with data subject rights

MadyHR lets you view, correct, restrict and delete an individual employee's personal data from within the platform, and download individual records and documents. On request to support@madyhr.ai we will provide an export of an individual's data, or of all your data, in a structured, machine-readable format within 10 working days.

If a data subject contacts us directly about data we process on your behalf, we will not respond substantively. We will forward the request to you promptly and assist you in responding.

Taking account of the nature of the processing, we will assist you by appropriate technical and organisational measures, insofar as possible, in fulfilling your obligations to respond to requests to exercise data subject rights.

10. Assistance with security, breaches and impact assessments

We will assist you, taking into account the nature of processing and the information available to us, in complying with your obligations under Articles 32 to 36 UK GDPR.

Personal data breaches. We will notify you without undue delay after becoming aware of a personal data breach affecting personal data we process on your behalf. Our notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.

You are the controller and it is your decision whether the breach must be reported to the Information Commissioner's Office. We will not report on your behalf. We will give you the information you need to make that decision and to meet your own 72-hour deadline.

Impact assessments. We will provide reasonable assistance with data protection impact assessments and any prior consultation with the ICO. We maintain our own assessment of the MadyHR platform and will make it available to you on request.

11. Deletion or return of data

On termination or expiry of your subscription, you may download your records from within MadyHR or request a full export of your data, which we will provide within 10 working days.

We will delete all personal data processed on your behalf 30 days after termination, unless you have asked in writing for it to be returned, or UK law requires us to retain it. The 30 days gives you a recovery window.

Deleted data is removed from active systems immediately. Copies held in encrypted backups are not accessed or restored and are overwritten in the normal backup cycle, which completes within 35 days.

We will confirm deletion in writing on request.

12. Audit and information

We will make available to you the information necessary to demonstrate compliance with Article 28 UK GDPR, and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.

In practice, we will first offer our security documentation, our record of processing activities, and written answers to your security questionnaire. If that does not satisfy your obligations, we will agree a proportionate on-site or remote audit, on reasonable notice, no more than once in any twelve-month period unless a breach or a supervisory authority requires otherwise, and at your cost.

13. Liability and general

Liability under this DPA is subject to the limitations and exclusions in the main agreement between us.

This DPA is governed by the law of England and Wales and subject to the exclusive jurisdiction of the courts of England and Wales, wherever the Controller is located, in line with our Terms & Conditions. Nothing in this clause removes any protection the Controller is entitled to under mandatory data protection law in the place where it is established.

If any provision of this DPA conflicts with the main agreement, this DPA prevails in respect of data protection matters.

Annex A — Contact

Processor: MAKZEE LTD
383 High Street, Cowdenbeath, KY4 9QW, United Kingdom
Company number SC877764
ICO registration ZC248854
Data protection contact: support@madyhr.ai

Controller: the subscribing customer, as identified in their MadyHR account.

Annex B — Categories of personal data and data subjects

This Annex sets out the categories of personal data the MadyHR platform is capable of holding, and the categories of individual they relate to. Article 28(3)(a) UK GDPR requires a processing contract to specify both.

You decide what is actually entered into your account. Some customers use only part of the platform and hold far less than this list.

Categories of data subject: your employees, workers, contractors, job applicants, and their nominated emergency contacts.

Special category data. Sickness records are health data under Article 9 UK GDPR. Other special category data may be present depending on what you choose to record. You are responsible for identifying an Article 9 condition and, where required, maintaining an Appropriate Policy Document under Schedule 1 of the Data Protection Act 2018.

Criminal offence data. Where you record DBS results or declared convictions, that is criminal offence data under Article 10 UK GDPR and requires a condition under Schedule 1.

Previous version: 2.3, 24 September 2026. Changes in 2.4: incorporation into the Terms made explicit; governing law aligned with the Terms (England and Wales); data export wording corrected to describe what the platform does today; Ask Mady named and its name-labelling described; document storage location added to clause 5.