Data Processing Agreement

1. Roles

For the personal data the Customer and its users enter into Perm ("Customer Personal Data"), the Customer is the controller and Perm is the processor. Where the Customer is a recruiting agency acting for a client employer, the agency confirms that it is authorised by that employer to use Perm, and Perm acts as its sub-processor. [to confirm]

For the data of the Customer's users that Perm needs to run accounts, sign-in security and invoicing, Perm is a separate controller, as described in its Privacy Policy.

2. Subject matter, duration, nature and purpose

Subject matter: providing the Perm service, an online application for keeping the employment, immigration and compliance records of the Customer's workers.

Duration: the term of the Terms of Service, plus the period until the data is deleted under section 13.

Nature: hosting, storing, organising, displaying, exporting, sending reminders about, and deleting data, plus encrypted backups.

Purpose: to let the Customer meet its record-keeping and reporting duties as an employer, track document validity and deadlines, inform its staff and workers, and apply retention periods.

3. Data subjects

• the Customer's employees and workers, current and former, most of them non-EU nationals;
• candidates for employment, including those never hired;
• site managers and other contacts the Customer records;
• the Customer's users of Perm.

4. Categories of personal data

The data includes a national identification number (CNP), which the Customer must process in line with Law 190/2018 (including its article 4 where the Customer relies on legitimate interests), and limited data concerning health (medical fitness). The Customer must not upload diagnoses or other medical details. The categories are:

• identity data: name, date of birth, nationality, personal numeric code (CNP) and passport number;
• identity, residence and work permit documents and their scans;
• contact details: phone, email, consent to WhatsApp messages;
• employment data: site, job, contract, employment status, absences, departures and the dates of notifications to IGI;
• timesheets and gross salaries;
• medical fitness: fit or unfit and the expiry date only, and the scan of the fitness certificate; never diagnoses;
• training records and housing proof;
• reminder messages sent and their delivery status;
• activity log entries: which user viewed, changed or exported what, with time, IP address and browser for sign-ins.

5. Customer's instructions

Perm processes Customer Personal Data only on the Customer's documented instructions, including for transfers to third countries, unless EU or Romanian law requires otherwise, in which case Perm informs the Customer first unless the law prohibits it. The Customer's instructions are the Terms of Service, this DPA, and the Customer's use and configuration of Perm (for example the retention settings, deletions and exports it carries out). Further instructions must be agreed in writing.

Perm will tell the Customer immediately if, in its opinion, an instruction infringes data protection law.

The Customer is responsible for the lawfulness of the processing, including having a legal basis, informing data subjects, and the accuracy of the data.

6. Confidentiality

Perm ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality. Access to production systems is limited to the staff who need it to run the service. Perm's staff accounts in the application can create, pause and restore customer accounts but cannot open the Customer's worker records or documents.

7. Security

Perm implements the technical and organisational measures described in Annex 1, which are appropriate to the risk under article 32 GDPR. Perm may update them, provided the overall level of protection is not reduced. Perm does not currently hold security certifications such as ISO 27001 or SOC 2.

8. Sub-processors

The Customer gives Perm a general written authorisation to engage sub-processors. The current sub-processors are listed on the sub-processors page.

Perm will announce any new or replacement sub-processor on that page and notify the Customer's administrators by email at least 30 days before it starts processing Customer Personal Data. [to confirm] The Customer may object on reasonable data protection grounds within that period. The parties will then discuss the objection in good faith; if they cannot resolve it, the Customer may terminate the affected service and receive a refund of fees prepaid for the period after termination.

Perm imposes on each sub-processor, by contract, data protection obligations equivalent to those in this DPA, and remains liable to the Customer for its sub-processors' performance.

9. International transfers

Customer Personal Data is hosted in the EU (Railway, EU West, Amsterdam), and backups are stored with an EU location. Some sub-processors are established in the United States, and transactional emails are sent through a provider in the United States. Perm transfers Customer Personal Data outside the European Economic Area only in accordance with Chapter V GDPR, relying on the EU-US Data Privacy Framework where the recipient is certified or on the European Commission's standard contractual clauses. The Customer authorises these transfers.

10. Assistance with data subject rights

Perm provides functions in the application that let the Customer handle data subject requests itself: viewing and correcting data, exporting it, and deleting a worker's data on request. The deletion function shows which data can be deleted at once and which must be kept for a legal period and until when, in line with article 17(3)(b) GDPR, and keeps the remaining data restricted until it can be deleted.

If Perm receives a request directly from a data subject, it will not answer it itself but will forward it to the Customer without undue delay, where the Customer can be identified. Perm will provide further reasonable assistance on request.

11. Personal data breaches

Perm will notify the Customer of a personal data breach affecting Customer Personal Data without undue delay and in any case within 48 hours of becoming aware of it. [to confirm] The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Perm will supplement the notice as more information becomes available and will take reasonable steps to contain the breach.

The Customer, as controller, is responsible for notifying the supervisory authority (ANSPDCP) within 72 hours of becoming aware of the breach, where required, and for informing data subjects where required. Perm will assist with the information it has.

12. Impact assessments and prior consultation

Processing in Perm involves national identification numbers, limited health data and data about workers who may be in a vulnerable position, so the Customer may need to carry out a data protection impact assessment (DPIA). Perm will provide the information reasonably needed for the Customer's DPIA and any prior consultation with the supervisory authority, including the descriptions in this DPA and its annexes.

13. Retention, deletion and return

During the agreement, Perm deletes Customer Personal Data automatically according to the retention periods in Annex 2, as configured by the Customer. Perm warns the Customer's administrators by email 14 days before scheduled deletions (reminder message texts are cleared monthly without an email). The Customer can lengthen a period (with a reason) and can pause deletions, for example during an inspection or legal dispute.

When the agreement ends, the Customer can export its data as described in the Terms of Service. Perm deletes Customer Personal Data within 90 days after the end of the agreement [to confirm], unless EU or Romanian law requires Perm to keep it. Copies in encrypted backups expire within a further 35 days. The Customer's own legal duties to keep records continue after the agreement ends, and it must export the data it needs to meet them.

14. Information and audits

Perm will make available to the Customer the information necessary to demonstrate compliance with article 28 GDPR, including written answers to reasonable security questionnaires.

If that information is not sufficient, the Customer, or an independent auditor bound by confidentiality, may audit Perm's compliance with this DPA, at most once a year (or after a personal data breach, or at a supervisory authority's request), with at least 30 days' written notice, during business hours, without unreasonably disrupting Perm's operations and without access to other customers' data. Each party bears its own costs. [to confirm]

15. Liability and precedence

Each party's liability under this DPA is subject to the limits in the Terms of Service [to confirm], without prejudice to the rights of data subjects under article 82 GDPR. If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails.

Annex 1: Security measures

Summary of the technical and organisational measures in place:

• Hosting: a single EU region (Railway, EU West, Amsterdam).
• Encryption in transit: the application is served only over HTTPS.
• Backups: nightly backups of the database and scans, encrypted with AES-256-GCM before they leave the server and stored with an EU provider that does not hold the key; deleted automatically after 35 days. A tested restore procedure is documented.
• Access by role: admins, HR, site managers and viewers have different permissions; site managers see only the workers of their own site; salaries and payroll are visible only to the employer's admins and HR; agency recruiters see only the clients assigned to them.
• Authentication: passwords are stored only as salted scrypt hashes; sessions use a secure, HTTP-only cookie and expire after 14 days; an account is locked for 15 minutes after 5 failed sign-in attempts.
• Activity log: views, changes, downloads, exports and sign-ins are recorded with the user and time. Entries are hash-chained so that any later change is detectable, and a daily fingerprint of the log is emailed to the Customer's admins. For identity, contact and pay fields the log records which field changed, never the values.
• Data minimisation: medical fitness is limited to fit or unfit and the expiry date; reminder messages contain no document numbers or scans; WhatsApp is used only with the worker's consent; audit packs are shared with inspectors through links that expire.
• Retention: automatic deletion according to Annex 2, with advance warning and a log entry for each deletion that contains no deleted data.
• Staff access: Perm staff accounts cannot open the Customer's worker records or documents in the application.

Annex 2: Retention periods

Default periods applied by Perm. The Customer can lengthen any period that can be changed, giving a reason, but can never shorten one below the legal minimum.

• Payroll (salary history, payroll exports): 5 years from 1 July of the year following the record's year (legal minimum; Law 82/1991, art. 25).
• Timesheets: 5 years from 1 July of the year following the record's year (legal minimum; Labour Code art. 119, Law 82/1991, art. 25).
• Contracts (contract scan, REGES extract): 5 years from 1 July of the year following the end of the contract (legal minimum; GD 295/2025, Law 82/1991, art. 25).
• Identity (name, CNP, passport number, nationality): kept until the last of payroll, timesheets and contracts is due, then anonymised.
• Permit and ID scans, training records, housing proof: 5 years after the end of the employment (legal minimum; OUG 32/2026 art. 7(1)(i), which requires the employer to keep a copy of the travel document or residence permit and the documents proving compliance with art. 7 for at least five years after the employment ends).
• Medical fitness: 3 years after the end of the contract.
• Status events (absences, departures, IGI notification dates): 5 years after the end of the contract.
• Contact details: 1 year after the end of the contract.
• Reminder message texts: 12 months after sending; the date and delivery status are kept with the worker's record.
• Candidates never hired: ID scans 14 days after the candidate is dropped; everything else 6 months after.
• Activity log: 24 months (same for all customers).
• Backups: 35 days.

Annex 3: Sub-processors

The current list, with purpose, data, location and transfer mechanism, is on the sub-processors page.