Data Processing Addendum (DPA)

This Data Processing Addendum (“DPA”) forms part of the QuickHR Terms of Service (“Agreement”) between Enable Business Pte Ltd (“QuickHR”, “we”, “us”, “our”) and the Customer (“Customer”, “you”) and applies whenever QuickHR processes Personal Data on behalf of the Customer in connection with the Services.

This DPA is incorporated into and subject to the terms of the Agreement. Capitalized terms not defined herein have the meaning given in the Agreement.

• 1. Definitions

• Personal Data: As defined under Singapore’s Personal Data Protection Act 2012 (PDPA), including any information relating to an identified or identifiable natural person.
• Processing: Any operation performed on Personal Data, such as collection, storage, use, disclosure, or deletion.
• Controller: The party determining the purposes and means of Processing (the Customer).
• Processor: The party processing Personal Data on behalf of the Controller (QuickHR).
• Sub-Processor: Third parties engaged by QuickHR to assist in Processing Personal Data.

• 2. Roles of the Parties

• 2.1. The Customer acts as the Data Controller.
• 2.2. QuickHR acts as the Data Processor (or Data Intermediary under PDPA) processing Personal Data only on documented instructions from the Customer.
• 2.3. QuickHR is not required to comply with any instruction that is unlawful or would expose QuickHR to regulatory, security, or operational risk.

Where Deemed Consent by Notification (DCbN) applies, it will be for limited purposes such as service analytics to improve functionality or security threat monitoring, in line with PDPA requirements.

• 3. Scope & Purpose of Processing

QuickHR processes Personal Data solely:

• To provide the QuickHR HRMS platform and related services;
• To support, secure, maintain, and improve the services;
• To fulfill contractual obligations under the Agreement;
• To comply with applicable laws and regulations.

QuickHR will not process Personal Data for its own purposes unless required by law or with the Customer’s written consent.

QuickHR may generate aggregated, anonymised statistical data for service improvement, security monitoring, and benchmarking, which does not identify Customer or any individual.

• 4. Data Subject Rights

QuickHR will:

• Promptly assist the Customer in responding to data access, correction, withdrawal, and other data subject rights requests;
• Direct data subjects to the Customer when requests relate to Personal Data controlled by the Customer.

• 5. Security Measures

QuickHR maintains an Information Security Management System (ISMS) aligned with:

• ISO 27001
• SS 714:2025 (DPTM)

Security measures include but are not limited to:

• Role-based access controls
• Encryption in transit and at rest
• Multi-factor authentication (MFA) for admin access
• Regular vulnerability assessments and penetration tests
• Secure Software Development Lifecycle (SSDLC) practices
• Incident response and breach notification procedures

More details: QuickHR Security & Data Protection

• 6. Sub-Processors

QuickHR may engage Sub-Processors (e.g., hosting providers) to support service delivery. QuickHR will:

• Maintain an up-to-date Sub-Processor list;
• Ensure Sub-Processors are bound by written data protection obligations equivalent to this DPA;
• Remain responsible for Sub-Processors’ actions.

Customer may object to a new Sub-Processor within fourteen (14) days of notice. If such objection is reasonable and unresolved, QuickHR may terminate the affected Services without liability.

• 7. Cross-Border Transfers

QuickHR’s live production hosting and ordinary processing of Customer Personal Data are conducted in Singapore, using AWS Singapore Region infrastructure, unless otherwise expressly agreed in writing with the Customer.

QuickHR does not routinely transfer or store Customer Personal Data outside Singapore as part of normal production operations.

For disaster recovery, business continuity, severe cloud-region outage, legal compliance, security incident response, or other exceptional operational necessity, QuickHR may activate, replicate, restore, or process limited Customer Personal Data in an overseas recovery region or environment, including AWS regions outside Singapore.

Any such overseas processing will be limited to what is necessary for continuity, recovery, security, or compliance purposes, and will be subject to appropriate technical, organisational, and contractual safeguards designed to provide a standard of protection comparable to the PDPA.

Where GDPR, UK GDPR, or other overseas transfer rules apply to a specific Customer, the parties may enter into the applicable Standard Contractual Clauses, UK International Data Transfer Addendum, or other lawful transfer mechanism by separate written agreement.

• 8. Breach Notification

In the event of a confirmed Personal Data breach impacting Customer data, QuickHR will:

• Notify the Customer within 24 hours of confirmation;
• Provide details of the nature, scope, and mitigation actions;
• Cooperate with the Customer to meet any legal or regulatory obligations.

• 9. Data Retention & Deletion

• Customer HRMS data can be exported within 30 days post-termination of services.
• After 30 days, production data will be deleted within a commercially reasonable timeframe subject to backup cycles and legal retention requirements.
• QuickHR retains metadata required for legal or audit purposes only where necessary and in compliance with PDPA.

• 10. Audits & Compliance

QuickHR will make available reasonable information (e.g., ISO certificates, audit reports) to demonstrate compliance with this DPA. Formal on-site audits require 30 days’ notice and must not unreasonably disrupt operations.

QuickHR maintains detailed internal security, data protection, and sub-processor documentation which can be made available to customers, regulators, or auditors upon request through our Data Protection Officer (DPO).

• 11. Liability & Indemnification

Liability under this DPA is governed by the limitation of liability set out in the Agreement. Each party remains responsible for its own breaches of data protection obligations.

QuickHR shall not be liable for regulatory penalties or fines arising from Customer’s instructions, business practices, or failure to comply with Controller obligations.

• 12. Term & Termination

This DPA terminates automatically upon termination of the Agreement. Clauses relating to confidentiality, security, and post-termination data handling survive termination.

• 13. Governing Law

This DPA is governed by and construed in accordance with the laws of the Republic of Singapore.

• 14. GDPR Applicability

QuickHR’s services are primarily designed, hosted, and operated for customers in Singapore and the Asia-Pacific region, and this DPA is primarily governed by Singapore law and the Personal Data Protection Act 2012 (“PDPA”).

Where, and only to the extent that, the EU General Data Protection Regulation (“GDPR”), UK GDPR, or similar overseas data protection law applies to the processing of Personal Data under the Agreement, the parties agree that:

• (a) the Customer acts as the Controller, and QuickHR acts as the Processor, unless otherwise expressly agreed in writing;
• (b) QuickHR shall process Personal Data only on the Customer’s documented instructions, including with respect to any transfer of Personal Data, unless required by applicable law;
• (c) QuickHR shall maintain appropriate technical and organisational measures designed to protect Personal Data against unauthorised or unlawful processing, accidental loss, destruction, or damage;
• (d) QuickHR shall ensure that personnel authorised to process Personal Data are subject to appropriate confidentiality obligations;
• (e) QuickHR may engage Sub-Processors in accordance with this DPA, provided that such Sub-Processors are bound by written obligations no less protective than those set out in this DPA;
• (f) QuickHR shall provide reasonable assistance to the Customer, taking into account the nature of the processing and information available to QuickHR, in responding to data subject rights requests and meeting applicable security, breach notification, and compliance obligations; and
• (g) upon termination of the Services, QuickHR shall return, delete, or anonymise Personal Data in accordance with this DPA, subject to backup cycles, legal retention obligations, and legitimate audit or compliance requirements.

Where GDPR or UK GDPR transfer safeguards are legally required for a specific Customer, the parties may enter into the applicable Standard Contractual Clauses, UK International Data Transfer Addendum, or other lawful transfer mechanism by separate written agreement.

• 15. Contact Information

For data protection inquiries:

• Data Protection Officer (DPO)
• Email: dpo [at] quickhr.co
• Phone: +65 6908 8158
• Address: Enable Business Pte Ltd, 60 Paya Lebar Road, #07-38 Paya Lebar Square, Singapore 409051