Skip to content
Humrivo.
Legal

Data processing agreement

How WasiAxis processes personal data on behalf of companies that use Humrivo HR System.

Last updated October 2026

The short version

  • Your company is the controller of the personal data in its workspace; WasiAxis is the processor.
  • We process that data only on your documented instructions, keep it confidential and secure, and help you meet your obligations.
  • This agreement applies automatically to every workspace and forms part of our Terms of service.

  1. 1.Parties and roles

    This Data Processing Agreement ("DPA") is between the company that holds a Humrivo HR System workspace ("Customer", the controller) and WasiAxis, Bihari Colony, Chowk, Satellite Town, Bahawalpur 63100, Pakistan ("Processor"). It applies to personal data the Customer places in Humrivo HR System ("Customer Data").

  2. 2.Subject matter and details of processing

    • Purpose: providing HR, attendance, leave, payroll, document, communication and, where enabled, workplace monitoring features.
    • Data subjects: the Customer’s employees, contractors, applicants, managers and administrators.
    • Categories of data: identity and contact details, job and contract details, attendance and leave records, compensation and payroll data, documents, messages and, where enabled, device activity data and screenshots.
    • Duration: for the term of the Customer’s subscription and the deletion period below.

  3. 3.Processor obligations

    • Process Customer Data only on the Customer’s documented instructions, including those given through the product’s settings.
    • Ensure everyone with access is bound by confidentiality.
    • Maintain appropriate technical and organisational security measures, including encryption in transit and at rest, tenant isolation enforced on the server, role-based access and audit logging.
    • Assist the Customer with data subject requests, security, impact assessments and consultations with authorities, taking into account the nature of the processing.
    • Notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Data.
    • Make available the information needed to demonstrate compliance, and allow reasonable audits on notice.

  4. 4.Sub-processors

    The Customer authorises the following sub-processors: Google Cloud and Firebase (hosting, database, authentication, storage, functions); Vercel (web hosting); the platform’s configured email delivery provider; AI model providers, only for assistant requests; Jitsi (8x8), only for video meetings; and, when card payments are offered, a payment partner, for billing data. We impose data protection terms on each, remain responsible for their performance, and will give notice of changes so the Customer can object on reasonable grounds.

  5. 5.International transfers

    Customer Data is primarily stored in the United States. Where transfers require it, the parties rely on standard contractual clauses or another lawful transfer mechanism.

  6. 6.Return and deletion

    During the subscription, the Customer can export its data from the product. When the subscription ends, Customer Data is deleted within 30 days of a deletion request or account closure, and from backups within a further 90 days, unless the law requires us to keep it.

  7. 7.Precedence and contact

    If this DPA conflicts with the Terms of service on the processing of personal data, this DPA prevails. Data protection contact: privacy@wasiaxis.com, WasiAxis, Bihari Colony, Chowk, Satellite Town, Bahawalpur 63100, Pakistan.