1. Roles and instructions

The customer acts as controller and AlloraHR as processor for customer data. AlloraHR processes personal data only to provide contracted services and on documented customer instructions, unless law requires otherwise.

2. Subject matter

Processing may include collection, organization, storage, consultation, use, disclosure and deletion of employee, candidate, payroll, attendance, performance and document data during the agreement and agreed post-termination period.

3. Customer obligations

The customer is responsible for lawful grounds, notices, consents, accurate data, authorized users, appropriate permissions and instructions that comply with applicable law.

4. Confidentiality and security

AlloraHR applies reasonable technical and organizational measures appropriate to the service, including encrypted connections, access controls and confidentiality obligations. Specific procurement requirements must be validated in writing.

5. Subprocessors and transfers

The customer provides general authorization for disclosed subprocessors under the agreement. AlloraHR remains responsible for appropriate contractual protections. International processing may occur under applicable transfer mechanisms.

6. Rights and incidents

AlloraHR provides reasonable assistance with data-subject requests and compliance obligations. Confirmed personal-data incidents are communicated without undue delay under the signed DPA.

7. Return, deletion and audit information

At the end of service, data is returned or deleted as agreed, subject to legal retention and backup lifecycle. Reasonable compliance information may be made available under confidentiality and security safeguards.

8. Precedence and signature

The signed DPA, customer agreement and applicable transfer clauses control over this public text. Request an execution copy at privacidad@allorahr.com.

Data Processing Addendum