Data Processing Agreement

This agreement forms part of the Terms of Service. It applies when Birch processes personal data in Customer Data. The Customer is the data fiduciary (DPDP Act 2023) or business/controller (US state laws), and Birch is the data processor or service provider.

• Subject matter and purpose: providing Birch's HR software and support.
• People: the Customer's employees, contractors, applicants and their nominees or dependants, and the Customer's users.
• Data: identity and contact details, employment and job data, leave, time and roster records, documents, and for Indian payroll, salary, bank and statutory identifiers (PAN, Aadhaar where entered, PF, ESIC).
• Duration: while the Customer's account is active, plus the deletion period in section 9.

Birch processes personal data only to provide the service and on the Customer's documented instructions, which include these terms and the Customer's use of Birch's features. Birch does not sell the data or use it for its own purposes, and will tell the Customer if it believes an instruction breaks the law.

Anyone at Birch with access to personal data is bound by confidentiality and only gets the access their work needs.

Birch keeps the technical and organizational measures described on its security page, and will not materially weaken them during the term.

The Customer authorizes the subprocessors on the subprocessors page. Birch will give 30 days' notice before adding one, and the Customer may object on reasonable data protection grounds. Birch puts equivalent data protection terms in place with each subprocessor and remains responsible for them.

Birch will tell the Customer without undue delay, and within 72 hours, of becoming aware of a breach affecting Customer personal data. It will share what it knows and help the Customer meet its own duties, including notifying the Data Protection Board of India and affected people under the DPDP Act.

Birch will pass on requests it receives from the Customer's employees and help the Customer respond to requests to access, correct or erase data, and with any data protection impact assessments the Customer has to carry out.

When the account ends, the Customer can ask for an export within 30 days. Birch then deletes Customer personal data, including from backups as they expire, unless the law requires it to be kept.

Customer Data is stored in the United States. For Indian customers, the transfer is made as permitted under section 16 of the DPDP Act 2023. If Birch takes on customers whose law requires specific transfer terms, it will add them here.

Birch will answer reasonable written questions about its compliance with this agreement once a year, or after a breach. Birch does not hold a third-party certification yet; its security page says which ones are planned.