Giver HR data-processing agreement

Parties and subject

The registering company is controller and Giver is processor for its HR contents. Its authorised representative accepts this agreement. The subject is hosting and operating its personnel records for the service term: storing, organising, retrieving, editing, exporting and instructed deletion of employee, applicant and company-user information and files. The company determines necessity and lawfulness. Medical diagnoses, biometrics and other high-risk special-category processing require a separate documented scope and safeguards.

Instructions and confidentiality

Giver acts only on documented company instructions, including this agreement and authorised account actions, unless applicable law requires otherwise. Giver informs the company of legally required processing where permitted and flags potentially unlawful instructions. Authorised personnel must maintain confidentiality. Contact mmusiol@ongiver.com for instructions.

Security

Controls include separate native company databases, private files, server-side permissions, short-lived single-use email links, HTTPS, certificate-verified email transport, isolated service networks, malware checks before upload persistence, encrypted database tables and complete encrypted backups. Administrative service access is limited. Recovery is tested separately; an independent penetration test, off-site disaster recovery or certified financial archive is not promised.

Subprocessors

The company authorises IONOS for hosting and Resend for account-access messages. Giver gives at least 14 days' notice of a new or replacement subprocessor and considers justified privacy objections. Giver remains responsible for subprocessor obligations. HR documents are not delivered to Resend, AI, banks or benefit providers through this installation.

Assistance and incidents

Considering the nature of processing and available information, Giver assists with data-subject rights, security, breach assessment, impact assessments and regulatory consultation. Giver informs the company without undue delay after becoming aware of a personal-data breach and supplies and updates known facts. The company remains responsible for its own reporting and employment decisions.

Return, deletion and evidence

At service end, the company chooses return and/or deletion. The execution date is documented with support, retaining only records required by law. Instructions apply to backup copies and subsequent restoration. Giver supplies necessary compliance information and permits reasonable audits, including inspections by the company or its auditor, with protection for other customers. Other Giver products are not automatically altered.

International transfers

Any transfer outside the EEA must comply with Chapter V GDPR. Resend's applicable processing agreement and standard contractual clauses describe the access-email transfer. Giver maintains the agreed safeguards and informs the company of relevant changes.

Version and provider

giver-hr-20261013-v1. Giver, Maximilian Matthias Musiol, Ickstattstraße 26, 80469 München, Deutschland. mmusiol@ongiver.com