Scope
This addendum applies when SalaryFy acts as a processor on your behalf — typically for HR / enterprise customers deploying SalaryFy to their employees.
Roles
Controller: the customer (e.g. the employer deploying SalaryFy).
Processor: SalaryFy, acting on the controller's documented instructions.
Sub-processors: listed on request; added only with prior written notice.
Security measures
SalaryFy implements technical and organisational measures documented in our Security page, including encryption, access control, monitoring and annual penetration testing.
Data subject rights
SalaryFy will assist the controller in fulfilling data subject requests (access, correction, deletion, portability) within 30 days.
Breach notification
We will notify the controller within 48 hours of becoming aware of any personal-data breach affecting their users.
Cross-border transfers
Primary storage is in India. Any cross-border transfers are done only with the controller's explicit consent and appropriate safeguards.
Return or deletion
On termination, all personal data will be returned or irrevocably deleted within 60 days, with written confirmation.