Skip to content

Data Processing Agreement

Last updated: October 7, 2026

This version replaces the version of May 13, 2026, which remains available in the archive. For a Customer that accepted an earlier version, this version takes effect 30 days after the Supplier notifies the Customer of it, as set out in the Agreement.

1. Parties

This Data Processing Agreement (“DPA”) is established between the Customer (including its affiliates that the Customer authorises to use the Service under its account, on whose behalf the Customer enters into this DPA and exercises their rights under it, except where Applicable Law requires an affiliate to exercise a right itself) and Taito.hr Oy, Business ID 3432713-2 (“Supplier”). It forms part of the Taito.ai Terms of Service or any other agreement under which the Supplier provides the Service to the Customer (the “Agreement”).

2. Background

2.1 The Supplier provides Taito.ai, a cloud-based human resources information system (the “Service”). This DPA covers the personal data the Supplier processes on the Customer’s behalf in the Service, including in:

  • the people directory and employee records, including employments, positions, compensation and custom fields configured by the Customer
  • time off, absence and attendance, including timesheets
  • documents, document templates and electronic signature
  • performance reviews, feedback and forms
  • the AI assistant and AI agents, including agents the Customer schedules or triggers (“AI features”)
  • access to the Service from the Customer’s own tools through the Supplier’s Model Context Protocol (MCP) server and APIs
  • integrations the Customer enables, such as payroll and accounting systems, applicant tracking systems, Slack, and email and calendar services

3. Terms for Data Processing

3.1 General

The Customer acts as the data controller while the Supplier functions as the processor. Terms align with the General Data Protection Regulation (2016/679/EU) (“GDPR”) and any other data protection and employment laws that apply to the processing (“Applicable Law”). References to provisions of the GDPR include the corresponding provisions of other Applicable Law.

The Supplier acts as an independent controller, not as the Customer’s processor, only for the personal data of the Customer’s authorised users and contact persons that it needs to manage the customer relationship, bill for the Service, secure the Service and meet its legal obligations, such as account, billing and technical log data. That processing is described in the Privacy Notice. It does not include the content of Customer personal data processed in the Service, which the Supplier processes only as processor.

3.2 Description of Processing

Nature and purpose. The Supplier processes personal data only to provide the Service under the Agreement. Processing consists of storage, structuring, retrieval and display; automated and AI-assisted processing (Section 3.3); document generation; transmission to third parties at the Customer’s instruction, such as e-signature, payroll and accounting services; and deletion.

Duration. For the term of the Agreement and until deletion under Section 3.4.

Data subjects. Current and former employees, contractors, interns and other workers of the Customer; job applicants, to the extent the Customer imports or accesses applicant data through an integration; emergency contacts, dependants and other persons whose data the Customer enters; and the Customer’s authorised users of the Service.

Categories of personal data. The Customer determines which personal data it enters into the Service, including through configurable custom fields, free-text fields, uploaded documents, integrations, and inputs to AI features. Typical categories are listed in Annex 1. The Customer is responsible for ensuring it has a lawful basis for each category and for configuring the Service’s data classification controls accordingly.

Special categories and national identification numbers. The Service does not require processing of special categories of personal data (GDPR Art. 9), personal data relating to criminal convictions and offences (Art. 10), or national identification numbers, the use of which many jurisdictions restrict (GDPR Art. 87). Where the Customer nonetheless enters such data, the Customer shall:

  • (a) ensure the processing is lawful under the law applicable to it (Section 3.1)
  • (b) where it stores such data in fields, use only custom fields it has classified in the Service: national identification numbers and bank account details as Restricted, and special category and criminal offence data as Secret. Time-off data is governed by the paragraph below
  • (c) instruct its users not to enter such data into free-text fields or AI conversations, where classification cannot be applied, and take into account that documents stored in the Service can be read by AI features (Section 3.3(f))

The Supplier processes such data solely as instructed and applies the safeguards in Section 3.3.

Time off and absence. The Customer defines its own time-off types, such as annual leave or sickness absence, and how they are named and grouped. By default, the Service records only the time-off type, the dates and the approval status of each absence. It records more, such as a comment on a request, only if the Customer or its users choose to enter it. A time-off type such as sickness absence may in itself constitute data concerning health. The Customer controls through the Service’s permission settings which of its users can see other employees’ time-off data, and AI features can see it only within the permissions of the user concerned (Section 3.3(c)). If the Customer chooses to record more than these defaults, such as the reason for an absence, it does so as controller and should make sure this is consistent with Applicable Law. The sub-processor list states which AI sub-processors the Service uses and for which functions (Section 3.8).

3.3 AI-Assisted Processing

(a) Providers. The AI features process personal data using large language models provided by the AI sub-processors named on the sub-processor list (Section 3.8). The Customer may select the provider its account uses for AI conversations from those the Service offers for selection. The Supplier may use other AI sub-processors on the list for supporting functions, such as search.

(b) No training. Neither the Supplier nor its AI sub-processors may use Customer personal data to train or improve AI models. The Supplier engages AI sub-processors only on terms that prohibit such use and that limit their retention of inputs and outputs to what they need to provide their service and to detect abuse. The sub-processor list states the retention period of each AI sub-processor, and a change to it is treated as the engagement of a new sub-processor under Section 3.8. The Supplier does not export the content of AI inputs or outputs to its product analytics providers.

(c) Access. AI features access Customer personal data with the permissions of the user who uses them or, for an agent, of the user who owns it.

(d) Classified fields. The Customer may classify custom fields as Restricted or Secret, and decides which of its users may change a field’s classification. According to the classification configured by the Customer, the Supplier does not transmit the value of a Restricted field to an AI sub-processor, and transmits an opaque reference in its place, and does not transmit a Secret field at all, nor indicate whether it holds a value. These controls apply to every AI channel of the Service, including the assistant, agents, Slack and MCP connections, whatever the permissions of the user.

(e) Masking of entered text. The Service applies best-effort masking to messages that users enter into AI conversations, designed to detect and remove the most common formats of national identification numbers and bank account numbers before a message is stored or transmitted to an AI sub-processor. Masked values cannot be recovered. Masking is a supplementary safeguard and does not ensure that every identifier is detected. The Customer remains responsible for the content its users enter into AI features, and shall instruct its users not to enter personal data that the Customer has not authorised for AI processing.

(f) Limits of these controls. Documents stored in the Service that a user can access, and files a user attaches to an AI conversation, may be read in full by AI features. Data other than classified fields, including absence data and built-in fields, is available to AI features within the user’s permissions. The Customer is responsible for instructing its users accordingly, including not to enter Restricted or Secret data into AI conversations. The Supplier is not responsible for the consequences of the classification and permission settings configured by the Customer, provided that the Service applies those settings as described in this Section 3.3 and Annex 2.

(g) Human oversight. The AI features are not designed to take decisions based solely on automated processing that produce legal or similarly significant effects on data subjects (GDPR Art. 22). The Customer shall not use them for such decisions, or for any practice prohibited by Article 5 of the Artificial Intelligence Act (2024/1689/EU), such as inferring the emotions of workers. The AI features act on the instructions of the Customer’s users, and a person remains in the loop for, and responsible for, decisions affecting data subjects. The Service asks for a user’s approval before AI features carry out an action that changes data in the Service or sends it outside the Service, such as updating an employee record or sending data to a payroll service. A user may give that approval in advance for an agent or a conversation. AI outputs can be inaccurate. The Customer remains responsible for reviewing them and for decisions it takes using them, including on recruitment, pay, performance, promotion and termination, and for any obligations it has as a deployer under the Artificial Intelligence Act.

(h) Customer-connected AI tools. Where the Customer connects its own AI tools to the Service, for example through MCP, the provider of that tool is not a sub-processor of the Supplier. Personal data retrieved by that tool is disclosed at the Customer’s instruction, and the Customer is responsible for its arrangement with that provider. Section 3.3(d) applies to such connections.

(i) AI conversations. AI conversations and the summaries and memories derived from them are Customer personal data and are deleted under Section 3.4.

3.4 The Supplier’s General Obligations

The Supplier shall:

  • Process personal data only on documented instructions from the Customer, including with regard to transfers to third countries, unless required to do so by law to which the Supplier is subject, in which case the Supplier shall inform the Customer of that requirement before processing unless the law prohibits it. The Agreement, this DPA, the Customer’s configuration of the Service, and actions taken in the Service by the Customer’s authorised users, including instructions they give to AI features, constitute the Customer’s documented instructions. Instructions given to AI features are instructions of the Customer only to the extent the resulting processing is within the purposes of this DPA and the permissions of the user concerned, and the Supplier remains responsible for the AI features operating as described in Section 3.3. Additional instructions require prior written agreement between the parties. The Supplier may decline an instruction that it cannot implement within the Service’s standard functionality, in which case it informs the Customer without undue delay
  • Inform the Customer without delay if, in its opinion, an instruction infringes data protection legislation. The Supplier is not required to follow such an instruction until the matter is resolved
  • Ensure that persons authorised to process the personal data are bound by confidentiality. Supplier personnel access Customer personal data only as necessary to provide, maintain and secure the Service or to comply with law. They access the Customer’s account in the Service only under a time-limited support grant issued by the Customer’s administrator. Access to production systems outside a support grant is limited to authorised personnel who need it to maintain or secure the Service
  • Process personal data in accordance with data protection legislation (including but not limited to the GDPR)
  • Notify the Customer of any requests received from data subjects or supervisory authorities
  • Not use personal data beyond the stated purposes, and not sell it
  • On termination of the Agreement, at the Customer’s choice return the personal data in a commonly used, machine-readable format and/or delete it. The Supplier keeps the personal data available for export for 30 days unless the Customer instructs earlier deletion, and then deletes it from active systems, and from backups as they expire in the ordinary backup rotation, and in any event within 90 days, unless law to which the Supplier is subject requires its storage. Until deleted, backups are protected under this DPA and not used for any other purpose. The Supplier confirms the deletion in writing on request

3.5 The Supplier’s Assistance Obligations

The Supplier shall assist the Customer in:

  • Responding to data subject and supervisory authority requests, including the erasure of specified personal data the Customer cannot delete through the Service
  • Complying with GDPR requirements regarding security, breaches, impact assessments, and prior consultations with supervisory authorities
  • Carrying out data protection impact assessments of the AI features and meeting its obligations as a deployer under the Artificial Intelligence Act, by providing the information reasonably necessary for that purpose, including data flows, sub-processors, and the intended purpose and known limitations of the AI features. The Supplier informs the Customer without undue delay if it considers that an AI feature falls within Annex III of that Act

The Supplier provides assistance that goes beyond reasonable routine support, such as extensive impact assessment or data extraction work, at the Customer’s reasonable cost agreed in advance, unless the assistance is needed because of the Supplier’s breach of this DPA.

3.6 Security

The Supplier shall take appropriate technical and organisational measures to protect personal data from unauthorised access, loss, or any other unlawful processing, as required by GDPR Art. 32. The Supplier implements at least the measures in Annex 2. Further detail is published in the Supplier’s trust center at trust.taito.ai and provided on request. The Supplier may update them, provided that the overall level of security is not reduced during the term of the Agreement.

3.7 Personal Data Breaches

The Supplier shall notify the Customer without undue delay after becoming aware of, or reasonably suspecting, a personal data breach affecting Customer personal data, and in any event within 48 hours after becoming aware of it, by email to the Customer’s account contact and to any security contact the Customer designates. The Customer designates security and privacy contacts under this DPA by notice to legal@taito.ai. The notification shall include, to the extent then available, the information listed in GDPR Art. 33(3), with further information provided as it becomes available. The Supplier shall take the measures necessary to contain and remediate the breach, and cooperate with the Customer in any investigations and in notifications to supervisory authorities and data subjects. The Supplier does not notify data subjects of the breach on the Customer’s behalf without the Customer’s prior consent, unless required by law.

3.8 Sub-processors

By agreeing to this DPA, the Customer gives the Supplier general written authorisation, within the meaning of GDPR Art. 28(2), to engage the sub-processors on the authorised list, at the processing locations stated in it, and to add or replace sub-processors under this Section. No separate approval is required. The Supplier shall:

  • Impose on each sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA
  • Monitor sub-processor performance
  • Remain fully liable to the Customer for the acts and omissions of sub-processors
  • Notify the Customer of any intended new sub-processors at least 30 days before they begin processing personal data, by email to the Customer’s account contact and to any privacy contact the Customer designates. The Customer may object to a new sub-processor on reasonable data protection grounds by notifying the Supplier in writing during that period; the Supplier will work with the Customer in good faith to address the concern. If the concern cannot be resolved within 30 days of the objection, the Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the unused portion of the term. A new sub-processor is authorised when the notice period ends without an unresolved objection

The current list of authorised sub-processors, with the legal entity, purpose, processing location, transfer mechanism and, for AI sub-processors, the functions and retention period of each, is maintained at trust.taito.ai/subprocessors, forms part of this DPA, and is provided as a copy on request. The Supplier keeps this information complete and up to date. If information is missing for a sub-processor, the Customer may object to that sub-processor under this Section as if it were newly engaged. A change in a sub-processor’s processing location or transfer mechanism is treated as the engagement of a new sub-processor, except where the Supplier relies on another transfer mechanism under Section 3.9 because the previous one ceases to apply, or where the change is required by the sub-processor’s terms. In those cases the Supplier notifies the Customer without undue delay.

Third-party services that the Customer connects to the Service, such as its payroll, e-signature or applicant tracking system, are not sub-processors of the Supplier. Personal data sent to them is disclosed at the Customer’s instruction.

3.9 International Transfers of Personal Data

The Service’s primary databases and their backups are located in the European Economic Area. The Supplier transfers personal data outside the European Economic Area only to sub-processors on the authorised list, and only under a transfer mechanism of Chapter V of the GDPR: an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework for certified recipients, or the Standard Contractual Clauses together with any supplementary measures required. The sub-processor list states the processing location and transfer mechanism for each sub-processor.

Where a transfer relies on the EU-U.S. Data Privacy Framework, the Supplier ensures that the Standard Contractual Clauses, or another mechanism under Chapter V, apply if the adequacy decision is invalidated, suspended or ceases to cover that sub-processor. The Supplier maintains a transfer impact assessment for each transfer that relies on the Standard Contractual Clauses and provides a summary to the Customer on request. If a public authority requests access to Customer personal data, the Supplier shall, and shall require its sub-processors to, notify the Customer unless prohibited by law, challenge the request where there are reasonable grounds to consider it unlawful, and disclose only the minimum personal data required.

By agreeing to this DPA, the Customer approves the transfers to listed sub-processors and their stated locations. A transfer to a sub-processor authorised under Section 3.8 requires no separate approval, provided a transfer mechanism under this Section is in place.

3.10 Auditing

The Customer may audit the Supplier’s actions and data related to personal data processing to verify compliance with this DPA. The Supplier must receive at least 14 days’ written notice prior to any audit. The Supplier may first answer the Customer’s request with documentation, such as its ISO/IEC 27001 certificate, security reports and completed questionnaires. If the documentation does not reasonably satisfy the Customer’s verification needs, the Customer, or an independent auditor it appoints that is bound by confidentiality and is not a competitor of the Supplier, may carry out an audit, including an on-site inspection. An on-site audit may take place at most once in any 12-month period, unless required by a supervisory authority or following a personal data breach. Each party bears its own costs, except that the Supplier bears the reasonable costs of an audit that reveals material non-compliance with this DPA, and remedies the non-compliance without undue delay.

3.11 Liability, Precedence and Changes

Liability under this DPA is subject to the limitations in the Agreement, including the separate limitation for breaches of data protection and confidentiality obligations, except where GDPR Art. 82 or other applicable law does not permit limitation. Nothing in this DPA limits either party’s liability to data subjects or its right of recourse under GDPR Art. 82(4) and (5). In matters of data protection, including the use of Customer personal data and of any data derived from it, this DPA prevails over the Agreement. The Supplier may update this DPA with at least 30 days’ notice of material changes by email to the Customer’s account contact and to any privacy contact the Customer designates. An update that materially reduces the protection of personal data or the Customer’s rights under this DPA takes effect for the Customer at the start of its next renewal term, unless it is required by law or by a supervisory authority, is needed to address a security risk, or is required by the terms of a sub-processor or by a change of sub-processor or transfer mechanism under Section 3.8 or Section 3.9. If the Customer reasonably considers that an update reduces the protection of personal data or its rights under this DPA, it may object by notifying the Supplier in writing before the notice period ends, and may then terminate the Agreement with effect from the date the update takes effect for it. If such an update takes effect during a paid term under one of these exceptions and the Customer terminates for that reason, the Supplier refunds prepaid fees for the unused portion of the term.

Annex 1: Illustrative Categories of Personal Data

This annex is illustrative. The Customer determines the personal data processed (Section 3.2). Typical categories are:

  • Identity: Full name, preferred name, date of birth, gender, nationality, photograph, employee number, national identification number
  • Contact information: Work and personal email address, phone number, home address, Slack user identifier
  • Emergency contacts: Name, phone number and relationship of persons the employee nominates
  • Employment information: Employment type and status, start and end dates, probation and notice periods, employment contract terms, role, job title, job level, team, working location, supervisory relationships
  • Compensation and payroll: Salary and benefits, pay currency and frequency, bank account details, data transmitted to payroll and accounting systems
  • Working time and absence: Working patterns, timesheets and attendance, time-off requests and balances, absence types including sickness and parental leave
  • Documents and signatures: Uploaded and generated documents, electronic signature records
  • Performance data: Reviews, employee feedback, goals, personal development plans, form responses
  • Applicant data: Candidate data imported from, or accessed in, the Customer’s applicant tracking system
  • AI and communication data: Content of AI conversations, files shared with AI features, agent instructions and outputs, tasks and notifications
  • Account data: User accounts, login identifiers, permissions, audit records
  • Other data the Customer chooses to enter

Annex 2: Technical and Organisational Measures

The Supplier implements at least the following measures. They may be improved over time, but not reduced below this level.

  • Encryption: Customer personal data is encrypted in transit (TLS) and at rest.
  • Access control in the Service: role-based and field-level permissions, applied in the web application, Slack, APIs and MCP connections, and to AI features (Section 3.3).
  • Supplier access: access to the Customer’s account only under a time-limited, revocable support grant issued by the Customer’s administrator, which is logged and visible to the Customer. Access to production systems is limited to authorised personnel who need it.
  • Change history: changes to employee profiles, including changes made by AI features, are recorded with who made them and when.
  • Separation: each customer’s data is logically separated from other customers’ data.
  • Resilience: regular backups of the Service’s databases, stored in the European Economic Area and kept for no more than 90 days.
  • Security management: an information security management system certified to ISO/IEC 27001. The Supplier notifies the Customer without undue delay if the certification lapses or its scope is reduced.
  • Testing: periodic penetration testing of the Service by an independent third party.
  • Personnel: confidentiality obligations for all personnel with access to Customer personal data.

Questions? Email us at legal@taito.ai.