# Data processing agreement

Last updated 21 October 2026

When your company uses Squadra HR, your company is the data controller for your employees' personal data, and Aigentcy processes it on your behalf as a processor under the GDPR. The data processing agreement (DPA) sets out how we do that.

## The data processing agreement

The DPA is part of our [terms of service](https://www.squadrahr.com/terms/) and applies to all company accounts, on the free plan and on paid plans. It covers:

-   What we process: the employee data your company enters or imports, only to provide the service.
-   Instructions: we process personal data only on your documented instructions.
-   Confidentiality: people who can access the data are bound to keep it confidential.
-   Security: the measures described on the [security page](https://www.squadrahr.com/security/).
-   Subprocessors: the list that comes with the DPA, and 30 days notice before we add or replace one.
-   Your rights requests: we help you answer access, correction and erasure requests from your employees.
-   Breaches: we tell you without undue delay, and within 48 hours of becoming aware of a personal data breach.
-   End of service: we delete your data after a 30 day grace period, or return it as an export if you ask.
-   Audits: we give you the information you need to show compliance.

To get a signed copy of the DPA, email [info@aigentcy.com](mailto:info@aigentcy.com) and we send it, with its list of subprocessors, for signature.

## Subprocessors

The DPA we send for signature lists the companies that process personal data on our behalf. We give customers 30 days notice before adding or replacing one.

Sign-in through Microsoft or Google happens with your own company's account at those providers. They act for your company and are not our subprocessors.

## Contact

Questions about data protection go to [info@aigentcy.com](mailto:info@aigentcy.com).