Data Processing Agreement

This Data Processing Agreement (“DPA”) describes how Cyberyami HRM processes personal data on behalf of its customers (the “Controller”) when they use the platform.

Note: this is a placeholder. The final DPA will be reviewed by counsel before launch and will replace this content. For an executed DPA today, contact us.

The customer is the data Controller; Cyberyami HRM acts as a Processor, processing personal data only on the customer's documented instructions and for the purpose of providing the service.

Processing is subject to the safeguards described on our Security page (encryption in transit and at rest, tenant isolation, access control). A current list of sub-processors is available on request.

The platform ships native self-service workflows so each Data Principal can exercise their statutory rights and the Controller can meet its DPDP and GDPR obligations from the in-app My Privacy console:

• Access (DPDP §11): downloadable personal-data export, fulfilled within 24 hours.
• Correction (DPDP §12): self-edit or administrator-reviewed correction of HR-of-record fields.
• Erasure (DPDP §12): anonymisation of personal identifiers with the audit trail preserved.
• Nomination (DPDP §14): nominate a representative to act on the principal's behalf.
• Grievance redressal (DPDP §13): file and track grievances; routed to the Controller's designated grievance officer / DPO, whose contact details the Controller configures in its white-label settings (not a fixed operator address).
• Consent (DPDP §5 / §6): versioned privacy notices, first-login consent capture, and withdrawal.

Breach notification (DPDP §8(6)) within the 72-hour board window and configurable data retention (DPDP §3) are likewise supported. See our Privacy Policy for retention windows and the erasure process.

Email support@cyberyami.com to request a signed Data Processing Agreement for your organisation.