Object of processing
Orquiva will process personal data on behalf of the Controller solely to deliver the contracted HRIS service.
Data Processing Agreement
Data Processing Agreement between your organisation (Controller) and Orquiva Software S.L. (Processor), under GDPR art. 28.
Categories of data
Identification, tax, banking, professional, absences, attendance, reviews, documents and e-signatures of your employees.
Processor obligations
Process only on documented instructions. Ensure confidentiality of authorised personnel. Technical and organisational measures under GDPR art. 32. Notify breaches within 72h. Assist the Controller with its obligations.
Sub-processors
Current public list at orquiva.com/subprocessors. Changes notified 30 days in advance. The client may object and terminate without penalty.
International transfers
Data stored in AWS Frankfurt (eu-central-1). No transfers outside the European Economic Area take place.
Audits & termination
The client may carry out reasonable audits with 30 days' notice. On contract termination, Orquiva returns or destroys data within 30 days (90 days in backups).