Data Processing Agreement

1. Parties and roles

This DPA is between Moonworkers Ltd, a company incorporated in England and Wales (Companies House number 11123973), registered office at 20-22 Wenlock Road, London, England, N1 7GU ("Moonworkers", "we"), and the customer that uses our payroll services ("Customer", "you").

For the personal data of your employees, workers, and directors that you provide to us for payroll purposes, you are the controller and Moonworkers is the processor. Where an accountant or bureau uses our platform on behalf of employer clients, the employer remains the controller and the accountant may act as a separate processor or joint instruction channel under its own engagement terms.

Moonworkers is registered with the Information Commissioner's Office (ICO) and pays the data protection fee. For data we process for our own purposes (such as operating our website and managing customer accounts), we act as a controller as described in our Privacy Policy.

2. Details of processing

• Subject matter: Provision of UK payroll services, including PAYE calculations, payslip generation, RTI submissions to HMRC, pension auto-enrolment, and related integrations you enable.
• Duration: The term of your agreement with us, plus the deletion period set out in section 8.
• Nature and purpose: Collection, storage, calculation, and transmission of payroll data strictly to run your payroll and meet your statutory reporting obligations, on your documented instructions.
• Data subjects: Your employees, workers, directors, and subcontractors included in your payroll.
• Categories of data: Identity and contact details, date of birth, National Insurance number, tax codes, salary and pay elements, bank details, pension contributions, working time, and absence records.
• Special category data: Statutory pay and absence records may reveal limited health-related information (for example statutory sick pay or parental leave). We process these solely to calculate statutory entitlements.

3. Our obligations as processor

Moonworkers shall:

• Process personal data only on your documented instructions, including as configured by you in the platform, unless required to do otherwise by UK law (in which case we will inform you unless prohibited).
• Ensure that all personnel authorised to process personal data are bound by confidentiality obligations.
• Implement appropriate technical and organisational measures to protect personal data, as described in section 6 and our Security Overview.
• Engage sub-processors only under the conditions set out in section 5.
• Taking into account the nature of the processing, assist you in responding to requests from data subjects exercising their rights (access, rectification, erasure, portability, objection).
• Assist you in meeting your obligations regarding security, breach notification, and data protection impact assessments, taking into account the information available to us.
• Notify you without undue delay after becoming aware of a personal data breach affecting your data, and provide the information reasonably required for your own notification obligations.
• Delete or return personal data at the end of the service as set out in section 8.
• Make available the information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits conducted by you or your appointed auditor, on reasonable notice and no more than once per year unless required by a supervisory authority.

4. Data location and international transfers

Production data processed through our payroll platform is hosted in the European Union (Amsterdam, Netherlands), on infrastructure operated by our hosting sub-processor. The EU is covered by the UK adequacy regulations, so no additional transfer mechanism is required for this hosting.

Where a sub-processor processes personal data outside the UK or EEA (for example payment processing), we rely on appropriate safeguards, typically the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with the sub-processor's own certifications where applicable.

Statutory recipients such as HMRC and your chosen pension providers (for example NEST, Smart Pension, The People's Pension) receive data as independent controllers under their own legal obligations; they are not sub-processors of Moonworkers.

5. Sub-processors

You give general written authorisation for the sub-processors listed below. We will give you at least 30 days' notice of any intended addition or replacement, during which you may object on reasonable data protection grounds. We impose data protection obligations on each sub-processor equivalent to those in this DPA and remain fully liable to you for their performance.

Optional integrations that you enable yourself (for example QuickBooks, Xero, FreeAgent, KashFlow, Deputy, or a pension provider) transfer data on your instruction to the provider you have chosen. Those providers act on your behalf under your own agreement with them and are not Moonworkers sub-processors.

6. Security measures

We implement appropriate technical and organisational measures under Article 32 UK GDPR, including encryption of data in transit and at rest, multi-factor authentication, role-based access control on a least-privilege basis, segregated production infrastructure with fixed egress IP addresses, automated backups, and logging and monitoring of production systems. A current description is published in our Security Overview.

7. Your obligations as controller

You are responsible for the lawfulness of the personal data you provide to us, for informing your employees about the processing (including through your own privacy notices), for the accuracy of the data you submit, and for ensuring that your instructions to us comply with UK data protection law.

8. Return and deletion

Upon termination of the services, we will, at your choice, return your payroll data (export available within 30 days of account closure, as set out in our Terms) and delete personal data from our production systems, unless UK law requires us to retain certain records. Data in encrypted backups is deleted through scheduled backup rotation.

9. Liability, term, and governing law

This DPA takes effect for as long as we process personal data on your behalf. The limitations of liability in our Terms of Use apply to this DPA. This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

10. Contact