Legal
Privacy Policy
How Grouper Technology Limited collects, uses, hosts and protects your personal data as BambooHR’s authorised European partner, with primary data storage on AWS Ireland.
Last updated: 16 August 2026
Grouper is committed to protecting personal data and maintaining high standards of privacy, security and regulatory compliance. Data protection is treated as a core operational and contractual responsibility, not as an afterthought. We design our service delivery, access controls, support processes and vendor governance to reflect the accountability, integrity, confidentiality and transparency principles of the GDPR.
This Privacy Policy explains how Grouper Technology Limited (“Grouper”, “we”, “us” or “our”) collects, uses, accesses, hosts, stores, protects, transfers and otherwise processes personal data in connection with the services we provide, including our role as a European partner of BambooHR.
Grouper supports organisations across Ireland, the United Kingdom, Europe and other regions with the deployment, administration and use of the BambooHR HRIS platform and related HR technology.
Our European service model is designed around a clear principle of European data residency. Customer Personal Data handled through Grouper’s European BambooHR service is hosted and stored within the European Economic Area (“EEA”), with primary hosting in Ireland.
This Privacy Policy applies to personal data processed in connection with:
- BambooHR implementation and onboarding;
- HRIS configuration;
- account administration;
- customer support;
- technical support;
- integration support;
- data migration;
- customer success;
- training;
- professional services;
- security and service administration;
- customer communications;
- sales and demonstrations;
- Grouper websites and digital services; and
- our general business activities.
Grouper Technology Limited is an Irish company with its registered office at 3rd Floor, 22 Ely Place, Dublin, D02 AH73, Ireland.
BambooHR provides the underlying human resources information system and related product functionality. Grouper provides European implementation, migration, configuration, training, customer success, support, service management and related professional services. Depending on the Customer’s subscription and configuration, the BambooHR HRIS platform may support employee records, onboarding, recruitment, time and attendance, leave management, performance, compensation, benefits, payroll-related functionality, reporting, analytics, integrations, APIs and artificial-intelligence features.
Depending upon the services purchased by a customer, Grouper may provide:
- BambooHR implementation;
- onboarding;
- configuration;
- account setup;
- migration assistance;
- integration services;
- technical support;
- HRIS support;
- training;
- customer-success services;
- service administration;
- troubleshooting; and
- related professional services.
The precise data-protection role of Grouper depends upon the particular Processing activity.
Where Grouper determines the purposes and means of Processing — for example in certain website, sales, business-contact, security or corporate-administration activities — Grouper acts as a Controller.
Where Grouper Processes Customer Personal Data solely on behalf of a Customer and in accordance with that Customer’s documented instructions, Grouper acts as a Processor.
Where the Customer itself acts as a Processor for another Controller, Grouper may act as a Sub-processor to the extent applicable.
BambooHR may separately act as a Processor or Sub-processor in relation to Customer Personal Data processed through the BambooHR HRIS platform. Roles are further described in Part B and the applicable customer agreement.
4.1 Core European Residency Commitment
For Customers purchasing Grouper’s European BambooHR service with EEA data residency, Customer Personal Data forming part of the core HRIS production environment is hosted and stored within the EEA, with the primary hosting location in Ireland.
The primary cloud hosting infrastructure for the European service is provided by Amazon Web Services (AWS), with primary data storage in the AWS Ireland region. The service is designed so that ordinary production storage remains in the contracted European region.
This applies to Personal Data maintained within the European HRIS environment, including employee, candidate and other workforce information.
4.2 Storage Versus Access
Data residency describes where Customer Personal Data is stored. It does not mean that no authorised support or technical access can ever occur from another country.
Exceptional access from outside the EEA may occur only where necessary, authorised and legally protected as described in Sections 17 and 18 of this Policy.
4.3 Backups, Resilience and Disaster Recovery
Backup, resilience and disaster-recovery arrangements are designed to preserve confidentiality, integrity and availability and to remain consistent with the Customer’s contracted regional hosting commitments.
Where replication, resilience or disaster-recovery infrastructure is used, Customer Personal Data remains stored within the EEA, subject to documented emergency, continuity or support scenarios and applicable transfer safeguards.
4.4 No Routine Relocation Outside the EEA
Grouper does not use exceptional support access as a mechanism for routine relocation of European Customer Personal Data.
Customer Personal Data forming part of the European service is not routinely hosted or stored outside the EEA. Any material change to the contracted data-residency model is subject to the applicable Agreement, notice requirements and Applicable Data Protection Law.
“Applicable Data Protection Law” means all data-protection, privacy and data-security laws and regulations applicable to the Processing, including where relevant:
- Regulation (EU) 2016/679 — the General Data Protection Regulation (GDPR);
- the Irish Data Protection Act 2018;
- applicable Irish ePrivacy and electronic-communications rules;
- the UK GDPR and UK Data Protection Act 2018 where applicable;
- applicable Swiss data-protection law where applicable;
- applicable national legislation implementing European privacy requirements; and
- any legislation that replaces, supplements or amends those laws.
The parties will interpret this Policy and any applicable DPA consistently with mandatory Data Protection Law. Mandatory provisions of the GDPR, applicable transfer instruments and supervisory-authority requirements take precedence where required.
The information processed depends on the Services selected by the Customer and the data the Customer chooses to place in the HR environment.
6.1 Employee and Workforce Information
Personal Data may include:
- name and employee identification numbers;
- photographs where provided;
- home or work contact details;
- date of birth, gender and demographic information where provided;
- marital or family information where provided;
- emergency contacts and telephone numbers;
- academic and professional qualifications;
- CV or résumé information, employment history and language proficiency;
- job title, grade, department, location, reporting lines and team affiliation;
- hire and termination dates, working hours and contractual details;
- performance, evaluation, disciplinary and work-history information;
- benefits, insurance, company assets and training information; and
- leave, attendance and time-off information.
6.2 Payroll and Compensation Information
Where relevant services are used, Personal Data may include:
- salary, compensation and bonuses;
- tax and social-security information;
- bank and payment details;
- pension information;
- share options and other benefits; and
- other payroll-related information.
6.3 Recruitment, Candidate and Referee Information
For candidates, prospective employees and referees, information may include:
- identity and contact details;
- CVs, résumés, employment history and qualifications;
- application, interview and recruitment records;
- candidate communications and recruitment status;
- proposed compensation information;
- referee names, contact details and professional relationship; and
- information contained in references.
6.4 Special Category and Sensitive Data
Depending upon a Customer’s use of the BambooHR HRIS platform, the Services may contain health or disability information and other special-category or sensitive Personal Data.
The Customer remains responsible for ensuring an appropriate Article 6 lawful basis and, where GDPR Article 9 applies, a valid special-category condition.
Customers should not place sensitive information into free-text fields or AI features unless necessary, lawful and permitted by the relevant product terms.
Personal Data processed in connection with Grouper’s services may relate to:
- current, former, prospective and future employees;
- candidates and applicants;
- contractors, consultants, agents and independent contractors;
- agency, temporary and casual workers;
- interns and volunteers;
- employee dependants, beneficiaries and emergency contacts;
- referees and reference providers;
- Customer administrators and authorised users; and
- other individuals whose Personal Data a Customer lawfully submits to the Services.
Personal Data may be obtained:
- directly from the individual;
- from the individual’s employer or prospective employer;
- from Customer administrators and authorised users;
- during implementation, configuration and data migration;
- through authorised integrations or APIs;
- through support requests and troubleshooting;
- through the BambooHR HRIS platform or another system selected by the Customer;
- through recruitment processes;
- from public sources where lawfully used; and
- from other lawful sources authorised by the Customer.
Grouper Processes Personal Data only for specified and lawful purposes. These may include:
- implementing and configuring the BambooHR HRIS platform;
- hosting or facilitating the hosting of Customer Personal Data;
- administering accounts and user permissions;
- maintaining and securing the service;
- providing customer and technical support;
- supporting integrations and migrations;
- delivering training and professional services;
- managing subscriptions and customer relationships;
- detecting and investigating security events;
- maintaining audit records;
- preventing fraud or misuse;
- complying with legal obligations; and
- improving service performance where permitted by the Agreement and Applicable Data Protection Law.
When support personnel access Customer Personal Data, access must be limited to the minimum information reasonably necessary for the support purpose and must be performed by authorised personnel subject to confidentiality and access controls.
Where Grouper acts as a Controller, the applicable lawful basis may include:
10.1 Contract
Processing necessary to enter into or perform a contract, or to take steps before entering a contract at the request of the individual.
10.2 Legitimate Interests
Processing necessary for legitimate business interests, provided those interests are not overridden by the rights and freedoms of individuals. Legitimate interests may include:
- service delivery;
- customer administration;
- information security;
- fraud prevention;
- business continuity;
- customer support; and
- relationship management.
10.3 Legal Obligation
Processing necessary to comply with applicable legal or regulatory requirements.
10.4 Consent
Where appropriate, Processing may be based upon consent. Consent may be withdrawn at any time without affecting the lawfulness of Processing carried out before withdrawal.
Where the Customer acts as Controller, the Customer is responsible for:
- determining the purposes for which Personal Data is processed;
- establishing lawful bases and special-category conditions;
- providing required privacy notices;
- obtaining consent where required;
- ensuring data accuracy and quality;
- determining appropriate retention periods;
- managing authorised users and permissions;
- using the Services securely; and
- ensuring its instructions to Grouper are lawful.
The Customer must not instruct Grouper to Process Personal Data in a manner that infringes Applicable Data Protection Law.
Grouper will notify the Customer where, in its reasonable opinion, an instruction infringes Applicable Data Protection Law and may suspend the affected Processing until the issue is resolved.
Grouper limits access to Customer Personal Data to authorised persons who reasonably require access for their duties. Personnel are subject to appropriate confidentiality obligations and receive privacy and security training appropriate to their role. Access is governed by least-privilege and need-to-know principles.
Access controls include:
- identity and authentication controls;
- role-based and privileged-access controls;
- administrative account controls;
- account lifecycle management;
- access logging and monitoring;
- periodic access review;
- confidentiality and acceptable-use requirements; and
- appropriate personnel security and training.
Grouper maintains, and requires relevant technology providers to maintain, technical and organisational measures appropriate to the risks presented by the Processing, taking account of the state of the art, implementation costs, the nature, scope, context and purposes of Processing and the risk to individuals.
Measures include:
- physical and logical access controls;
- strong authentication and appropriate password controls;
- encryption in transit and at rest where appropriate;
- pseudonymisation where appropriate;
- network firewalls, perimeter security and intrusion detection;
- logging, monitoring and audit trails;
- vulnerability management and security testing;
- restricted administrative access;
- secure transmission, including protected transfer channels;
- backup, redundancy, recovery and resilience;
- business-continuity and disaster-recovery planning;
- secure development and change management;
- data separation between customers and processing purposes;
- incident-response procedures;
- staff security awareness and training; and
- subprocessor due diligence and security governance.
Additional detail on minimum control domains is set out in Schedule 2 of the Data Processing Agreement. Security measures may evolve over time, but changes will not materially diminish the overall level of protection for Customer Personal Data during an active subscription except where required by law or agreed with the Customer.
Grouper maintains documented procedures to identify, investigate, contain, mitigate, remediate and report Personal Data Breaches.
Where Grouper acts as Processor and becomes aware of an actual or suspected Personal Data Breach affecting Customer Personal Data, Grouper will notify the relevant Customer in the most expedient time reasonably possible and, in any event, within 48 hours of becoming aware of the incident.
To the extent reasonably available, notification will include:
- the nature of the incident;
- categories of Personal Data affected;
- approximate categories and numbers of Data Subjects and records;
- likely consequences;
- measures taken or proposed;
- mitigation actions; and
- a contact point for further information.
Information may be provided in phases as it becomes available.
Grouper will provide reasonable cooperation to enable the Customer to meet applicable regulatory and Data Subject notification obligations.
Public or regulatory communications concerning a Customer-specific breach will be coordinated consistently with law and the applicable Agreement.
Grouper may appoint carefully selected Sub-processors and service providers where necessary to provide, host, secure, support, monitor or improve the Services.
Before permitting a Sub-processor to Process Customer Personal Data, Grouper will carry out appropriate due diligence and impose written data-protection obligations appropriate to the Processing. These obligations include confidentiality, appropriate technical and organisational measures, purpose limitation, support for Data Subject rights and breach obligations, deletion or return requirements, and lawful international-transfer safeguards where applicable.
Grouper remains responsible for Sub-processor performance to the extent required by Applicable Data Protection Law and contract.
Where the applicable customer terms provide general written authorisation, Customers will receive advance notice of material new Sub-processors and an opportunity to object on reasonable data-protection grounds.
For BambooHR subprocessors, the current BambooHR DPA provides at least 30 days’ prior notice of a new Subcontractor that will Process Customer Personal Data.
Schedule 4 provides transparency on key provider categories and named providers identified in the governing service materials.
BambooHR LLC provides the underlying HR technology platform used in connection with the relevant Services. Grouper may work with BambooHR for platform maintenance, hosting, implementation, troubleshooting, service support, security, technical administration, integrations and other functions necessary to provide the contracted Services.
BambooHR’s Processing is governed by applicable contractual and data-protection terms, including its DPA, security measures, subprocessor arrangements and international-transfer safeguards.
Grouper remains responsible for its own obligations under Applicable Data Protection Law and the applicable customer agreement. Where BambooHR Processes Personal Data in support of Grouper’s European customer environment, the applicable contractual, security and data-residency requirements apply.
For Grouper’s contracted European service, Customer Personal Data is designed to be stored in the EEA, with primary hosting in Ireland via Amazon Web Services (AWS). Authorised Processing or remote access from outside the EEA may constitute a Restricted Transfer even when the data remains stored in Ireland. Such access is permitted only where lawful, necessary and protected by appropriate safeguards.
Examples of exceptional scenarios include:
- an emergency affecting the Irish data-centre environment or service continuity;
- a support or maintenance request requiring authorised specialist access from outside the EEA, subject to the Customer’s applicable approval or contractual authorisation; and
- a verified Customer request to relocate or otherwise Process data outside the contracted European hosting region.
Where a Restricted Transfer occurs, Grouper and/or the relevant technology provider will use a legally recognised mechanism such as:
- an adequacy decision;
- the European Commission Standard Contractual Clauses;
- the UK International Data Transfer Addendum where applicable;
- participation in the EU-US Data Privacy Framework where legally available and applicable;
- Binding Corporate Rules where applicable; or
- another valid safeguard recognised under Applicable Data Protection Law.
Where required, a Transfer Impact Assessment and supplementary technical, contractual or organisational measures will be implemented.
Nothing in such exceptional-access arrangements changes Grouper’s commitment that Customer Personal Data for the European service is stored within the EEA.
Where EU Standard Contractual Clauses are required, they are incorporated in their officially approved form without alteration to mandatory wording. For Controller-to-Processor transfers, Module Two will ordinarily apply unless another module is required by the parties’ roles.
Where Ireland is selected as the applicable EU governing law and forum, the parties agree to the courts of Ireland as provided in the applicable SCC annex.
For transfers subject to UK Data Protection Law, the EU SCCs will apply together with the then-current UK International Data Transfer Addendum or another legally recognised UK transfer mechanism.
Supplementary measures may include:
- encryption;
- access restrictions;
- key-management controls;
- minimisation;
- logging;
- contractual limitations on onward transfer;
- government-request review procedures;
- transparency measures; and
- suspension or termination of transfers where an adequate level of protection cannot be ensured.
Grouper recognises that lawful government access requests can create material privacy risks. To the extent permitted by law, where Grouper or a relevant processor receives a legally binding request for Customer Personal Data from a public, law-enforcement or judicial authority, the request will be reviewed for validity, scope and proportionality.
Unlawful or disproportionate requests will be challenged where there are reasonable grounds and a lawful basis to do so.
Disclosure will be limited to the minimum legally required.
The Customer will be notified where legally permitted. Where notification is prohibited, reasonable efforts will be made to obtain permission to provide notice where appropriate.
Records of the request and response will be maintained as required by law and the applicable transfer mechanism.
Depending upon Applicable Data Protection Law, individuals may have rights including:
- access;
- rectification;
- erasure;
- restriction of Processing;
- data portability;
- objection;
- withdrawal of consent;
- rights relating to automated decision-making and profiling; and
- the right to complain to a competent supervisory authority.
Where Grouper acts as Processor, requests concerning Customer Personal Data should ordinarily be directed to the relevant Customer as Controller. If Grouper receives such a request directly, Grouper will, unless legally prohibited, refer or notify the request to the Customer and will not respond substantively except on documented Customer instructions or where required by law. Grouper will provide reasonable assistance to enable the Customer to fulfil its obligations.
Taking account of the nature of the Processing and the information available to Grouper, Grouper will provide reasonable assistance with Data Protection Impact Assessments and, where required, prior consultation with a competent supervisory authority.
The Customer remains responsible for determining whether a DPIA or prior consultation is required for its use of the Services.
Grouper will make available information reasonably necessary to demonstrate compliance with applicable Processor obligations. This may include:
- security documentation;
- policies;
- compliance information;
- audit information;
- independent assurance reports;
- relevant certifications; and
- responses to reasonable security questionnaires.
Where legally or contractually required and reasonable documentary evidence is insufficient, Customers may exercise applicable audit rights on reasonable notice, subject to confidentiality, security, non-interference and protections for other customers’ information. Unless required because of a Security Incident, regulatory requirement or reasonable evidence of material non-compliance, formal audits should ordinarily be limited to once in any twelve-month period. Customers generally bear their own audit costs unless law or contract provides otherwise.
Grouper retains Personal Data only for as long as reasonably necessary for the relevant purpose or as required by law.
Where Grouper acts as Processor, retention is primarily determined by:
- documented Customer instructions;
- the applicable customer agreement;
- the duration of the Services;
- support requirements;
- legal obligations; and
- contractual deletion requirements.
Upon termination or expiry of the Services, or earlier upon a valid Customer instruction where technically and legally practicable, Grouper will return, make available for export, or securely delete Customer Personal Data in accordance with the Agreement.
Where law requires continued retention, the affected data will remain protected, isolated from ordinary use and Processed only to the extent required by law.
Support-related information will be retained only for the period necessary to deliver, evidence and close the support activity, subject to applicable legal and operational retention requirements.
Grouper supports the principles of data minimisation, accuracy and purpose limitation. Customers should Process only Personal Data reasonably necessary for legitimate HR and workforce-management purposes and should avoid unnecessary sensitive information in free-text fields, attachments, notes, custom fields or optional features.
Customers are responsible for maintaining accurate Customer Personal Data. Where Grouper or a processor becomes aware that data is inaccurate or outdated in circumstances requiring action, Grouper will cooperate with the Customer to rectify or erase the data in accordance with documented instructions and Applicable Data Protection Law.
Special category Personal Data should be limited to information for which the Customer has an appropriate lawful basis and genuine business requirement.
Certain BambooHR features may use artificial intelligence or machine learning. AI functionality is optional where identified as such and may be subject to separate BambooHR AI terms.
Current BambooHR AI service materials identify third-party AI providers including OpenAI, Cohere and Anthropic/Claude, and current subcontractor materials may identify additional AI or document-processing providers (such as LlamaIndex) depending on feature configuration.
Customers remain responsible for:
- assessing whether AI use is appropriate for their organisation;
- establishing a lawful basis;
- providing required transparency to data subjects;
- obtaining consent where required;
- implementing sufficient human oversight;
- evaluating bias and fairness risks; and
- complying with employment, equality, AI and data-protection law.
Customers must not submit sensitive or regulated information to AI features where prohibited by the applicable AI terms, including health, genetic or biometric information, government-issued identifiers, and personal financial or bank information. AI outputs may be inaccurate, incomplete, biased, non-unique or unsuitable for a particular purpose and must not be treated as a substitute for responsible human judgement.
Where BambooHR uses Customer Data, Input or Output to fine-tune or train a customer-specific model, the applicable BambooHR AI terms state that such use is for providing the AI features to that Customer and that the resulting customer-trained model is not otherwise used to provide services to other customers.
AI providers and AI-related processing may involve authorised Processing outside the EEA. Such Processing is subject to the international-transfer safeguards in this Policy and any applicable Data Processing Agreement. Core HRIS storage residency commitments do not by themselves mean every optional AI inference operation occurs physically within the EEA.
Grouper provides HR technology implementation, support and related services. Grouper does not ordinarily determine who a Customer recruits or employs, promotions, compensation, performance outcomes, disciplinary action, benefits decisions, termination or other employment decisions. Those decisions remain the responsibility of the relevant employer or Controller.
Customers must ensure that AI, analytics, scoring or workflow features are not used to make unlawfully automated decisions producing legal or similarly significant effects without the safeguards required by Applicable Data Protection Law, including meaningful human involvement where required.
The BambooHR HRIS platform supports APIs and integrations that can retrieve, transmit or modify employee and other HR data. Customers are responsible for authorising appropriate permissions, protecting API credentials, limiting integration access to legitimate business purposes, and ensuring that third-party integrations are lawfully configured and contractually governed.
Programmatic access should use supported authentication methods and must not expose Customer Data or credentials to unauthorised parties.
Integrations must not use Customer Data beyond the documented and authorised purpose.
Where an integration provider Processes Personal Data on behalf of the Customer or Grouper, appropriate processor or subprocessor terms and transfer safeguards must apply.
Where Grouper acts as Controller in relation to its own business activities, we may Process business contact information relating to:
- prospective customers;
- customer contacts;
- suppliers;
- partners;
- professional advisers;
- event attendees;
- website visitors; and
- individuals who contact Grouper.
Information may include name, organisation, role, business contact details, communications, enquiry information, IP address, browser and device information, pages visited and similar technical data.
We Process such information to respond to enquiries, administer relationships, provide requested services, maintain security, fulfil contracts, comply with law and, where permitted, send relevant business communications. Recipients may opt out of direct marketing at any time. Operational, contractual, security and customer-service communications are not marketing.
Websites may use essential, functional and analytics cookies and similar technologies. Where legally required, non-essential cookies will be used only after appropriate consent and users will be provided with controls to manage preferences.
Grouper seeks to embed privacy into service design and operations. This includes:
- European data-residency options;
- data minimisation;
- least-privilege access;
- appropriate authentication;
- encryption;
- access logging;
- role-based permissions;
- secure transmission;
- Sub-processor controls;
- retention controls;
- incident-response processes;
- privacy and security training;
- security testing;
- DPIA support; and
- documented accountability.
Grouper will maintain records and governance measures appropriate to its role and will cooperate in good faith with Customers, Data Subjects and competent supervisory authorities.
Grouper may update this Privacy Policy and DPA where reasonably necessary to reflect changes in law, regulatory guidance, security requirements, technology, Services, Processing activities, sub-processors or transfer mechanisms. Material changes will be communicated where required.
Where Grouper Processes Customer Personal Data as Processor, Part B and the applicable customer agreement govern the contractual Processing relationship. In the event of inconsistency concerning Customer Personal Data, the following order of precedence applies: mandatory Applicable Data Protection Law; applicable SCCs, UK Addendum or other mandatory transfer mechanism; the Data Processing Agreement; applicable data-protection provisions of the Agreement; and the remainder of the Agreement.
Grouper’s European BambooHR proposition is built around three principles:
European data residency.
Customer Personal Data is hosted and stored within the EEA, with primary hosting in Ireland via Amazon Web Services (AWS).
European privacy standards.
Customer Personal Data is Processed in accordance with applicable European data-protection requirements including the GDPR.
European service and support.
Grouper provides customers with European implementation, support and service management around the BambooHR HRIS platform.
Our aim is to enable organisations to use BambooHR while maintaining the privacy, governance and data-residency standards expected by European customers.
Questions concerning this Privacy Policy, Grouper’s Processing activities, Data Subject rights, security or our European data-residency arrangements may be submitted through Grouper’s designated privacy or customer-support channels.
Grouper Technology Limited may also be contacted at 3rd Floor, 22 Ely Place, Dublin, D02 AH73, Ireland.
Where the Personal Data concerned is contained within an employer’s BambooHR account, individuals should ordinarily contact that employer first, as that organisation will generally be the Controller responsible for determining how the information is used.
This Data Processing Agreement (“DPA”) forms part of the agreement, order form, statement of work or other contract governing the provision of Grouper’s BambooHR-related services between the Customer and Grouper Technology Limited.
In providing the Services, Grouper may Process Customer Personal Data on behalf of the Customer. This DPA establishes the Parties’ respective obligations for that Processing.
This DPA applies to the extent Grouper Processes Customer Personal Data on behalf of the Customer and such Processing is subject to Applicable Data Protection Law. It supplements and forms part of the Agreement; capitalised terms not defined here have the meaning given in the Agreement.
For this DPA:
Customer Personal Data
Personal Data controlled by a Customer or Customer Affiliate and Processed by Grouper in connection with the Services.
Restricted Transfer
A transfer of Personal Data that requires a lawful transfer mechanism under Applicable Data Protection Law.
Standard Contractual Clauses (SCCs)
The applicable European Commission standard contractual clauses for transfers of Personal Data to third countries, as amended, replaced or supplemented from time to time.
Sub-processor
A third party appointed by or on behalf of Grouper to Process Customer Personal Data.
Technology Provider
BambooHR LLC and, where applicable, related BambooHR entities providing the underlying HR technology platform.
Unless otherwise agreed in writing, the Customer acts as Controller and Grouper acts as Processor. Where the Customer acts as Processor for another Controller, Grouper acts as Sub-processor to the extent applicable.
Grouper will Process Customer Personal Data only on documented Customer instructions and only as necessary to provide, maintain, secure and support the Services, unless required to Process the data by applicable law.
Grouper will promptly inform the Customer if, in its reasonable opinion, an instruction infringes Applicable Data Protection Law and may suspend the affected Processing pending resolution.
Each Party will comply with its obligations under Applicable Data Protection Law in relation to Personal Data Processed under or in connection with the Agreement. Grouper will not knowingly Process Customer Personal Data in a manner that is likely to cause the Customer to breach Applicable Data Protection Law.
Grouper will ensure that Authorised Persons are subject to appropriate confidentiality obligations, access Customer Personal Data only where reasonably necessary, receive appropriate privacy and security training and Process Customer Personal Data only in accordance with this DPA and documented Customer instructions. Access will be limited according to least-privilege and need-to-know principles.
Grouper will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
The minimum control domains are described in Schedule 2. Grouper may update those measures provided that changes do not materially diminish the overall level of protection afforded to Customer Personal Data.
Grouper will notify the Customer as soon as reasonably practicable and, where the 48-hour contractual commitment applies, in no event later than 48 hours after becoming aware of an actual or suspected Security Incident affecting Customer Personal Data.
Information may be provided in phases as it becomes available. Grouper will provide reasonable cooperation needed for the Customer to comply with notification duties to supervisory authorities and affected Data Subjects.
The Customer grants Grouper general written authorisation to engage Sub-processors necessary to provide the Services.
Grouper will maintain information on Sub-processors that Process Customer Personal Data and will provide reasonable advance notice of material additions or replacements.
Where the underlying BambooHR DPA applies, BambooHR currently provides at least 30 days’ prior written notice of a new Subcontractor that will Process Customer Personal Data.
Grouper will impose written data-protection obligations on Sub-processors materially equivalent to the protections required by this DPA. Grouper remains responsible for Sub-processor performance to the extent required by Applicable Data Protection Law.
Taking account of the nature of Processing, Grouper will provide reasonable assistance to enable the Customer to respond to requests for access, rectification, erasure, restriction, portability, objection and other applicable rights.
If Grouper receives a request directly concerning Customer Personal Data, Grouper will promptly refer or notify the Customer and will not respond substantively except on documented instructions or where required by law.
Grouper will provide reasonable assistance, taking account of the nature of Processing and information available, with Data Protection Impact Assessments, prior consultation with supervisory authorities, and reasonable enquiries or investigations by a competent supervisory authority relating to the Services.
Grouper will make available information reasonably necessary to demonstrate compliance with applicable Processor obligations, which may include security documentation, certifications, audit reports and summaries.
Where such information is insufficient and an audit is required by Applicable Data Protection Law, the Customer may request an audit on reasonable notice. Audits will ordinarily be limited to once in any twelve-month period unless a Security Incident or regulatory requirement justifies more frequent review. The Customer will bear its own audit costs unless law or the Agreement provides otherwise.
Grouper will ensure that Restricted Transfers of Customer Personal Data are made in accordance with Applicable Data Protection Law. Where the Customer purchases the European data-residency service, primary Customer Personal Data storage is in Ireland/EEA via Amazon Web Services (AWS), but authorised non-EEA remote access may still constitute a Restricted Transfer and must be protected accordingly.
If a transfer mechanism ceases to be lawful, Grouper will work with the Customer to implement an alternative lawful mechanism or suspend the affected transfer.
To the extent permitted by law, Grouper will review legally binding public-authority requests for Customer Personal Data, challenge unlawful or disproportionate requests where there are reasonable grounds, seek to limit disclosure to the minimum legally required, notify the Customer where legally permitted and maintain appropriate records.
At the Customer’s request, or upon termination or expiry of the Services, Grouper will, at the Customer’s option and subject to technical feasibility and the Agreement, return or securely delete Customer Personal Data and require relevant Sub-processors to do the same. Where law requires retention, Grouper will isolate and protect the retained data and Process it only as legally required.
The Customer warrants that it has the rights, permissions, notices, lawful bases and consents required to provide Customer Personal Data for Processing; that its instructions comply with Applicable Data Protection Law; that it will not instruct unlawful Processing; and that it will configure and use the Services securely and maintain appropriate controls over user accounts, credentials and integrations.
Liability arising from or relating to this DPA is subject to the limitations and exclusions in the Agreement except to the extent prohibited by Applicable Data Protection Law or inconsistent with mandatory SCC provisions. Nothing in this DPA limits rights of Data Subjects or supervisory authorities that cannot lawfully be limited.
This DPA takes effect when the Customer becomes bound by it and continues for as long as Grouper Processes Customer Personal Data on behalf of the Customer. Obligations that by their nature or under law must continue while data is retained survive expiry or termination.
Grouper may update this DPA where reasonably necessary to comply with law, implement new transfer mechanisms, respond to regulatory guidance, or reflect changes to Services or Processing. No update will materially reduce protection during an active subscription term except where required by law or expressly agreed.
Except where Applicable Data Protection Law or mandatory transfer terms require otherwise, this DPA is governed by the governing law applicable to the Agreement.
In the event of inconsistency concerning Customer Personal Data, the following order of precedence applies: mandatory Applicable Data Protection Law; applicable SCCs, UK Addendum or other mandatory transfer mechanism; this DPA; applicable data-protection provisions of the Agreement; and the remainder of the Agreement.
Controller / Data Exporter
The Customer identified in the applicable Agreement or Order Form.
Processor / Data Importer
Grouper Technology Limited, 3rd Floor, 22 Ely Place, Dublin, D02 AH73, Ireland.
Technology Provider
BambooHR LLC and applicable BambooHR entities providing the underlying HRIS platform.
Subject Matter
Provision, implementation, configuration, operation, maintenance, hosting support, security and support of BambooHR-related HR information system services.
Nature of Processing
Collection, receiving, recording, organisation, structuring, migration, hosting, storage, retrieval, consultation, use, transmission, making available, restriction, support access, deletion and other Processing reasonably necessary to provide the Services.
Purpose
To provide, implement, operate, secure, maintain and support the Services in accordance with documented Customer instructions and the Agreement.
Duration
For the duration of the Services and any subsequent period necessary to return or delete Customer Personal Data or comply with law.
Data Subjects
Employees, former employees, prospective employees, candidates, contractors, consultants, agency workers, temporary and casual workers, interns, volunteers, referees, dependants, beneficiaries, emergency contacts, Customer administrators and other individuals whose Personal Data is submitted by or on behalf of the Customer.
Personal Data
Identity, contact, demographic, employment, recruitment, qualification, organisational, compensation, payroll, tax, social-security, banking, pension, benefits, attendance, leave, performance, training, disciplinary, emergency-contact, account, system and related HR information.
Sensitive Data
Where selected by the Customer, may include health and disability information and other special-category or sensitive data permitted by the Services.
Primary European Storage
Ireland / EEA via Amazon Web Services (AWS) for Customers purchasing the European data-residency service.
Competent Supervisory Authority
Where the DPC is competent: Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland.
Grouper maintains technical and organisational measures across the following minimum control domains:
1. Information Security Governance
Documented security responsibilities, risk assessment, governance, management oversight and appropriate policies.
2. Personnel Security
Confidentiality obligations, role-appropriate screening where lawful, security awareness and privacy training, and disciplinary controls for unauthorised access.
3. Physical Security
Restricted access to relevant facilities and infrastructure; controlled access paths; access authorisations; physical monitoring and other safeguards appropriate to the hosting environment.
4. Identity and Access Management
Authentication, role-based access, least privilege, privileged-account controls, account lifecycle management, idle timeout and periodic review.
5. Data Access Control
Controls designed so authorised users can access only data within their permissions; logging and monitoring of access; release of data only to authorised persons.
6. Encryption and Pseudonymisation
Appropriate encryption of Personal Data in transit and at rest; pseudonymisation where appropriate to the processing purpose.
7. Network and Transmission Security
Firewalls, protected gateways, secure communication channels, TLS/SFTP or equivalent protected transfer mechanisms, and controls against unauthorised interception or alteration.
8. Logging and Monitoring
Logging of relevant system, administrative and access activity; monitoring for suspicious events; retention of audit information appropriate to risk.
9. Input and Change Control
Controls to identify who entered, altered or deleted data; authentication of authorised users and systems; documented change-management practices.
10. Vulnerability and Security Testing
Processes to identify, assess and remediate vulnerabilities; periodic penetration or security testing; regular assessment and evaluation of control effectiveness.
11. Availability, Backup and Recovery
Infrastructure redundancy, backup, restore capability, availability controls and protection against accidental loss or destruction.
12. Business Continuity and Disaster Recovery
Documented continuity and recovery plans designed to restore availability and access in a timely manner following a disruption or Security Incident.
13. Data Separation
Logical or application-level separation between customers and between processing purposes; controls designed to prevent unauthorised cross-customer access.
14. Secure Development
Security practices appropriate to software development, testing, release and change management.
15. Subprocessor Management
Due diligence, written data-protection obligations, security review, transfer safeguards and ongoing oversight appropriate to the processing.
16. Incident Management
Documented procedures for detection, investigation, containment, remediation, escalation, customer notification and lessons learned.
EU Restricted Transfers
Where EU SCCs are required, the official European Commission SCCs are incorporated by reference without alteration to mandatory wording. Unless roles require otherwise, the Customer is the Data Exporter, Grouper and/or the applicable Technology Provider is the Data Importer, and Module Two applies to Controller-to-Processor transfers.
UK Restricted Transfers
For transfers subject to UK Data Protection Law, the EU SCCs will apply together with the then-current UK International Data Transfer Addendum or another legally recognised UK transfer mechanism.
Swiss Transfers
For transfers subject to Swiss data-protection law, the SCCs will be interpreted and adapted as required under applicable Swiss law, including appropriate references to the Swiss supervisory authority and Swiss Data Subjects.
EU-US Data Privacy Framework
Where a US recipient is an eligible participant in the EU-US Data Privacy Framework and the European Commission adequacy decision remains valid for the relevant Processing, the framework may be relied upon as an adequacy mechanism. Grouper does not rely on the obsolete EU-US or Swiss-US Privacy Shield frameworks.
Transfer Impact Assessments and Supplementary Measures
Where required, the parties will assess the circumstances of the transfer, destination-country laws and practices, onward transfers, categories of data, storage location, transmission channels and supplementary technical, contractual or organisational safeguards. Transfers will be suspended where no lawful and adequate safeguard can reasonably be maintained.
Exceptional Access Scenarios for European Customers
Authorised exceptional non-EEA access may occur only in the following circumstances:
- an emergency affecting the Irish data-centre environment or service continuity;
- a support or maintenance request requiring authorised specialist access outside the EEA, subject to applicable Customer approval or contractual authorisation; and
- a verified Customer request for Processing or hosting outside the European region.
The precise providers used vary by product, feature, support pathway and Customer configuration. The current live subprocessor register maintained by Grouper and/or BambooHR is controlling for active service delivery.
The following key providers have been identified in the governing service materials. A provider listed here does not necessarily Process Customer Personal Data for every Customer or every deployment.
BambooHR LLC
Technology provider; HRIS maintenance, hosting and support. Location: United States / service regions including Europe.
Amazon Web Services (AWS)
Primary cloud hosting infrastructure; European regional hosting in Ireland. Location: Ireland / Europe and other regions depending on service configuration.
Anthropic / Claude
AI / language-model processing. Location: United States.
Cohere
Language-model API / AI processing. Location: United States.
OpenAI
Language-model API / AI processing. Location: United States.
LlamaIndex / LlamaParse
Optional document parsing associated with AI functionality. Location: United States.
Atlas MongoDB
Data storage supporting selected services / AI-related functionality. Location: United States.
Gainsight
Customer relationship / CRM services.
Salesforce
CRM platform.
Cloudflare
Web application firewall / security.
Datadog
Infrastructure and application monitoring.
Microsoft / Google Workspace
Collaboration, communication and document storage depending on current configuration.
Mailgun
Application communications.
Snowflake
Data analytics.
Twilio
MFA / SMS delivery.
Additional Providers
Additional providers identified in current service materials may include Celonis/Make, Databricks, Formstack, Jira, Netskope, Omni/Visier, Pendo, Rollbar, Slack, Tableau, OneTrust/TrustArc, Wrike and others. Customers should refer to the live BambooHR subcontractor list and Grouper’s current subprocessor information for the most current details.
1. Scope
This Schedule applies where the Customer enables or uses BambooHR artificial-intelligence or machine-learning functionality in connection with Grouper-supported Services.
2. AI Providers
Current service materials identify AI providers including OpenAI, Cohere and Anthropic/Claude and may identify additional providers such as LlamaIndex for optional document parsing. The active provider set may change in accordance with applicable subprocessor notice requirements.
3. Inputs and Outputs
Customer-provided prompts, instructions or data submitted to AI functionality may constitute “Inputs” and generated responses may constitute “Outputs”. Depending on the feature, Inputs or Outputs may include Customer Data. Outputs may not be unique and may be similar to outputs produced for other users.
4. Customer Responsibilities and Human Oversight
The Customer is responsible for ensuring that it has the rights, lawful basis, notices and permissions necessary to submit Inputs and use Outputs. The Customer must implement sufficient human oversight and must independently assess outputs before using them for employment, legal, financial, safety-critical or similarly significant decisions.
5. Sensitive and Regulated Data Restrictions
Where prohibited by the applicable AI terms, the Customer must not submit sensitive or regulated information to AI features, including health, genetic or biometric information, government-issued identification numbers, or personal financial or bank-account information. Customers should minimise Personal Data in prompts.
6. Accuracy, Bias and Fairness
Generative AI has known and unknown limitations. Outputs may be inaccurate, incomplete, unsafe, biased, unfair, offensive or otherwise unsuitable. Customers are responsible for reviewing outputs, testing for relevant risks and avoiding unlawful discrimination or solely automated employment decisions.
7. Model Improvement
Where the applicable BambooHR AI terms permit use of Performance Data and Feedback to improve AI functionality, such use is governed by those terms. Where Customer Data is used to fine-tune a customer-specific model, the resulting model is used to provide AI features to that Customer and is not otherwise used to provide services to other customers.
8. International Processing
AI providers may Process authorised Inputs or related Personal Data outside the EEA. Such Processing is subject to the transfer safeguards in this DPA and does not alter the location of the Customer’s contracted core HRIS storage region. Customers should evaluate whether optional AI use is consistent with their own residency, works-council, employment-law and risk requirements before enabling it.
Questions about this Privacy Policy or your data rights?
Contact Us
