Data Processing Addendum

Draft — to be finalized with legal counsel before launch.

Roles

The customer is the data controller for employee personal data; Paylio acts as a data processor, processing it only on the customer’s documented instructions to provide the service.

Security

Encryption in transit, tenant isolation enforced at the application and database layers, role-based access control, and append-only audit logging of sensitive actions.

Sub-processors & retention

Hosting and email delivery are provided by vetted sub-processors. Payroll records are retained for the periods required by UAE law, then deleted or anonymized.