Legal

GDPR Compliance

Last updated: August 20, 2026

Our Commitment

HR Instance is committed to protecting personal data and ensuring compliance with GDPR and applicable data protection regulations. We act as a data processor for your HR data, while you — the employer — remain the data controller.

Lawful Basis for Processing

We process employee data under the following lawful bases: contract performance (employment contracts), legal obligations (payroll and tax compliance), and legitimate interests (HR management and platform security).

Your Rights Under GDPR

Data subjects have the right to: access their personal data, rectify inaccurate data, erasure (right to be forgotten), restrict processing, data portability (receive data in a machine-readable format), and object to processing. Contact support@hrinstance.com to exercise these rights.

Data Transfers

HR Instance stores all data in AWS Mumbai (India). If you are based in the EU/EEA and your employees' data is processed by EU-located sub-processors, all such transfers are covered by Standard Contractual Clauses (SCCs) under GDPR Art. 46(2)(c).

Data Retention

We retain your data for the duration of your subscription plus 30 days after termination to allow for data export. Payroll and statutory compliance data may be retained longer as required by applicable law (e.g., 7 years for payroll records under Indian law).

Sub-processors

We work with the following sub-processors: Amazon Web Services (infrastructure, India region), SendGrid (email delivery), Twilio (SMS), Stripe (billing). All sub-processors have signed Data Processing Agreements meeting GDPR requirements.

Data Protection Officer

For GDPR-related enquiries, contact our DPO at support@hrinstance.com. We respond to all data protection requests within 30 days.