FaciroSign in

Data Processing Addendum

Version 2026.07.28 · Effective 2026-07-28 · Last updated 2026-07-28

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Faciro ("Processor") and the customer organisation that creates a Faciro workspace ("Controller"). It applies when Faciro processes personal data on the Controller's behalf.

This document is a practical addendum aligned with the Mauritius Data Protection Act 2017. It is not legal advice, is not a claim of certification or full regulatory compliance, and should be reviewed by your own counsel. Larger customers may request a signed version.

1. Roles

  • Controller: the employer / workspace Admin (shop owner or HR) who determines why and how employee workforce data is processed in Faciro.
  • Processor: Faciro, which processes that data only to provide the leave, attendance, hours, absence, overtime, and payroll-preparation services described below.

2. Subject matter and duration

Processing covers personal data uploaded or generated in the Controller's workspace for the term of the service and until deletion, return, or export assistance after termination, as described here and in our Privacy Policy and Data Retention Summary.

3. Nature and purpose of processing

  • Leave requests, approvals, balances, history, and related reports
  • Team and role management within the workspace
  • Optional attendance clock connection or CSV import (punch times / device person IDs — not biometric templates)
  • Working hours, absences, and overtime derived from attendance and leave day rows
  • Payroll-preparation summaries and optional Mauritius payroll-helper fields (amounts such as salary helper inputs) — Faciro prepares information for payroll teams; it does not process payroll or issue payslips
  • Optional work-from-home declarations and weekly manager approval
  • Email notifications related to leave and approvals

4. Types of personal data and data subjects

  • Data subjects: employees, managers, and admins of the Controller
  • Data: names, contact details, roles; national ID / NIC and date of birth if collected by the Controller; leave records and notes; optional sick attachments (may include health-related information); optional punch times and external clock IDs; hours, absence, and overtime figures; payroll-preparation and helper fields configured by the Controller

The Controller decides whether to collect NIC / ID numbers, medical uploads, and salary helper amounts, and remains responsible for lawful collection and staff notice. See the Employee Privacy Notice.

5. Controller instructions

Faciro processes personal data only on documented instructions from the Controller (including configuration in the product and written requests), unless required by law. The Controller warrants that its instructions are lawful under DPA 2017 and employment law.

6. Confidentiality and security

Faciro shall:

  • Limit access to personnel who need it to provide the service, under confidentiality obligations
  • Implement appropriate technical and organisational measures (HTTPS, hashed passwords, company-scoped isolation, access controls, CSRF protection for browser sessions)

7. Personal data breach notification

Faciro will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's workspace data, with information reasonably available to help the Controller meet its own notification duties under DPA 2017.

8. Subprocessors

The Controller authorises Faciro to use subprocessors needed to run the service. The current production list is published at /subprocessors, including:

  • Neon — Managed PostgreSQL: Primary application database
  • Vercel — Application hosting / edge: Serve the Faciro web application and APIs
  • Resend — Transactional email: Password reset, leave notifications, and operational emails
  • Cloudinary — File storage (CDN): Store leave attachments (e.g. sick leave documents) when object storage is enabled

Faciro remains responsible for subprocessors' performance for this processing. Material changes to core subprocessors will be reflected on the Subprocessors page or on request. Cloudinary is used for leave attachment storage when object storage is enabled.

9. International transfers

Personal data may be processed outside Mauritius by Faciro or its subprocessors. Faciro uses contractual and security safeguards with those providers. Controllers should assess transfer risk for their own DPA registration and internal policies.

10. Assistance with data subject rights

Taking into account the nature of processing, Faciro will reasonably assist the Controller to respond to access, correction, erasure, or objection requests from staff relating to data in Faciro. Employees should normally contact their employer first.

11. Deletion, return, and export assistance

During the subscription, the Controller may export available leave, attendance, and payroll-summary reports through the product where those exports exist. On termination, the Controller should export needed data before closure. Faciro will reasonably assist with deletion or return of workspace personal data within a reasonable period after a written request or termination, except where retention is required by law or for secure backups for a limited time. See the Data Retention Summary.

12. Controller responsibilities

  • Register as a controller with the Mauritius Data Protection Office when required
  • Inform staff that leave, attendance, hours, and related data are processed through Faciro
  • Configure leave balances, attendance mapping, and payroll-helper inputs to match contracts and Mauritius employment rules where they apply
  • Assign managers correctly and limit admin/manager access to what is needed
  • Only upload sick/medical documents when necessary for leave decisions
  • Verify payroll-preparation figures before using them for pay decisions

13. Governing law

This DPA is governed by the laws of Mauritius. Disputes shall be resolved in the courts of Mauritius, unless mandatory local protections require otherwise.

14. Contact

Privacy and processing requests: info@faciro.com

General: info@faciro.com

Data Protection Office: dataprotection.govmu.org