Data processing agreement
This agreement forms part of the Reimgo terms of service between the customer ("you", the controller) and HRX360 Ltd ("we", the processor). Last updated 16 November 2026.
1. Roles and scope
You are the controller of the personal data your company and its users put into Reimgo (account data, expense data, receipts, bank details). We are the processor. We process that data only to provide the service, on your documented instructions, which are these terms, the settings your admins choose in the app, and the actions your users take. Switching on AI apps and a user approving an app is your instruction to deliver the data that user can see to that app; from then on that app's provider is not our sub-processor, and its handling of the data is a matter between you and that provider.
2. Our obligations
We process personal data only on your instructions unless the law requires otherwise, in which case we tell you first where the law allows. Our staff who can access personal data are bound by confidentiality and access the data only for support and operations, under access controls that are logged.
We keep the security measures described on our security page: a database per customer, encryption in transit, encryption at rest for bank details and payment files, hashed passwords, two-factor sign-in for admin and finance users, a second person and a fresh code to release payments, an append-only audit trail, nightly backups.
We tell your admin without undue delay, and within 72 hours of becoming aware, of a personal data breach affecting your data, with what we know and what we are doing. We help you respond to data subject requests and to assessments or consultations your law requires, within reason and at no charge for ordinary requests.
3. Sub-processors
We use the sub-processors on our sub-processor list. Each is bound by written terms no less protective than this agreement, and we stay responsible for their work. We give at least 30 days' notice of a new sub-processor by email to your admin; if you object on reasonable data-protection grounds and we cannot resolve it, you may end the service and we refund any prepaid fees for the rest of the term.
4. International transfers
Personal data of UK and EU persons that leaves the United Kingdom or the European Economic Area is transferred under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which are incorporated into this agreement, or under another lawful mechanism. Our hosting location is stated in the privacy policy and on the sub-processor list.
5. Deletion and return
You can export your data at any time while the account exists, including while it is read-only. When the account closes we delete your personal data within 90 days, except what we must keep by law, and we delete backups on their rolling schedule. A former employee's personal data can be removed by your admin at any time; the financial records stay under a pseudonym, which the law on record-keeping requires.
6. Audit and records
We keep a record of processing on your behalf and, once a year on reasonable notice, answer a written security questionnaire or give you the results of our own assessments. Where your law requires an audit, you or an auditor you appoint and we agree may audit our compliance with this agreement, at your cost, no more than once a year unless a breach or a regulator requires more.
7. Liability and precedence
The liability caps and exclusions in the terms of service apply to this agreement. Where this agreement and the terms conflict about personal data, this agreement prevails. It lasts as long as we process personal data for you.