B2B Terms of Service & Data Processing Agreement (DPA)
Contractual SaaS subscription terms, liability disclaimers and caps, Kiosk/AI governance rules, and integrated Data Processing Agreement (Art. 28 GDPR).
This agreement governs professional use of SekiaHR by the Customer Company. SekiaHR provides a software tool “AS IS” and does NOT provide legal, labor, or tax advice. It includes a binding Data Processing Agreement (Art. 28 GDPR DPA).
1. Nature of the SaaS Service, No-Legal-Advice Shield & Acceptance Audit Trail
SekiaHR grants the Customer Company a Software-as-a-Service (B2B SaaS) license solely for internal human resources management. The relationship between the parties is strictly commercial and independent; no employment, co-employment, or legal representation relationship exists between SekiaHR and the Customer Company’s workers.
⚖️ “AS IS” Technological Provision: The software is provided as an IT support tool. While SekiaHR maintains industry-leading availability, security, and engineering standards, it does not warrant that the Customer Company’s configuration will automatically satisfy every collective bargaining agreement or labor inspection criterion without proper configuration and human review by the Customer.
🛡️ No-Labor-Advice & No-Payroll-Agency Shield: SekiaHR is NOT a labor law firm, payroll agency (gestoría), or tax consultancy. Severance and settlement simulator outputs, working-time alerts, AI-suggested shift schedules, and OCR expense extractions are strictly indicative and auxiliary. The Customer Company bears sole responsibility for verifying all data and calculations with its licensed labor advisor or legal counsel before taking any action with legal or financial impact on workers.
Current Version, Evidentiary Electronic Acceptance Log (Timestamp + IP) & Prevalence
In accordance with Art. 23 LSSI-CE and the EU eIDAS Regulation (910/2014), electronic acceptance of these Terms and the DPA Annex upon registration at /registro or upon material updates is immutably logged on our servers with the exact UTC timestamp, legal text version identifier, and acceptor IP address, constituting full documentary evidence between the parties.
2. Customer Responsibilities, Indemnification, Kiosk Mode, Billing Lifecycle & Liability Cap
Exclusive Customer Responsibility for Configuration & Labor Compliance
The Customer Company is solely and exclusively responsible for: (a) the accuracy and lawfulness of uploaded employee data; (b) proper configuration of work calendars, shifts, breaks, and collective bargaining agreements; (c) compliance with obligations before the Labor Inspectorate (ITSS), Social Security, and Tax Authorities; and (d) safeguarding administrator credentials.
Express Indemnification Clause & Prior Employee Notice Duty (Art. 90.2 LOPDGDD & Art. 20.3 ET)
The Customer Company undertakes to inform its workers and, where applicable, legal worker representatives in writing prior to deploying the time-tracking system, shared Kiosk terminals, or point-in-time geolocation, in compliance with Article 90.2 LOPDGDD and Article 20.3 of the Spanish Workers’ Statute. The Customer Company shall hold SekiaHR completely harmless and indemnify it (covering any fines, damages, settlements, and legal fees) against any judicial, administrative, or employee claim arising from failure to provide such prior notice, unlawful configuration, or illegal instructions.
Shared Terminal (Kiosk Mode) & Offline Clock-In with Deferred Synchronization
When the Customer Company enables Kiosk Mode (/kiosk) on shared tablets or workplace terminals, or when employees use offline clock-in features with deferred synchronization upon regaining connectivity, the Customer Company is solely responsible for securing the physical placement of the shared device, preventing third-party observation of personal PIN codes, and auditing deferred-sync timestamps.
Subscriptions, Upgrades/Downgrades, 30-Day Notice & Cancellation vs. Irreversible Deletion
Plan upgrades take effect immediately on a prorated basis; plan downgrades take effect at the start of the next billing cycle. Any price modification or material amendment to these Terms shall be notified at least thirty (30) calendar days in advance. Processed billing periods are non-refundable except in cases of billing error attributable to SekiaHR or mandatory law. Upon subscription cancellation, the Customer retains read and export access until the end of the current cycle plus 30 days. If the Customer requests permanent account deletion, it acknowledges that deletion is irreversible and that it must first export its 4-year time-tracking records (RDL 8/2019) to fulfill its statutory custody duty.
Maximum Aggregate Liability Cap (12-Month Fees) & Statutory Carve-Out
💰 Except in cases of willful misconduct or gross negligence (dolo o culpa grave under Art. 1102 of the Spanish Civil Code and Art. 82 GDPR), SekiaHR’s maximum aggregate contractual and non-contractual liability to the Customer Company for all claims arising from the service shall be strictly capped at the total fees actually paid by the Customer Company to SekiaHR during the twelve (12) months immediately preceding the event giving rise to liability.
Exclusion of Indirect Damages & Administrative Labor Sanctions
Under no circumstances shall SekiaHR be liable for lost profits, loss of business opportunity, indirect or consequential damages, nor shall it assume payment of infraction notices, surcharges, or fines imposed on the Customer Company by the Labor Inspectorate (LISOS), Data Protection Authorities, or Tax Authorities resulting from employee failure to clock in, delays, lack of notice, or misconfiguration.
3. Binding Annex: Data Processing Agreement (DPA — Art. 28 GDPR)
This section constitutes a legally binding Data Processing Agreement under Article 28 of Regulation (EU) 2016/679 (GDPR) and Article 33 LOPDGDD, taking effect automatically upon registration of the Customer Company:
Subject Matter, Duration & Documented Instructions (Art. 28.3.a GDPR)
Roles & Scope: The Customer Company is the Data Controller and SekiaHR acts as Data Processor with respect to HR data hosted in the Customer’s workspace. SekiaHR processes data solely on documented instructions from the Customer (as reflected in platform configuration) throughout the subscription term.
Technical and Organizational Security Measures (Art. 32 GDPR)
Security by Design: SekiaHR enforces TLS 1.3 encryption in transit and AES-256 at rest, strict logical tenant isolation (companyId), role-based access control (RBAC), cryptographic password hashing, encrypted daily backups, and local EU-hosted OCR inference servers without third-party transfers.
Special Categories of Data (Art. 9.2.b GDPR — Medical Leave & Document Audit)
Occupational Health Data: Where processing includes medical leave certificates or absence justifications containing health data under Art. 9.2.b GDPR, SekiaHR enforces segregated storage restricted to authorized HR roles and logs an immutable audit trail (actor, timestamp, and IP) on every upload, view, download, or deletion.
Personal Data Breach Notification (Art. 33 GDPR)
Incident Response: In the event of a personal data breach affecting Customer Company assets, SekiaHR shall notify the Customer without undue delay and no later than 48 hours after becoming aware, providing the technical details required for regulatory notification.
Sub-processors & Sovereign European Infrastructure (Art. 28.2 & 28.4 GDPR)
EU Sovereignty: SekiaHR hosts its databases (PostgreSQL), document storage (MinIO S3), mail engine (BillionMail), and AI OCR engine on dedicated European Union infrastructure. Any addition or replacement of infrastructure sub-processors will be notified in advance, allowing the Customer Company to lodge a reasoned objection.
Assistance, Audit Rights & Deletion or Return Upon Termination (Art. 28.3.e-h GDPR)
Portability & Certified Erasure: SekiaHR assists the Customer in responding to data subject rights requests and provides full export tools (CSV/PDF). Following contract termination and the 30-day export window, SekiaHR deletes production data and purges encrypted backups within a maximum of 60 days, unless statutory blocking applies.
4. Governing Law, B2B Venue & Severability
This agreement is governed by Spanish law. Should any clause be declared void or unenforceable, the remaining provisions shall remain in full force and effect. For any dispute arising from this B2B agreement, the parties submit exclusively to the Courts and Tribunals of SekiaHR’s domicile in Spain.
For contractual inquiries or to request a countersigned copy of the DPA, write to legal@sekiahr.com.
Version v2.0 · Last updated: October 2026