HubbubHR – Commitment to GDPR

HubbubHR GDPR & Data Protection Commitment

Abstract

Protecting personal data is fundamental to HubbubHR’s cloud-based Adaptive Human Capital Management (aHCM) platform.

This GDPR & Data Protection Commitment provides an overview of HubbubHR’s approach to privacy, security, and data protection, and explains how our platform, operational practices, and contractual commitments support customers in meeting their obligations under the General Data Protection Regulation (GDPR), UK General Data Protection Regulation (UK GDPR), and other applicable data protection legislation.

This document is intended to complement, and should be read together with, the HubbubHR Data Processing Agreement (DPA), which sets out HubbubHR’s detailed contractual commitments relating to the processing and protection of Customer Personal Data. It should also be read alongside the HubbubHR Subscription Agreement, Enterprise Security Overview, Privacy Policy, Customer Support & Service Level Agreement (SLA), and other documents forming part of the HubbubHR Trust Centre.

Document Notice

This document is intended to provide a high-level overview of HubbubHR’s privacy and data protection practices. It does not form part of the contractual agreement between HubbubHR and its customers and does not replace the HubbubHR Data Processing Agreement (DPA).

The HubbubHR Data Processing Agreement (DPA) forms part of the contractual framework governing the processing of Customer Personal Data and should be read together with the applicable Subscription Agreement, Privacy Policy, Enterprise Security Overview, Customer Support & Service Level Agreement (SLA), and any other documents expressly incorporated by reference.

1. Our Commitment

At HubbubHR, protecting personal data is fundamental to how we design, develop, operate, and support our cloud-based Adaptive Human Capital Management (aHCM) platform.

We are committed to helping our customers protect employee information and support compliance with applicable data protection legislation, including:

EU General Data Protection Regulation (GDPR)
UK General Data Protection Regulation (UK GDPR)
applicable national data protection legislation
other applicable privacy laws where our customers operate

Privacy and data protection are embedded throughout our platform, operational practices, and contractual commitments.

2. Controller and Processor Responsibilities

In most cases:

Customer acts as the Data Controller, determining why and how personal data is processed.
HubbubHR acts as the Data Processor, processing Customer Personal Data only on documented instructions from the Customer and in accordance with applicable law.

The detailed responsibilities of each party are set out in the HubbubHR Data Processing Agreement (DPA).

3. Data Processing Agreement (DPA)

HubbubHR provides a comprehensive Data Processing Agreement (DPA) which forms part of our contractual framework with customers.

The DPA describes our commitments relating to:

processing Customer Personal Data;
confidentiality;
technical and organisational security measures;
approved subprocessors;
international data transfers;
data subject rights;
personal data breach notification;
audit and compliance obligations;
return and deletion of Customer Personal Data; and
other matters required under applicable data protection legislation.

Customers should review the DPA together with the Subscription Agreement before using the Services.

4. Privacy by Design

Privacy considerations are incorporated throughout the design and operation of the HubbubHR platform.

Examples include:

secure software development;
role-based access controls;
configurable security permissions;
audit logging;
encryption in transit and at rest;
customer-controlled retention and deletion capabilities;
secure APIs and integrations; and
continuous security improvements.

5. Security

HubbubHR is built on Microsoft Azure’s enterprise cloud platform and implements multiple layers of technical and organisational security measures to help protect Customer Personal Data.

These include:

encrypted communications;
encryption at rest;
customer data isolation;
secure authentication;
role-based access controls;
backup and recovery processes;
monitoring and logging;
vulnerability management; and
secure operational practices.

Further information is available in our:

Enterprise Security Overview;
Enterprise Security Guide (available on request); and
Data Processing Agreement (DPA).

6. Data Subject Rights

The HubbubHR platform includes functionality designed to assist customers in responding to requests relating to:

access;
rectification;
erasure;
restriction of processing;
portability; and
correction of personal information.

As Data Controller, Customer remains responsible for determining how such requests are managed.

If HubbubHR receives a request directly from a data subject relating to Customer Personal Data, we will, unless legally prohibited, direct the individual to the relevant Customer.

7. International Data Transfers

Where Customer Personal Data is transferred internationally, HubbubHR implements appropriate safeguards in accordance with applicable data protection legislation.

Information regarding international data transfers, approved subprocessors, and applicable safeguards is contained within our Data Processing Agreement (DPA) and our published Subprocessor List.

8. Artificial Intelligence

HubbubHR may provide AI-assisted functionality, including HubbubHR Copilot, to assist Authorised Users when using the Services.

AI-assisted functionality operates within Customer-configured security permissions and access controls.

Customer remains responsible for reviewing, validating, and exercising appropriate human judgement before relying upon AI-generated outputs or making employment, legal, compliance, payroll, financial, or operational decisions.

Where Customers connect third-party AI services or AI agents through supported APIs or Model Context Protocol (MCP) endpoints, Customer remains responsible for the configuration, governance, and use of those third-party services.

9. Customer Responsibilities

While HubbubHR provides secure technology and contractual commitments to support compliance, customers remain responsible for:

determining the lawful basis for processing personal data;
configuring the Services appropriately;
managing user access and permissions;
responding to data subject requests;
maintaining appropriate organisational policies; and
complying with applicable data protection legislation.

Customers should obtain independent legal advice where appropriate regarding their own legal obligations.

10. Related Documentation

This document should be read together with the following HubbubHR documentation:

Data Processing Agreement (DPA)
Subscription Agreement
Enterprise Security Overview
Customer Support & Service Level Agreement (SLA)
Privacy Policy
Subprocessor List

The Data Processing Agreement (DPA) contains HubbubHR’s detailed contractual commitments relating to the processing and protection of Customer Personal Data and should be considered the primary document governing our data processing obligations.