Vardies legal
Data processing agreement
This summary describes the processor terms that apply when a business uses Vardies to process workforce data. The signed customer agreement controls where it contains additional terms.
Last updated: 27 October 2026
Instructions and scope
The business documents the purposes, categories of people, and categories of data processed through its tenant. Vardies processes that data only to provide the contracted service, follow documented instructions, maintain security, and meet binding legal requirements.
Security and confidentiality
Vardies limits access by role and tenant, encrypts secrets, hashes passwords and kiosk PINs, revokes sessions when accounts are disabled, and records security-relevant activity in an immutable audit trail. Personnel and subprocessors are bound by confidentiality obligations.
Subprocessors and assistance
The business authorises the service providers needed for hosting, mail, payments, and operational monitoring. Vardies keeps provider access limited and assists with data-subject requests, security incidents, impact assessments, and regulator enquiries as required by law.
Return and deletion
The business can export supported records during the subscription. At the end of the service, Vardies deletes or returns tenant data according to the customer instruction and applicable retention duties, while security and billing records may be retained where legally required.