Helia HR

Data Processing Agreement

Last updated 2026-09-14 · See also Privacy Policy

1. Our role

For the employee and organisational data your company stores in Helia HR, your company is the data controller and Helia HR is the data processor under GDPR Article 28. We process that data only on your documented instructions, as captured in your subscription. For the data we collect about your admins to operate the service (sign-in email, IP address, audit-log actor), we are the controller, and our Privacy Policy covers it.

2. Where the data lives

In the EU. The database is in Frankfurt (Supabase) and the application runs in Frankfurt (Vercel, fra1). Your HR records are not transferred outside the EU/EEA. The one exception is the optional AI features: the specific text sent for a feature is processed by OpenAI in the United States under Standard Contractual Clauses. The features are on by default wherever Helia AI is available, an owner can switch all of them or any one off in Settings → AI, and How Helia AI works explains what is and is not sent.

3. Sub-processors

We use these providers to run the service. It is the same list as section 8 of our Privacy Policy.

  • Supabase (Frankfurt, EU): Primary database and file storage.
  • Vercel (Frankfurt, EU): Application hosting and serverless functions.
  • Resend (EU): Transactional email: magic links, invitations and notifications.
  • Cloudflare: DNS and inbound email routing for our domain.
  • Sentry (Germany, EU): Error tracking: reports of errors in the application, sent from our servers.
  • Google: Identity provider, only if you choose to sign in with Google.
  • Paddle (EU): Our payment provider for billing and VAT, used when you choose a paid plan.
  • OpenAI (US): Powers the optional AI features. Only the fields a given AI action needs are sent, under a no-training agreement: when someone uses an AI feature, and when a candidate applies through a public job page while CV screening is on, so the CV can be parsed.

4. Security of processing

The technical and organisational measures we apply under GDPR Article 32 are described in section 10 of our Privacy Policy.

5. Getting the DPA

Email hello@heliahr.com and ask for the DPA. We send it to you for signature, and once you have signed and returned it, we countersign and send the executed copy back.

To receive the DPA for signature, or with any question about how we process your data, email hello@heliahr.com.