Data processing agreement (dpa) — Payhawk

Cited by

Facts read from this source

• DPA last updated Report an error

  “Last updated on 26 Jun 2026”

• DPA AI training restriction Report an error

  “The Processor shall not use the Controller's Personal Data, including user prompts and conversational histories, to train, fine-tune, or improve any foundational or general-purpose artificial intelligence models.”

• DPA subprocessor notice days Report an error

  “The Processor shall notify the Controller of any intended changes to the List of Sub-Processors in Schedule 2 of this DPA (“List of Sub-Processors”) at least thirty (30) days in advance.”

• DPA audit frequency Report an error

  “The Audit Request shall include at least the scope and duration of the audit and shall not be conducted more than once per year, unless otherwise required under Data Protection Laws.”

• DPA data deletion days Report an error

  “For the duration of the Framework Agreement and deleted 90 days after its expiration or termination, unless the Controller has instructed otherwise.”

• Data subject request notification days Report an error

  “The Processor shall notify the Data Controller promptly, and in any event no later than three (3) business days, of any request from a Data Subject wishing to exercise their rights under the Data Protection Legislation;”

• Core list Report an error

  “Payhawk EOOD Payhawk Platform provider Belgium and Germany (LLMs hosted on Google Cloud)”

• Merge API Report an error

  “Merge API, Inc.¹ API provider for HR Integrations through Payhawk Sweden (AWS EU data centers)”

• Duffel Report an error

  “Duffel Technology Limited² API provider for connectivity with airlines and accommodation providers United Kingdom”

• Certifications Report an error

  “PCI-DSS (The Payment Card Industry Data Security Standard) SOC 2, type 2 SOC 1, type 1 ISO 27001:2022”

• Pentest frequency Report an error

  “Third-party penetration tests are conducted against the application and supporting infrastructure at least annually.”

• Encryption in transit Report an error

  “Communication with Payhawk is encrypted with TLS 1.2 or higher over public networks.”

• Encryption at rest Report an error

  “Payhawk data is encrypted at rest with industry-standard AES-256 encryption.”

• Ddos protection Report an error

  “We utilize AWS Shield’s sophisticated CDN with built-in DDoS protection as well as native AWS tools and application-specific mitigation techniques.”

• Two factor production Report an error

  “2FA is required for all production systems.”

• Environment segregation Report an error

  “Testing, staging, and production environments are separated from one another. No customer data is used in any non-production environment.”

• Disaster recovery Report an error

  “In the event of a major region outage, Payhawk has the ability to deploy our application to a new hosting region.”

• International transfers Report an error

  “the Processor or its Sub-Processor(s) may transfer the Personal Data outside the EEA and/or the UK to a specific data recipient only by duly complying with the provisions of Chapter V of the GDPR/UK-GDPR”

• Card issuers Report an error

  “Payhawk Debit and Credit Cards are issued by Payhawk Financial Services UAB in the EEA, Payhawk Financial Services Limited in the UK, and Cross River Bank, Member FDIC in the US.”

• Company registration Report an error

  “Payhawk Limited is registered under company registration number 11747263, Chancery House, 53-64 Chancery Lane, London WC2A 1QS.”

• Sales contact Report an error

  “Sales sales@payhawk.com”

• Support contact Report an error

  “Support support@payhawk.com”

• DPA version by signup date Report an error

  “Applicable to customers signed on or after 18 August 2025. For customers signed between 23 September 2024 and 18 August 2025 the following DPA will apply. For customers signed before 23 September 2024 the following DPA will apply.”

• Pentest reports on request Report an error

  “Reports are available on request with an appropriate NDA in place.”

• Product eligibility restriction Report an error

  “The Payhawk product is not available for micro-enterprises or small charities based in the UK as defined in the UK Consumer Duty Regulations.”

Scores citing this record

• The Controller European sovereignty
• The Finance Lead European sovereignty
• The Office Manager European sovereignty
• The Skeptic European sovereignty
• The Tax Adviser European sovereignty
• The Travelling Employee European sovereignty