Data Protection & Information Security
Your data, protected to international standards — from your office to ours, and everywhere in between.
GDPR
Compliant
DPA
Signed with every client
IDTA
Managed for UK to SA transfers
Hetzner
Hosting in Germany
Our Data Protection Commitments
When you hire through Xpert Remote Staffing, you trust us with personal information about your business, your people and your customers. We take that responsibility seriously. Our data protection framework is built to meet the requirements of every market we serve, so you can grow your team in South Africa with complete confidence.
GDPR compliant
A Data Processing Agreement (DPA) with every client
We manage the IDTA for UK to South Africa transfers
POPIA compliant at home
Hosted by Hetzner, Germany
All Xpert Remote Staffing and client data is hosted in Hetzner’s data centres in Germany — the gold standard for information security. Germany has some of the strictest data protection laws in the world, and Hetzner is one of Europe’s most trusted hosting providers.
- ISO/IEC 27001 certified: Hetzner’s information security management is certified to the leading international standard.
- Data stays in the EU: your information is stored under the full protection of GDPR and German data protection law.
- Secure facilities: access-controlled data centres with round-the-clock monitoring.
- Built for reliability: redundant power, cooling and network connections keep services running.
- DDoS protection: infrastructure is protected against denial-of-service attacks.
Why this matters to you
Your data is not just stored somewhere offshore. It sits in the European Union, inside one of the most tightly regulated data protection environments in the world, under contracts that give you clear rights and control.
How Xpert complies
Data Protection Across Our Markets
We serve clients in the United Kingdom, United States, Australia, Europe and Canada. Here is how we meet the data protection expectations of each market
United Kingdom
Key data protection law
UK GDPR and the Data Protection Act 2018 (regulator: ICO)
How Xpert adheres
Signed DPA with every client, IDTA managed by us for UK to SA transfers, GDPR-aligned processing
European Union
Key data protection law
General Data Protection Regulation (GDPR)
How Xpert adheres
GDPR compliant processing, signed DPA, data hosted within the EU in Germany
United States
Key data protection law
State privacy laws such as the California Consumer Privacy Act (CCPA/CPRA)
How Xpert adheres
Signed DPA, GDPR-level safeguards applied as standard, secure EU hosting
Canada
Key data protection law
PIPEDA, plus provincial laws such as Quebec’s Law 25
How Xpert adheres
Signed DPA setting out accountability and safeguards for data processed abroad
Australia
Key data protection law
Privacy Act 1988 and the Australian Privacy Principles
How Xpert adheres
Signed DPA giving contractual protection for cross-border disclosure, in line with APP 8
South Africa
Key data protection law
Protection of Personal Information Act (POPIA)
How Xpert adheres
Full POPIA compliance as a South African responsible party and operator
How We Protect International Transfers
Moving data across borders is where many providers fall short. We make sure every transfer has the right legal safeguard in place. View the information to the right to find out more about each data journey.
UK client → Xpert (South Africa)
Legal safeguard
International Data Transfer Agreement (IDTA)
Who handles it
Xpert manages it for you
EU client → Xpert (South Africa)
Legal safeguard
EU Standard Contractual Clauses (SCCs)
Who handles it
Xpert manages it for you
Any client → Xpert
Legal safeguard
Data Processing Agreement (DPA)
Who handles it
Signed with every client
Xpert → Hetzner (Germany)
Legal safeguard
Stored within the EU under GDPR
Who handles it
Xpert, with Hetzner as hosting provider
Xpert vs a Typical Offshore Provider
| Xpert Remote Staffing | Typical offshore provider | |
|---|---|---|
| Data Processing Agreement | Signed with every client | Often not offered |
| UK transfer safeguards (IDTA) | Managed by Xpert | Left to the client |
| GDPR compliance | Yes | Varies |
| Data hosting | Hetzner, Germany (EU) | Often unclear or unspecified |
| ISO 27001 certified hosting | Yes | Not always |
| Home-country privacy law | POPIA (GDPR-aligned) | Varies by country |
| Overseen by employment lawyers | Yes | Rarely |
Your Rights and Our Accountability
- Transparency: you always know what data we hold and why.
- Control: we process your data only on your documented instructions.
- Confidentiality: staff with access to personal data are bound by confidentiality obligations.
- Breach notification: we will notify you promptly of any personal data breach, as set out in your DPA.
- Return or deletion: at the end of our engagement, your data is returned or securely deleted.
- Legal oversight: our business is managed by qualified employment law specialists.
Frequently Asked Questions
Are you GDPR compliant?
Yes. Xpert Remote Staffing is GDPR compliant and also complies with South Africa’s POPIA.
Do I need to sign a DPA?
Yes — we sign a Data Processing Agreement with every client before any personal data is processed.
Who handles the IDTA for UK transfers?
We do. We put in place and manage the International Data Transfer Agreement for all UK to South Africa transfers.
Where is my data stored?
In Hetzner’s ISO/IEC 27001 certified data centres in Germany, inside the European Union.
Can I see your data protection documents?
Of course. Ask your account manager for a copy of our DPA and transfer documentation at any time.
Disclaimer: This information is a general guide and does not constitute legal or tax advice. Employment and tax rules differ by country and change over time. Clients should seek advice on their own circumstances before engaging a contractor.
Hire With Confidence
Contact Xpert Remote Staffing to request our DPA or discuss your data protection requirements.