Data processing agreement

This agreement applies whenever Accolgo processes personal data on behalf of a customer organisation in North Africa. It is the written contract between a controller and its processor that data protection laws in this region commonly require. The customer is the controller; Accolgo is the processor. Where the law of the customer’s country has no data protection law in force, or does not require a written processor contract, the customer and Accolgo agree that this agreement applies in the same way as a matter of contract. If the customer’s regulator requires further terms, the customer should tell us.

Subject matter and duration

Processing of onboarding check-in data (identities and contact details of starters, managers and buddies; worded check-in replies; optional notes; follow-up records) for the duration of the customer’s subscription, and after that until Accolgo deletes it at the customer’s request or, once automatic deletion is switched on, on the schedule in the retention policy. The data subjects are the customer’s new starters, their line managers and their buddies.

Sensitive data. The service is designed to collect wellbeing answers and free-text notes. These may contain sensitive data, in particular data concerning health (including mental health) and information about harassment. The service also infers possible safeguarding concerns from notes, using word checks designed by Accolgo, and routes flagged notes to the senior contacts the controller nominates. By using the service the controller instructs Accolgo to carry out this scanning and routing. Accolgo does not use note text for any purpose of its own, including improving the word checks, which it reviews using only counts of flags and of labels cleared as wrong. The controller is responsible for identifying the lawful basis, and any condition or consent that the law of its country requires for sensitive data, for carrying out any impact assessment its law requires before its people use the service, and for telling its people about this processing. A summary of the data protection impact assessment is available on request, using the contact address in our privacy notice. Accolgo will also provide the information the controller needs to complete its own. Accolgo processes this data only to provide the service, applies the measures on the security page, and never uses it for its own purposes.

Instructions

Accolgo processes personal data only on the controller’s documented instructions, which are the provision of the service as documented, and never for its own purposes except anonymised aggregates as described in the terms. Accolgo will tell the controller if, in its opinion, an instruction infringes data protection law. Everyone with access is bound by confidentiality.

Sub-processors

The controller gives general authorisation for these sub-processors. We give notice before adding or replacing one, so the controller has the opportunity to object, and we flow down equivalent obligations under a written agreement in each case.

Stripe acts as an independent controller for choosing payment networks, fraud prevention and legal compliance, under its own privacy notice, and never receives check-in answers or notes.

Accolgo uses Google Analytics on its own website and app, with the visitor’s consent, to learn how people use them. Accolgo uses it for its own purpose, improving the product, and it is not engaged to process the controller’s data on the controller’s behalf. It is not sent names, email addresses, organisation names, check-in answers or anything anyone types, and it is not used on check-in pages. The privacy notice describes it.

Security safeguards, confidentiality and personnel

Accolgo applies appropriate technical and organisational measures to secure the integrity and confidentiality of personal data, described on the security page: encryption in transit, row-level security with zero anonymous table access, tokenised single-use check-in links, audit records, and least-privilege access. Everyone with access is bound by confidentiality.

The private word. A “private word” with someone senior who is not the starter’s own manager is accessible only to the organisation’s head of people (and owner), the roles every named senior contact on the account must hold. The person’s manager is not told, unless the organisation has nobody senior besides the manager, in which case the starter is told this before sending. The words are stored in the database, encrypted at rest by our database provider but not separately encrypted by Accolgo, with the organisation’s other check-in answers, and only Accolgo’s own authorised technical staff with database administrator access, running the service, could technically read them.

Personal data breaches

Accolgo notifies the controller without undue delay and, where practicable, within 48 hours after becoming aware of a personal data breach, with the information the controller needs to meet its own duties to notify its regulator and the affected people, and assists with that notification.

Morocco’s law, as we have read it, does not set a deadline for telling the CNDP about a breach, and we have not confirmed the position in Libya or Sudan. Whatever the local rule, Accolgo’s commitment is the same: to tell the controller without undue delay and, where practicable, within 48 hours.

Assistance with rights and assessments

Accolgo assists the controller with requests for access, correction and deletion, including hard deletion and a copy of one person’s data, both done by hand on request, and with impact assessments and audits. Accolgo makes available the information needed to demonstrate compliance with this agreement.

A person’s data export includes the check-in answers their manager and buddy gave about their settling in. Managers and buddies should be told, when they are asked to take part, that their observations form part of the new starter’s record and can be disclosed to that person on request. The one exception is a private-word message, which belongs to the person who raised it, not to the starter it may concern.

Cross-border transfer

Personal data is stored in the United Kingdom (Supabase, London). Some sub-processors process limited data in the United States: hosting (Vercel), transactional email (Resend), the in-app help assistant (Anthropic), payments (Stripe, the paying organisation’s billing details only) and, where it does not use the EU, error monitoring (Sentry). Each such transfer is made on this basis: the recipient is bound by a written agreement that upholds protection of the data, and the transfer is necessary for the performance of the service the controller has requested. The controller authorises these transfers by entering into this agreement.

Some countries in this region control the sending of personal data to other countries. Morocco is one: its law allows a transfer only to a country with sufficient protection, unless an exception applies (such as the person’s express consent, the performance of a contract, or the express authorisation of the CNDP). The controller is responsible for any consent, notification or authorisation that the law of its country requires before data is stored or processed outside that country.

Return and deletion

On termination the customer can ask Accolgo for a copy of all its data, and ask for it to be deleted. Until automatic deletion is switched on, Accolgo deletes it by hand when asked. Once it is on, Accolgo deletes it on the retention schedule. In both cases Accolgo keeps only what the law requires be kept.