Privacy notice

A new starter, a line manager or a buddy can get their check-ins by WhatsApp instead of email, but only if they have agreed to it themselves or, when they have no email address, their organisation has confirmed it has their permission.

This notice explains how Accolgo handles your personal data. It is the version for people in Southern Africa (Botswana, Eswatini, Lesotho and Namibia (South Africa has its own version)). People in South Africa have their own version of this notice, which refers to South African law. Accolgo is an early-warning system for the first months of a new job. It asks a new starter, their line manager and a buddy short check-in questions and turns the answers into a colour and a suggested next step for the line manager, without anyone reading the individual answers so that a supportive conversation happens at the right moment. Data protection law differs from country to country, so the section "The data protection laws that may apply to you" says what we know about each country.

Accolgo’s colour, reasons and suggested next step are there to prompt a supportive conversation, not to judge anyone’s performance.

Who is responsible for your data

Your employer (the organisation that invited you) decides why and how your check-in data is used, so under data protection law it is the controller. Accolgo, a trading name of Clickonic Limited, a company registered in England and Wales, processes that data on the employer’s documented instructions as its processor. Questions about your data should go first to your organisation’s people team; you can also contact Accolgo directly. Where your country’s law requires your employer to register with or notify a data protection regulator, to get a regulator’s authorisation, or to appoint a data protection officer, that is your employer’s responsibility as controller.

Your employer is responsible for choosing the legal reasons for using your information, and must be able to tell you what they are.

The data protection laws that may apply to you

Data protection law differs between the countries in Southern Africa, and we have not confirmed the position in every country. This is what we have found for each country this version covers. In the last column, "Confirmed" means we have read the text of the law ourselves, and we say whether it was the official text or a published copy. "Not confirmed" means we have not yet read the law ourselves, so we say nothing about what it requires. Laws change, and this is a plain-English guide, not legal advice. Your employer, as controller, is responsible for working out which law applies to it.

Botswana. The Act has been in force since 14 January 2025. We have not yet read its sections, so we do not describe what it requires. Your employer should check it.

Eswatini. The controller must notify the Authority of its processing (section 46). Where a processor is not based in Eswatini, the controller must take reasonable steps to make sure that the processor complies with the data protection law of the place where the processor is based (section 16(3)). Accolgo is based in the United Kingdom, where the UK GDPR applies. A person can complain to the Authority (section 34). The Act asks that a breach is notified to the Authority and to the person as soon as reasonably possible (section 17).

Namibia and Lesotho. We have not confirmed whether Namibia has a data protection law in force, or whether Lesotho’s regulator has been set up. Accolgo still applies the same safeguards, set out in this notice and in the data processing agreement, in every country.

Registration, notification and authorisation. In some countries in this region the employer, as controller, must notify its data protection regulator of its processing (Eswatini does, in section 46), and in some it may need the regulator’s authorisation before data leaves the country (see below). The employer’s own registration, notification or authorisation is the employer’s responsibility as controller. If you are an employer, please check the rules in your own country.

What we collect

• Your name, work email, job title, start date and who your manager and buddy are.
• Your check-in answers: worded replies to short questions.
• Your notes and requests: an optional note to your manager, and an optional request for a conversation.
• From managers and buddies: their check-in answers about how the starter seems.
• Follow-up records: that a manager marked a conversation as done, with an optional short note.
• From a new starter, line manager or buddy who gets check-ins by WhatsApp: the mobile phone number their organisation gives us, used only once they have agreed to it themselves or, if they have no email address, once their organisation has confirmed it has their permission.
• When you confirm WhatsApp yourself, we keep the time and the internet address and browser you used, as proof that it was you.
• Where an organisation confirms WhatsApp for someone who has no email address, we keep who at the organisation confirmed it (their name), when they did, the number and the version of the wording they confirmed against.

We collect this to support your settling in, which is a purpose your employer has decided on. You are told what is collected before your first check-in.

Health and other sensitive information

Some check-in questions ask how you are feeling and settling in. Your answers, and anything you choose to write in a note, may tell us something about your health, including your mental health, or about something that has happened to you at work, such as harassment. Data protection laws in this region generally treat information about health as sensitive and give it extra protection. We do not ask you for it directly, but you may choose to share it, and we treat everything you write as if it could be.

When a note may mean you, or someone else, is at risk. Accolgo’s software reads each note for words that suggest a risk of harm, sexual harassment, bullying, or another safety concern. If it finds them, it marks the note with that type of concern and sends it straight away to the senior people your employer has named to handle this (usually the head of people). It may also show you details of a free helpline.

A note you write for your manager is read by your manager. Your head of people sees it only if your next check-in is still not settling. When Accolgo picks up a safety concern in a note, it also goes to HR. If our software thinks the note may show a concern, we will ask you whether it is about your manager. If you say yes, your manager will not see it and only the senior people will. A private word with someone senior, or a note you have said is about your manager, goes to your manager only if your organisation has nobody senior other than your manager, and you are told this before you send it.

The software can be wrong in both directions: it can mark something that was not a concern, and it can miss something that was. The software never makes a decision about your job, pay, probation or performance. It only decides who is shown a note and what marking appears; a person at your employer reads it and decides what happens.

Who decides the rules. Your employer decides whether to use Accolgo and who receives these notes, and is responsible for the legal reasons for handling this information. Accolgo designs the word checks and the categories. You can ask your employer which legal reasons it relies on.

How long it is kept. A note that raised a concern is kept while the concern is open, even if it would otherwise have been deleted, so that nothing is lost while it is being dealt with. After that it follows the normal schedule in our data retention policy.

Your choice. You never have to write a note. If you would rather speak to someone in person, you can ask for a word with your manager, or a private word with someone senior who is not your manager.

Who sees your answers

Nobody at your organisation reads your individual answers: not your manager, not the head of people and not anyone in HR. Accolgo’s software turns your answers into a colour, the reasons behind it and a suggested next step for your manager. Your answers are stored in our database. Our database provider (Supabase) encrypts everything it stores at rest; Accolgo does not add separate encryption of its own. Access to the stored data is limited to the Accolgo application itself and Accolgo’s own authorised technical staff, who need it to run the service, not to read your answers, and to Supabase as the provider that hosts it. A note you choose to write to your manager is read by your manager. If your next check-in is still not settling, your head of people sees that note too, with your manager’s follow-up notes. When Accolgo picks up a safety concern in a note, it also goes to HR, or to HR alone if it is about your manager. A private word with someone senior goes to the head of people and any named senior contacts your organisation has set up, as described below.

In rare cases, such as a legal requirement or a serious safety concern, a starter’s answers can be released to their employer, only on a written request approved by Accolgo, and never routinely.

Markings, not verdicts. Accolgo turns each check-in into simple scores by topic (1 to 5), and uses them to give each new starter one of four markings: Needs attention, Worth watching, Settling well, or Too early to tell. The marking is a prompt for your manager to have a conversation, not a judgement about you or your performance. It is never used to rank people against each other and there are no league tables of people. The software never makes a decision about your job, pay, probation or performance. It only decides who is shown a note and what marking appears; a person at your employer reads it and decides what happens. You can ask to see your markings and scores as part of a subject access request.

What we never do

• No automated decision-making that produces legal or similarly significant effects. Every decision about a person is taken by a human at your employer.
• A “private word” with someone senior who is not your manager goes to the head of people and to any named senior contacts your organisation has set up. It never goes to your manager, except when your organisation has nobody senior other than your manager, in which case you are told this before you send it and shown other sources of help. Where it does not go to your manager, the head of people decides whether, and when, your manager is told. It is stored in the database along with other check-in answers, and access to that stored data is restricted to Accolgo’s own authorised technical staff, who need it to run the service.
• No selling of data, no advertising, no profiling beyond the check-in signal itself.
• Nothing is collected covertly: every check-in is asked for openly, by email or by WhatsApp, and new starters are shown a short "who sees what" welcome before their first check-in.

Your rights

Data protection laws in this region give people rights over their personal data. Depending on where you live, these usually include the right to be told what data is held about you and to ask for a copy of it, to ask for it to be corrected or deleted, and to object to its use. Some laws add other rights, and some countries have no data protection law (see above). A request for your data includes what your manager and buddy said about you, balanced against their privacy as the law requires. Requests go to your organisation’s people team or to Accolgo, and are handled within a reasonable time and within any deadline the law of your country sets.

If you believe your data has been mishandled, you may complain to your employer, and then, where your country has one, to the data protection regulator. In Eswatini you can complain to the Eswatini Data Protection Authority (section 34). In Botswana, Lesotho and Namibia we have not yet confirmed the complaint route. We would ask that you raise it with us or your employer first so we can put it right.

If you contact us through our website

If you use the enquiry form on our website, we collect your name, work email, organisation, roughly how many new starters you take on a year and anything you write in your message. We use these details only to reply to your enquiry. They are sent to us by email through our email provider and are not saved in the Accolgo database. For these details, Clickonic Limited (Accolgo is its trading name) decides how they are used. We keep the email for as long as we need it to deal with your enquiry and anything that follows from it.

Cookies and website analytics

Accolgo sets essential cookies to keep you signed in and to remember your cookie choice. These do not need your consent.

If you accept analytics cookies, we use Google Analytics to learn how people use our website and the Accolgo app, so we can improve them. It records which pages are opened, which buttons and links are pressed, how many fields of a form have been used and whether the form was sent or left, which error appeared (as a short code, never the message), how fast pages load and how long people stay on a page or a step. It records whether a video on our website is played, how far through it people get (a quarter, half, three quarters or the end) and whether it is watched to the end. If you arrive from one of our email or campaign links, it also records the name of that campaign, taken only from the campaign tags in the link. It also records which features are used, such as running the calculator, starting the product tour or adding a new starter. For signed-in users it also records their kind of role (for example line manager or head of people) and which country's version of the site they use.

It never records names, email addresses, organisation names, check-in answers or anything anyone types, and page addresses are recorded without any record number in them. Google Analytics is never used on the check-in pages that new starters, managers and buddies answer, on unsubscribe pages or in emails.

Google Analytics sets cookies whose names begin with _ga. They last up to six months. Google's advertising features are switched off, so nothing collected is used for advertising. Google Analytics keeps this data for 14 months and then deletes it.

For this analytics data, Accolgo decides how this data is used. Accolgo is a trading name of Clickonic Limited. We rely on your consent for these cookies and for the analytics they make possible. Google may process this data in the United States and other countries.

You choose whether to accept or reject analytics cookies when you first visit. You can change your choice at any time using the Cookie settings link at the foot of the page. If you withdraw your consent, analytics stops straight away and we remove the Google Analytics cookies from your browser. We ask again after six months.

Contact us

For anything about your personal data, including asking for a copy of it or making a complaint, email dermot@clickonic.co. You can also contact your employer’s people team, who are responsible for your data. If you are still unhappy, you can complain to the data protection regulator in your country, where there is one (see the table above).

Where data lives, and cross-border transfer

Your check-in data is stored in the United Kingdom, in Supabase’s London region. Some processors handle limited data elsewhere: hosting (Vercel), transactional email (Resend) and the in-app help assistant (Anthropic) may process it in the United States, and error monitoring (Sentry) in the United States or the EU.

Because all of this is outside the country you live in, your employer, as controller, authorises each transfer by using Accolgo. Each recipient is bound by a written agreement that upholds protection of the data, and each transfer is necessary for the service your employer has asked for. Our processors are hosting (Vercel), database and authentication (Supabase), transactional email (Resend), WhatsApp messages (Twilio and Meta), error monitoring (Sentry), the in-app help assistant (Anthropic) and payments by your employer (Stripe, which never sees your check-ins). Each is bound by a written processor agreement, or, for Twilio and Meta, by their published data processing terms.

Sending data abroad. Some countries in this region control the sending of personal data to other countries, and some ask the employer, as controller, to tell the regulator or to get its authorisation first. Because Accolgo stores data in the United Kingdom and uses processors in the United States and the EU, these rules can apply to your employer. What we have found:

• Eswatini (confirmed, section 33): personal information may go to a recipient outside Eswatini and outside the Southern African Development Community only if the recipient’s country gives an adequate level of protection. There are exceptions, including the person’s unambiguous consent and where the transfer is necessary to carry out a contract. The Commission may authorise a transfer to a country without adequate protection if the controller satisfies it that there are adequate safeguards, in particular contractual clauses.

• Botswana, Lesotho and Namibia: we have not yet confirmed the transfer rules.

It is the employer’s responsibility, as controller, to make any notification or get any authorisation or consent that its own country requires.

When a new starter, line manager or buddy gets check-ins by WhatsApp, having agreed to it themselves or, if they have no email address, through their organisation’s confirmation, the message is sent from Accolgo’s WhatsApp number, which is run by Clickonic Limited, through Twilio, and Meta provides the WhatsApp Business service that carries it. The same applies to the sign-in link we send by WhatsApp to a line manager who has no email address. Twilio and Meta handle their mobile phone number and the message, which can name the new starter and holds a private check-in or sign-in link. Twilio and Meta are bound by their published data processing terms, and where they process this data, which may be outside your country, is not yet confirmed.

You can reply STOP to any WhatsApp message at any time. We then stop using WhatsApp for you and use email instead or, if we have no email address for you, send nothing more.

How long we keep it

We intend to keep personal data only for as long as the onboarding programme needs it, and then delete it on the schedule in our data retention policy. Automatic deletion is not switched on yet. Until it is, we keep personal data until it is deleted, and we delete it by hand when your organisation asks or you exercise your right to deletion, save for anything the law requires us to keep. The retention page has the dated update.

Anonymised history, which no longer identifies anyone, is intended to be deleted once it is more than 3 years old, once automatic deletion is switched on.