Data processing agreement

This agreement applies whenever Accolgo processes personal data on behalf of a customer organisation in West Africa or Middle Africa. It is the written contract between a controller and its processor that data protection laws in this region commonly require. The customer is the controller; Accolgo is the processor. Where the law of the customer’s country has no data protection law in force, or does not require a written processor contract, the customer and Accolgo agree that this agreement applies in the same way as a matter of contract. If the customer’s regulator requires further terms, the customer should tell us.

Subject matter and duration

Processing of onboarding check-in data (identities and contact details of starters, managers and buddies; worded check-in replies; optional notes; follow-up records) for the duration of the customer’s subscription, and after that until Accolgo deletes it at the customer’s request or, once automatic deletion is switched on, on the schedule in the retention policy. The data subjects are the customer’s new starters, their line managers and their buddies.

Sensitive data. The service is designed to collect wellbeing answers and free-text notes. These may contain sensitive data, in particular data concerning health (including mental health) and information about harassment. The service also infers possible safeguarding concerns from notes, using word checks designed by Accolgo, and routes flagged notes to the senior contacts the controller nominates. By using the service the controller instructs Accolgo to carry out this scanning and routing. Accolgo does not use note text for any purpose of its own, including improving the word checks, which it reviews using only counts of flags and of labels cleared as wrong. The controller is responsible for identifying the lawful basis, and any condition or consent that the law of its country requires for sensitive data, for carrying out any impact assessment its law requires before its people use the service, and for telling its people about this processing. A summary of the data protection impact assessment is available on request, using the contact address in our privacy notice. Accolgo will also provide the information the controller needs to complete its own. Accolgo processes this data only to provide the service, applies the measures on the security page, and never uses it for its own purposes.

Instructions

Accolgo processes personal data only on the controller’s documented instructions, which are the provision of the service as documented, and never for its own purposes except anonymised aggregates as described in the terms. Accolgo will tell the controller if, in its opinion, an instruction infringes data protection law. Everyone with access is bound by confidentiality.

Confidentiality and reversibility. Some laws in this region ask the controller to sign with its processor a confidentiality clause and a clause that makes it easy to move all the data out at the end of the contract. Burkina Faso (Article 42) is an example that we have read in the official text. Everyone with access to the data is bound by confidentiality (see Instructions), and on termination the customer can ask Accolgo for a copy of all its data (see Return and deletion). The customer may treat those two provisions as the confidentiality and reversibility clauses, and should check with its authority that this is accepted.

Sub-processors

The controller gives general authorisation for these sub-processors. We give notice before adding or replacing one, so the controller has the opportunity to object, and we flow down equivalent obligations under a written agreement in each case.

Stripe acts as an independent controller for choosing payment networks, fraud prevention and legal compliance, under its own privacy notice, and never receives check-in answers or notes.

Accolgo uses Google Analytics on its own website and app, with the visitor’s consent, to learn how people use them. Accolgo uses it for its own purpose, improving the product, and it is not engaged to process the controller’s data on the controller’s behalf. It is not sent names, email addresses, organisation names, check-in answers or anything anyone types, and it is not used on check-in pages. The privacy notice describes it.

Security safeguards, confidentiality and personnel

Accolgo applies appropriate technical and organisational measures to secure the integrity and confidentiality of personal data, described on the security page: encryption in transit, row-level security with zero anonymous table access, tokenised single-use check-in links, audit records, and least-privilege access. Everyone with access is bound by confidentiality.

The private word. A “private word” with someone senior who is not the starter’s own manager is accessible only to the organisation’s head of people (and owner), the roles every named senior contact on the account must hold. The person’s manager is not told, unless the organisation has nobody senior besides the manager, in which case the starter is told this before sending. The words are stored in the database, encrypted at rest by our database provider but not separately encrypted by Accolgo, with the organisation’s other check-in answers, and only Accolgo’s own authorised technical staff with database administrator access, running the service, could technically read them.

Personal data breaches

Accolgo notifies the controller without undue delay and, where practicable, within 48 hours after becoming aware of a personal data breach, with the information the controller needs to meet its own duties to notify its regulator and the affected people, and assists with that notification.

Several countries in this region set a deadline, or a standard, for the controller to tell its authority about a breach. Nigeria sets 72 hours (section 40). Ghana says as soon as reasonably practicable, and its law (section 31) also places the duty on anyone processing data under the controller’s authority; Accolgo will co-operate with any notification that law requires. Its commitment is the same in every country: to tell the controller without undue delay and, where practicable, within 48 hours, so that the controller has as much of any deadline as possible.

Assistance with rights and assessments

Accolgo assists the controller with requests for access, correction and deletion, including hard deletion and a copy of one person’s data, both done by hand on request, and with impact assessments and audits. Accolgo makes available the information needed to demonstrate compliance with this agreement.

A person’s data export includes the check-in answers their manager and buddy gave about their settling in. Managers and buddies should be told, when they are asked to take part, that their observations form part of the new starter’s record and can be disclosed to that person on request. The one exception is a private-word message, which belongs to the person who raised it, not to the starter it may concern.

Cross-border transfer

Personal data is stored in the United Kingdom (Supabase, London). Some sub-processors process limited data in the United States: hosting (Vercel), transactional email (Resend), the in-app help assistant (Anthropic), payments (Stripe, the paying organisation’s billing details only) and, where it does not use the EU, error monitoring (Sentry). Each such transfer is made on this basis: the recipient is bound by a written agreement that upholds protection of the data, and the transfer is necessary for the performance of the service the controller has requested. The controller authorises these transfers by entering into this agreement.

Several countries in this region control the sending of personal data to other countries. Some ask the controller to notify, or to get the authorisation of, its data protection authority before data is stored or processed outside the country. Burkina Faso (Article 42, official text) requires the authority’s prior authorisation, and Nigeria (sections 41 and 43, read from a published copy) requires adequate protection or one of the listed conditions, with the basis recorded. Other countries in this region may have rules of this kind that we have not yet confirmed. The controller is responsible for any notification, authorisation or consent that the law of its country requires before data is stored or processed outside that country.

Return and deletion

On termination the customer can ask Accolgo for a copy of all its data, and ask for it to be deleted. Until automatic deletion is switched on, Accolgo deletes it by hand when asked. Once it is on, Accolgo deletes it on the retention schedule. In both cases Accolgo keeps only what the law requires be kept.