Data processing terms
These terms apply whenever Accolgo processes personal information on behalf of a customer organization, and set out how Accolgo meets the accountability obligation PIPEDA places on the customer for information it hands to a third party for processing. The customer remains the organization accountable for the information under PIPEDA; Accolgo processes it strictly on the customer’s instructions, as its service provider.
Subject matter and duration
Processing of onboarding check-in information (identities and contact details of starters, managers and buddies; worded check-in replies; optional notes; follow-up records) for the duration of the customer's subscription, and after that until Accolgo deletes it at the customer's request or, once automatic deletion is switched on, on the schedule in the retention policy.
Instructions
Accolgo processes personal information only to provide the service as documented, with the knowledge and authorization of the customer, and never for its own purposes except anonymized aggregates as described in the terms. Accolgo treats all such information as confidential.
Sub-processors
| Provider | Purpose | Region |
|---|---|---|
| Supabase | Database, authentication, storage | UK (London) |
| Vercel | Application hosting | Application code runs in London (United Kingdom), the same place as the database. Vercel’s network passes requests through the nearest point of presence, and Vercel states its primary processing facilities are in the United States |
| Resend | Transactional email | US / per sending configuration |
| Sentry | Error monitoring | United States or EU |
| Anthropic | Powers the in-app help assistant, which picks help articles to show. Receives the question a signed-in user types | United States |
| Twilio | Will send the WhatsApp check-in message to a line manager or buddy who chooses WhatsApp, once WhatsApp check-ins start, which is coming soon. It will handle their mobile phone number and the message, which can name the new starter and holds a private check-in link. WhatsApp is only used when a line manager or buddy chooses it. | Not yet confirmed |
| Meta (WhatsApp Business) | Will provide the WhatsApp Business service that carries that message, once WhatsApp check-ins start, which is coming soon. It will handle the same mobile phone number and message. WhatsApp is only used when a line manager or buddy chooses it. | Not yet confirmed |
| Stripe | Takes subscription payments | United States (Stripe, LLC) and Stripe affiliates elsewhere. UK and EEA customers contract with Stripe Payments Europe, Limited |
We give notice before adding or replacing a sub-processor and flow down comparable protection obligations, each under a written agreement, consistent with clause 4.1.3 of PIPEDA’s Schedule 1.
Stripe acts as an independent controller for choosing payment networks, fraud prevention and legal compliance, under its own privacy notice, and never receives check-in answers or notes.
Security safeguards, confidentiality and personnel
As PIPEDA’s safeguards principle requires, Accolgo protects personal information with security safeguards appropriate to its sensitivity, described on the security page: encryption in transit, row-level security with zero anonymous table access, tokenized single-use check-in links, audit records, and least-privilege access. Everyone with access is bound by confidentiality.
The private word. A “private word” with someone senior who is not the starter's own manager is accessible only to the organisation's head of people (and owner), the roles every named senior contact on the account must hold. The person's manager is not told, unless the organisation has nobody senior besides the manager, in which case the starter is told this before sending. The words are stored in the database, encrypted at rest by our database provider but not separately encrypted by Accolgo, with the organisation's other check-in answers, and only Accolgo's own authorised technical staff with database administrator access, running the service, could technically read them.
Breach reporting
Where there are reasonable grounds to believe a breach of security safeguards has occurred that creates a real risk of significant harm to an individual, Accolgo notifies the customer without undue delay so that it can report to the Office of the Privacy Commissioner of Canada and notify affected individuals as PIPEDA’s breach-reporting rules require, and assists with that notification. Accolgo also keeps a record of every breach of security safeguards involving personal information it holds, whether or not it meets the significant-harm threshold, for the period PIPEDA requires.
Individual access and assistance
Accolgo assists the customer with requests for access, correction and deletion, including hard deletion and a copy of one person's data, both done by hand on request, and with privacy impact assessments and audits.
A person’s information export includes the check-in answers their manager and buddy gave about their settling in. Managers and buddies should be told, when they are asked to take part, that their observations form part of the new starter’s record and can be disclosed to that person on request. The one exception is a private-word message, which belongs to the person who raised it, not to the starter it may concern.
Cross-border transfer
Personal information is stored in the United Kingdom (Supabase, London). Some sub-processors process limited information in the United States: hosting (Vercel), transactional email (Resend), the in-app help assistant (Anthropic), payments (Stripe, the paying organisation's billing details only) and, where it does not use the EU, error monitoring (Sentry). PIPEDA does not bar processing outside Canada; it requires the customer, as the accountable organization, to use contractual means to secure comparable protection wherever the information goes, which these terms and our sub-processor agreements provide. Per OPC guidance, the customer should tell affected individuals, generally at or before collection, that their information may be processed outside Canada and may be accessible to that jurisdiction’s authorities under its own laws; our privacy notice does this for you.
Return and deletion
On termination the customer can ask Accolgo for a copy of all its information, and ask for it to be deleted. Until automatic deletion is switched on, Accolgo deletes it by hand when asked. Once it is on, Accolgo deletes it on the retention schedule. In both cases Accolgo keeps only what the law requires be kept.