Data processing agreement

This agreement applies whenever Accolgo processes personal data on behalf of a customer organisation, and meets the written-contract requirement inArticle 28 of the GDPR. The customer is the controller; Accolgo is the processor.

Subject matter and duration

Processing of onboarding check-in data (identities and contact details of starters, managers and buddies; worded check-in replies; optional notes; follow-up records) for the duration of the customer's subscription, and after that until Accolgo deletes it at the customer's request or, once automatic deletion is switched on, on the schedule in the retention policy. The data subjects are the customer’s new starters, their line managers and their buddies.

Special category data. The service is designed to collect wellbeing answers and free-text notes. These may contain special category data, in particular data concerning health (including mental health) and information about harassment. The service also infers possible safeguarding concerns from notes, using word checks designed by Accolgo, and routes flagged notes to the senior contacts the controller nominates. By using the service the controller instructs Accolgo to carry out this scanning and routing. Accolgo does not use note text for any purpose of its own, including improving the word checks, which it reviews using only counts of flags and of labels cleared as wrong. The controller is responsible for identifying an Article 6 lawful basis and an Article 9 condition (with any further safeguards Irish law requires), for carrying out a data protection impact assessment before its people use the service, and for telling its people about this processing. A summary of the data protection impact assessment is available on request, using the contact address in our privacy notice. Accolgo will also provide the information the controller needs to complete its own. Accolgo processes this data only to provide the service, applies the measures on the security page, and never uses it for its own purposes.

Instructions

Accolgo processes personal data only on the controller’s documented instructions, which are the provision of the service as documented, and never for its own purposes except anonymised aggregates as described in the terms. Accolgo will tell the controller if, in its opinion, an instruction infringes data protection law. Everyone with access is bound by confidentiality.

Sub-processors

The controller gives general authorisation for these sub-processors. We give notice before adding or replacing one, so the controller has the opportunity to object, and we flow down equivalent obligations under a written agreement in each case.

Stripe acts as an independent controller for choosing payment networks, fraud prevention and legal compliance, under its own privacy notice, and never receives check-in answers or notes.

Security of processing

As Article 32 requires, Accolgo applies appropriate technical and organisational measures, described on the security page: encryption in transit, row-level security with zero anonymous table access, tokenised single-use check-in links, audit records, and least-privilege access.

The private word. A “private word” with someone senior who is not the starter's own manager is accessible only to the organisation's head of people (and owner), the roles every named senior contact on the account must hold. The person's manager is not told, unless the organisation has nobody senior besides the manager, in which case the starter is told this before sending. The words are stored in the database, encrypted at rest by our database provider but not separately encrypted by Accolgo, with the organisation's other check-in answers, and only Accolgo's own authorised technical staff with database administrator access, running the service, could technically read them.

Personal data breaches

Accolgo notifies the controller without undue delay after becoming aware of a personal data breach, with the information the controller needs to meet its own Article 33 duty to notify the Data Protection Commission within 72 hours, and its Article 34 duty to tell affected people where the risk is high, and assists with that notification.

Assistance with rights and assessments

Accolgo assists the controller with data subject requests under Articles 15 to 22, including hard deletion and a copy of one person's data, both done by hand on request, and with data protection impact assessments and prior consultation under Articles 35 and 36. Accolgo makes available the information needed to demonstrate compliance and allows for audits under Article 28(3)(h).

A person’s data export includes the check-in answers their manager and buddy gave about their settling in. Managers and buddies should be told, when they are asked to take part, that their observations form part of the new starter’s record and can be disclosed to that person on request. The one exception is a private-word message, which belongs to the person who raised it, not to the starter it may concern.

International transfers

Personal data is stored in the United Kingdom (Supabase, London), which the European Commission has decided protects personal data adequately. Some sub-processors process limited data in the United States: hosting (Vercel), transactional email (Resend), the in-app help assistant (Anthropic), payments (Stripe, the paying organisation's billing details only) and, where it does not use the EU, error monitoring (Sentry). Those transfers are made either to organisations participating in the EU-US Data Privacy Framework or under the EU standard contractual clauses, supported by a transfer risk assessment. The controller authorises these transfers by entering into this agreement.

Return and deletion

On termination the customer can ask Accolgo for a copy of all its data, and ask for it to be deleted. Until automatic deletion is switched on, Accolgo deletes it by hand when asked. Once it is on, Accolgo deletes it on the retention schedule. In both cases Accolgo keeps only what the law requires be kept, as Article 28(3)(g) provides.