This agreement forms part of our terms of service. It covers the personal data a customer puts into Ayekoo about its employees and other people. The customer is the data controller and [Registered company name] is its data processor under Ghana's Data Protection Act, 2012 (Act 843).
What we process
Purpose
Providing Ayekoo to the customer: storing, showing, calculating, exporting and notifying, as the customer's admins and users direct.
People
The customer's employees, former employees, job candidates the customer adds, contractors, and their emergency contacts and dependants.
Data
- Identity and contact details, job and employment history, time off, documents, performance and development records.
- Pay and payroll details, bank and Mobile Money accounts, SSNIT number and TIN.
- Ghana Card and passport numbers, which we encrypt.
- Optional special categories the customer chooses to record, such as health or disability support needs. The customer decides whether to collect these and who may see them.
Duration
For as long as the customer uses Ayekoo, plus the export and deletion periods below.
Acting on your instructions
We process the customer's personal data only to provide Ayekoo and as the customer instructs, including through the settings and actions of its admins. We will tell the customer if we believe an instruction breaks the law. We never sell it or use it for our own purposes.
Our people
Only staff who need access to support or run Ayekoo can reach customer data. They are bound by confidentiality, and their access is limited and logged.
Security measures
- Each customer's data is separated by row-level security in the database, enforced for every request the app makes.
- Ghana Card, passport, bank account and Mobile Money numbers are encrypted with AES-256-GCM, with only the last four digits stored in readable form.
- All traffic uses HTTPS. Passwords are stored as one-way hashes.
- Field-level permissions decide who can see each part of a profile, and reveals of sensitive numbers, pay changes and exports are recorded in an audit log.
- Payroll runs need approval from a second person.
- Regular backups, and a tested way to restore them.
Subprocessors
The customer authorises us to use the subprocessors on our subprocessors page. Each is bound by a written contract with data protection terms at least as strict as these.
We will give at least 30 days' notice before adding or replacing a subprocessor. If the customer objects on reasonable data protection grounds and we cannot resolve it, the customer may end the affected service and receive a refund of prepaid fees for it.
Transfers outside Ghana
Customer data is hosted with [Hosting provider] in [Hosting location]. Some subprocessors operate in other countries. We only transfer data to countries and providers that offer adequate protection, under contracts that require it, as Act 843 expects.
Helping with people's requests
Ayekoo lets admins find, correct, export and delete a person's data themselves. Where they cannot, we help the customer respond to requests from the people whose data it holds. If someone contacts us directly, we pass the request to the customer.
Data breaches
If we become aware of a personal data breach affecting the customer's data, we will tell the customer without undue delay and within 48 hours, with what we know, and keep them updated. We will help the customer meet any duty to notify the Data Protection Commission or the people affected.
Return and deletion
When the agreement ends, the customer has 30 days to export its data. We then delete it from live systems within 60 days, and from backups as they roll off within 30 days after that, unless the law requires us to keep it.
Information and audits
We will give the customer the information reasonably needed to show we meet this agreement, including answers to security questionnaires. Requests go to security@ayekoo.app.