Who is responsible for what when your organisation uses PerfTrack.
This DPA applies to Personal Data in Customer Data that PerfTrack processes on behalf of the Customer in providing the Service. Terms defined in the Terms of Service have the same meaning here. The Customer is the Data Controller and PerfTrack is the Data Processor. For data that PerfTrack processes for its own purposes (account administration, billing, website and security logs), PerfTrack is a separate controller, as the Privacy Policy explains.
Annex A describes the processing. This DPA applies for as long as PerfTrack processes Customer Data.
PerfTrack will process Customer Data only to provide, secure and support the Service, in line with the Customer's documented instructions. The Terms, this DPA, and the Customer's use and configuration of the Service are the Customer's complete instructions. Further instructions must be in writing, be lawful and be reasonably practicable, and may be subject to additional charges. If PerfTrack believes an instruction breaches the law, it will tell the Customer and may suspend that instruction. PerfTrack may also process Customer Data where the law requires, and will tell the Customer first where it lawfully can.
PerfTrack will not sell Customer Data, use it for advertising, or use it to build profiles of individuals for its own purposes. PerfTrack may use anonymised, aggregated usage statistics that do not identify any customer or individual to operate and improve the Service.
The Customer is responsible for having a lawful basis for the processing, for the accuracy and legality of Customer Data, for informing individuals about the processing (Annex D provides a template notice), for deciding who has access to Customer Data inside the Service, for meeting its own obligations to the Nigeria Data Protection Commission (including registration, any Data Protection Officer, and impact assessments where required), and for deciding whether and how to notify regulators and individuals of a breach. The Customer confirms that its instructions and its use of the Service comply with the NDPA and other applicable law.
PerfTrack will ensure that anyone it authorises to process Customer Data is bound by a duty of confidentiality and has access only where needed for support, security, billing or legal compliance.
PerfTrack will maintain appropriate technical and organisational measures to protect Customer Data against unauthorised or unlawful processing and against accidental loss, destruction or damage. The measures in place at the date of this DPA are summarised in Annex C and on the Security page. PerfTrack may update them, provided it does not materially reduce the overall level of protection.
The Customer gives PerfTrack general authorisation to use the sub-processors listed in Annex B. PerfTrack will bind each sub-processor to data protection obligations no less protective than this DPA in all material respects, and remains responsible to the Customer for their performance of those obligations. PerfTrack will give the Customer at least 30 days' notice by email to the account administrator before adding or replacing a sub-processor. If the Customer reasonably objects on data protection grounds within that period and the parties cannot resolve it, the Customer may terminate the affected part of the Service without penalty.
The Customer acknowledges that PerfTrack's sub-processors may process Customer Data on servers outside Nigeria. PerfTrack will transfer Customer Data outside Nigeria only to providers that apply appropriate safeguards, in line with the NDPA, and will make information about the locations available to the Customer on request.
Taking into account the nature of the processing, PerfTrack will help the Customer, by appropriate technical and organisational measures (including the Service's own access, edit, export and delete functions), to respond to requests from individuals exercising their rights. If PerfTrack receives such a request directly, it will not respond on the merits and will forward it to the Customer within 5 business days, unless the law requires otherwise.
PerfTrack will notify the Customer's account administrator without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will include, as far as known, the nature of the breach, the categories and approximate number of individuals and records affected, the likely consequences, and the measures taken or proposed. PerfTrack will keep the Customer updated, take reasonable steps to contain and remediate the breach, and give the Customer the information it reasonably needs to meet its own duty to notify the Nigeria Data Protection Commission and affected individuals. The Customer, as controller, decides whether and how to notify them. PerfTrack's notification is not an admission of fault.
PerfTrack will give the Customer reasonable help with data protection impact assessments, and consultations with the Nigeria Data Protection Commission, relating to the Service, taking into account the nature of the processing and the information available to PerfTrack.
When the agreement ends, the Customer may request an export of its Customer Data within 30 days by emailing hello@perftrackapp.com. After that period, PerfTrack will permanently delete Customer Data, and sub-processors will delete it in accordance with their own schedules. Residual copies in backups will be overwritten in the ordinary backup cycle. PerfTrack may retain data where the law requires, and will keep it confidential and protected. Inactive accounts are handled as set out in the Terms of Service.
PerfTrack will make available the information reasonably necessary to show compliance with this DPA, starting with this DPA, the Security page and written answers to a security questionnaire. If that is not sufficient, the Customer may, on at least 30 days' written notice and not more than once a year (or sooner after a confirmed breach), carry out an audit through a mutually agreed independent auditor bound by confidentiality, during business hours, without unreasonably disrupting the business, and at the Customer's cost. The audit will not extend to other customers' data or to the infrastructure of sub-processors.
Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service. Nothing in this DPA limits liability that cannot lawfully be limited, or any rights an individual has directly under the NDPA.
This DPA starts when the Customer accepts the Terms and ends when PerfTrack stops processing Customer Data. If this DPA conflicts with the Terms or the Privacy Policy on the handling of Personal Data, this DPA prevails. It is governed by the laws of the Federal Republic of Nigeria, and Section 23 of the Terms of Service applies to disputes. PerfTrack may update this DPA on 30 days' notice, for example to reflect changes in law or to the Service; Section 22 of the Terms applies.
When an administrator accepts the Terms of Service, Privacy Policy and this DPA in the app, PerfTrack records the document version, the date and time, the administrator's account and IP address. This record is the Customer's and PerfTrack's evidence that the DPA was agreed.
| Subject matter | Providing the PerfTrack HR and performance management Service to the Customer. |
|---|---|
| Duration | The term of the agreement, plus the 30-day return and deletion period in Section 11. |
| Nature and purpose | Hosting, storing, retrieving, displaying, calculating (such as payroll and leave balances), transmitting by email, backing up and deleting Customer Data so the Customer can manage its workforce. |
| Individuals concerned | The Customer's current and former employees, new hires in onboarding, administrators and managers, and individuals named in employee records (such as emergency contacts). |
| Types of Personal Data | Names, work and personal contact details, job titles, departments, employment dates; salary, allowances, deductions, tax and pension settings, payslips, and bank account details used for payroll; leave and attendance records, including clock-in time and, where enabled by the Customer, device location; goals, reviews, ratings, feedback and recognition; documents uploaded by the Customer, including company policy documents; records of which policy documents each user opened and when; the name and email stamped on pages a user views; user account and activity records. |
| Special-category data | PerfTrack does not ask for special-category data. The Customer may nevertheless record some (for example, the reason for medical leave, or a medical certificate uploaded as a document). The Customer is responsible for having a lawful basis and a genuine need, and should record only what is necessary. |
| Provider | What it does for PerfTrack | Customer Data involved | Location |
|---|---|---|---|
| Render | Cloud hosting of the application and PostgreSQL database | All Customer Data | Outside Nigeria (provider data centres) |
| Cloudinary | Storage and delivery of uploaded documents and files | Files uploaded by the Customer | Outside Nigeria (provider infrastructure) |
| Brevo (Sendinblue) | Sending transactional email (invitations, verification, notices) | Names, email addresses and the content of notification emails | Outside Nigeria |
| Flutterwave | Processing subscription payments | Administrator and billing contact details and payment details (we do not store card numbers); no employee data | Nigeria and other countries |
| Serving web fonts; previewing some uploaded files in the browser through the Google document viewer when a user opens them | IP address and, for a previewed file, its link and content | Outside Nigeria |
Customers will be notified of changes to this list as set out in Section 6.
Customer-chosen video links. If the Customer adds a YouTube or Vimeo link to a company policy, the employee's browser connects directly to that provider when the policy is opened. PerfTrack does not send Customer Data to the provider, and the provider is not PerfTrack's sub-processor; the Customer chooses the video and is responsible for it.
Under the NDPA your employer must tell you how it uses your personal data. If your organisation uses PerfTrack, you may copy and adapt the text below into your staff handbook, intranet or onboarding pack, and fill in the bracketed parts.
How [Company name] uses your personal data in PerfTrack
[Company name] uses PerfTrack, a cloud-based HR platform operated by PerfTrack, to manage employment records. [Company name] is responsible for your data (the "data controller"). PerfTrack processes it on our behalf under a written data processing agreement and may not use it for its own purposes.
What we hold: [your contact details, job and department, employment dates, pay and bank details, leave and attendance records, performance reviews, goals and feedback, documents you give us, and your PerfTrack account activity. Add or remove items to match what you actually use.]
Why, and on what basis: [to run payroll and pay you, manage leave and attendance, manage performance, meet legal obligations (including tax and pension), and run the business. Our lawful bases are performance of your employment contract, legal obligation and our legitimate interests.]
Who sees it: only people in [Company name] who need it for their role, as set by our PerfTrack permissions; PerfTrack and its service providers (hosting, document storage, email) acting on our instructions; and authorities where the law requires.
How long: [for the duration of your employment and [x] years afterwards, or as the law requires].
Your rights: you can ask to see, correct or delete your data, object to or restrict its use, and ask for a copy. Contact [name / HR email]. You may also complain to the Nigeria Data Protection Commission.