Definitions
- Customer: the organisation that has an agreement with us to use nQX Talent.
- Customer personal data: the personal data in the customer's nQX Talent workspace, and any other personal data we handle for the customer to provide the service.
- Sub-processor: a service provider we engage that may handle customer personal data.
- Words such as controller, processor, personal data, personal data breach, processing and data subject have the meanings given in the GDPR.
Roles and responsibilities
The customer is the controller of customer personal data and Novargo is its processor.
The customer is responsible for having a lawful basis for the data it puts into nQX Talent, for telling its people how their data is used (for example in its own privacy notice to employees), for the accuracy of the data, and for making sure its instructions to us are lawful.
Details of the processing
| Details | |
|---|---|
| Subject matter | Providing nQX Talent, a web application for performance reviews and people management, and supporting it. |
| Duration | The term of the customer agreement, and afterwards until the data is deleted under section 11. |
| Nature of the processing | Hosting and storing, organising, calculating, displaying, exporting, emailing, backing up, supporting and deleting data, as the customer uses the service. |
| Purpose | To provide nQX Talent and support it under the customer agreement. |
| Data subjects | The customer's employees, former employees, contractors and other workers, its managers and administrators, other people it invites to the service, and people named in its records, such as emergency contacts. |
| Categories of personal data | Work details, personal details and identification numbers, performance data (KPIs, results, ratings, comments), reward data (bonus targets and figures), growth data (development plans, training, qualifications, succession) and account and audit data, as section 4 of our Privacy Policy describes. |
| Special categories of data | Only what the customer chooses to record in optional fields, such as ethnicity, religion, disability or trade union coverage, on the customer's own lawful basis. |
Following the customer's instructions
We process customer personal data only on the customer's documented instructions. These are the customer agreement, these terms, and the customer's own use and settings of nQX Talent. The only exception is where EU or Maltese law requires us to do something else; then we tell the customer first, unless the law forbids it.
We tell the customer at once if we believe an instruction breaks data protection law.
Confidentiality
Everyone at Novargo who can access customer personal data is bound by a duty of confidentiality, and has access only as far as their work needs it.
Security
We take the technical and organisational measures that Article 32 of the GDPR requires, as described in the annex below. We keep them under review and may improve them, but we will not reduce the overall protection they give.
Sub-processors
The customer gives us general authorisation to engage sub-processors, for example for hosting and database services, email delivery and infrastructure. We engage each one under a written contract with data protection obligations at least as protective as these terms, and we remain responsible to the customer for its work.
We keep a current list of sub-processors and send it to any customer who asks at connect@novargo.com. We tell customers in advance, normally at least 30 days ahead, before we add or replace a sub-processor. A customer may object on reasonable data protection grounds. If we cannot resolve the objection, the customer may end the part of the service affected.
International transfers
We store customer personal data in the European Union. We transfer it outside the European Economic Area only with the safeguards the GDPR requires, such as a European Commission adequacy decision or the Commission's Standard Contractual Clauses, together with any extra measures that are needed.
Helping the customer
nQX Talent lets customers view, correct, export and delete the records they hold, which covers most requests from their people. If a customer needs more help to answer a request to exercise data protection rights, we give it. If a request reaches us directly, we pass it to the customer and do not answer it ourselves unless the customer asks us to.
We also help customers, as far as reasonable and taking into account the information available to us, with security, data protection impact assessments and any prior consultation with a supervisory authority.
Personal data breaches
If we become aware of a personal data breach affecting customer personal data, we tell the customer without undue delay. We give the customer the information it needs to meet its own duties, including notifying the Information and Data Protection Commissioner within 72 hours where that applies, and we take steps to contain the breach and limit its effects.
Return and deletion
While the agreement is in force, the customer can export its data at any time with the export tools in nQX Talent. When the agreement ends, we return the data if the customer asks, and then delete it. Unless the agreement says otherwise, we delete it within 90 days of the end, except where EU or Maltese law requires us to keep it. Copies in backups are overwritten in the normal backup cycle and are protected until then.
Information and audits
We make available to the customer the information it needs to show that these terms are met. We allow and contribute to audits, including inspections, by the customer or an independent auditor it appoints. Audits take place on reasonable notice, during working hours, no more than once a year unless a breach or a supervisory authority requires it, and under a duty of confidentiality. Where written information answers the question, we may provide that first.
Liability and order of precedence
Each party's liability under these terms is governed by the customer agreement. On data protection matters, these terms prevail over anything else in the customer agreement, except a separate data processing agreement signed with us.
Annex: technical and organisational measures
Access control
- Each customer has a separate workspace. Access rules are enforced by the database itself, so one customer's users cannot reach another customer's data.
- Within a workspace, roles and permissions set by the customer decide who sees and changes what.
- Our staff have the least access their work needs. They open a customer's workspace only to provide support or keep the service running, and any change they make is recorded in that workspace's audit log.
Encryption
- All traffic to the website and the app is encrypted in transit (HTTPS).
- Databases, stored files and backups are encrypted at rest.
Sign-in
- Passwords are stored only as salted one-way hashes.
- Sign-in sessions expire and are renewed securely; passwords are reset by a link sent by email.
Records and monitoring
- Every change in a workspace is recorded in its audit log, with who made it and when.
- Technical logs help us detect and look into misuse.
Availability and recovery
- The service runs in data centres in the European Union, on infrastructure built for resilience.
- Data is backed up automatically.
Building and changing the service
- Changes are reviewed and run through automated tests before release.
- Changes are tried on a separate copy of the service before they reach customers.
- Software dependencies are kept up to date.
Data minimisation and integrity
- Personal fields beyond the basics are optional; each customer decides what to record.
- Exported documents carry verification codes and fingerprints, so altered copies can be detected.
Incidents
- We follow a set process to contain, assess, fix and report security incidents.
Questions about this page?
Email us and a member of our team will reply.