Legal

Data processing agreement

Last updated 20 October 2026 · Effective 20 October 2026

This agreement sets out how Nkonso Technologies Ltd processes personal data on behalf of each organisation that uses Agoo. Ghana’s Data Protection Act, 2012 (Act 843) requires processing by a data processor to be governed by a written contract that requires confidentiality and security (section 30); this is that contract.

On this page

1. Parties and scope
2. Processing on the customer’s instructions
3. Details of the processing
4. Nkonso’s obligations
5. Security measures
6. Sub-processors
7. Requests from data subjects
8. Help with compliance
9. Security compromises
10. International transfers
11. Return and deletion
12. Information and audits
13. Liability
14. Duration, precedence and changes
15. Contact

1. Parties and scope

This data processing agreement (“DPA”) is between the customer named on the Agoo account (the “customer”), as data controller, and Nkonso Technologies Ltd (“Nkonso”), as data processor. It forms part of the terms of service and is accepted with them. Customers who need a signed copy can ask us for one.
It applies to personal data that Nkonso processes for the customer in providing Agoo (“customer personal data”). Nkonso’s processing of customer account, billing and support data as a controller is covered by our privacy notice instead.
It also applies to answers collected through Agoo Forms (agooforms.com and its apps). For an organisation’s own Forms workspace, the customer is that organisation. For a personal or team workspace, the “customer” is the person or team who makes the forms there, and Nkonso gives them the same commitments; the answers to their forms, and the files sent with them, are customer personal data.
Words such as personal data, processing, data subject, data controller, data processor and special personal data have the meanings given in Act 843. A “security compromise” means unauthorised access to, or acquisition of, customer personal data, as in section 31 of Act 843.

2. Processing on the customer’s instructions

Nkonso processes customer personal data only on the customer’s documented instructions. These are the terms of service, this DPA, the customer’s settings and configuration in Agoo, and other written instructions from the customer’s authorised administrators that are consistent with the agreement.
If Nkonso believes an instruction breaks Act 843 or another data protection law, it will tell the customer and need not follow it until the customer confirms or changes it.
If the law requires Nkonso to process customer personal data in another way, Nkonso will tell the customer before doing so, unless the law forbids that.
The customer is responsible for the lawfulness of its instructions and of the personal data it collects, including its lawful basis, its notices to data subjects, its registration with the Data Protection Commission and any consent it needs.
One narrow exception, as controller: so that nobody is asked for feedback too often across Agoo, and so that a visitor’s Stop for every organisation is honoured, Nkonso keeps keyed hashes of the phone numbers and email addresses feedback requests go to and of those who stop them for every organisation, and uses them for nothing else. They can’t be turned back into the contact details, and they never include the customer’s answers.
Agoo Reviews, as controller: the customer’s page on Agoo Reviews (its name, category and a branch for each of its sites, with the site’s name, town and address) and the notice to its Owner and Admins before the page opens, sent to the email addresses on their Agoo accounts, are Nkonso’s own processing for Agoo Reviews, covered by our privacy notice. Nothing the customer records about its visitors, staff or bookings is put on its page.
Review invitations: when the customer invites people to review it on Agoo Reviews, Nkonso processes their contact details as the customer’s processor under this DPA. As controller for Agoo Reviews, Nkonso keeps keyed hashes of the phone numbers and email addresses of people who ask not to be invited again, by the customer or by every business, and a record of which invitation a review came through so the review gets its label. It never tells the customer which invitation led to which review, and it uses these for nothing else.

3. Details of the processing

Subject matter	Providing Agoo to the customer under the terms of service.
Duration	For as long as the customer uses Agoo, and afterwards until the data is deleted under section 11.
Nature	Collecting, recording, storing, organising, retrieving, displaying, syncing to the customer’s paired devices, keeping users’ unsaved work as personal drafts (on their own device and, for larger editors, with their account), matching (for example against the customer’s watchlist), sending messages, confirming a visitor’s phone number or email address with a one-time code, recording agreements to the customer’s documents and producing signed copies of them, digitally signing visitors’ passes so the customer’s devices can check them without a connection, building a visitor’s pass for Apple Wallet or Google Wallet when the visitor asks for one and keeping it up to date, serving the customer’s visitor pages and tracked QR codes on the customer’s own domain where it adds one, reading the busy times of the calendars the customer's staff connect and choose and adding events and Google Meet, Microsoft Teams or Zoom meetings for their bookings to their own accounts, serving each member of staff's private calendar link, sealing the contact details of customers the customer invites to review it and reading only the recipients of emails sent to its review forwarding address, reporting, exporting and deleting; and, when the customer joins an organisation group, making available to that group what the customer chooses: its totals, its watchlist entries for screening at the group’s other organisations, or access for the group’s administrators as the customer’s own Auditors or Admins.
Purposes	Visitor management (walk-in check-in, including visitors checking themselves in on their own phones from the customer’s check-in posters where the customer turns it on; the built-in visitor types and any the customer creates; invitations and passes, from which visitors can tell their host they are running late, ask for another time, cancel or check out, and answer the customer’s questions before arriving; visitors asking to visit from the customer’s request page, confirmed by a one-time code, where the customer turns it on; documents visitors accept or sign (the customer’s privacy notice, and NDAs, waivers and site rules), with signed copies to the visitor; multi-day passes, pass rules and passes signed for offline checks; passes visitors choose to add to Apple Wallet or Google Wallet, updated when the visit changes; visitor and booking pages on the customer’s own domain; host approvals, including by link; visits for several hosts, a team of the customer’s staff or no one in particular, which the customer’s front desk passes to whoever will see the visitor, books in for another time or turns away; the customer’s guest Wi-Fi given to visitors while they are checked in, and its Wi-Fi shared with its staff; watchlist screening, badges and contractors); deliveries (parcels logged by the customer's staff, its kiosks, or couriers at a kiosk or from the customer's drop-off poster, the person or team they are for told with a one-time collection code and reminded until they collect them, collection by code, signature or a member of staff's confirmation, and, where the customer turns it on, label photos read by AI to suggest the recipient); appointment booking (booking pages, including inside the customer’s own website, confirmed by a one-time code; bookings that need a host’s confirmation, confirmed or declined by link; waitlists for full days; reminders; marking no-shows; hosts' connected Google and Microsoft calendars, whose busy times are kept off booking pages and to which confirmed bookings are added; video meetings made with Google Meet, Microsoft Teams or Zoom in the host's own account; and each member of staff's private calendar link to their bookings, the visits they host and their approved leave); visitor feedback (surveys the customer makes, asked once after a visit or booking or from the customer’s feedback posters, results, low-score alerts and follow-up, and replies to visitors who asked for one); invitations to review the customer on Agoo Reviews (to everyone whose visit checks out or whose booking ends, and to customers the customer names: typed in, from a customer list, from emails it copies to its forwarding address, or with single-use links it hands out or makes through the API), with one reminder, the customer's replies to reviews of its page and its flags, review insights, the AI reply drafts and review summaries the customer asks for, and emails about its page to its staff; staff attendance (clock-in, shifts and rosters, overtime, leave, timesheets and payroll files), including timesheets for each period and their confirmation by staff, approval by the people the customer chooses, locking and reopening, payroll files the customer's HR makes from approved timesheets by the customer's pay codes and layouts, kept so they can be downloaded again, with corrections in later files when a timesheet is reopened, open shifts staff claim and shifts they swap, with their approval by the people the customer chooses, warnings where a roster meets the rest and consent rules of the Labour Act, 2003 (Act 651) (sections 41, 42 and 55), the customer’s leave types, leave requests from its staff and their approval by the people the customer chooses, each person’s leave balances and the record behind them, the leave year end, and the certificates leave needs, kept for the customer’s obligations as an employer (Labour Act, 2003 (Act 651), sections 27 and 57); HR records (each member of staff's personal and employment details, the customer's departments and positions, job history and changes to a job from a date, made by the customer's HR or proposed by line managers and approved by the people the customer chooses, corrections staff ask for, statutory numbers and pay accounts, emergency contacts, next of kin and beneficiaries, and staff seeing and correcting their own record in the Agoo Workspace app), for the customer's employment of its staff, its legal duties under the Labour Act, 2003 (Act 651) and tax and pension law, and paying them; HR documents (each member of staff's contracts, letters, licences, permits and certificates, kept encrypted and checked for viruses, with reminders before they run out), for the same purposes; emergency roll call; QR codes the customer makes, including sending people who scan a tracked code to its destination and counting its scans; notifications by SMS, WhatsApp, email and push, including scheduled report emails to the customer’s staff; keeping visitors' WhatsApp replies to the customer's messages with the visit or booking they answer, so the customer's staff can read and answer them in Agoo (and Agoo's support answers them where the customer's plan doesn't include answering), and counting each reply the customer's staff send, by person and by site, against the customer's allowance, wallet and monthly WhatsApp budget; reporting and audit; organisation groups the customer joins or leads, as the customer’s Owner instructs in Agoo (accepting an invitation, choosing the group’s access, sharing the watchlist, leaving); Agoo AI features the customer turns on; and support the customer asks for.
Data subjects	Visitors and guests; people who book appointments or are invited; hosts, employees, receptionists, security guards and other staff, and the emergency contacts, next of kin and beneficiaries they name; the customer’s administrators and users; contractors and their workers; delivery riders; and, depending on the customer, residents and domestic staff, pupils, parents, guardians and authorised pick-up people, members and children of a congregation, people visiting patients, people who answer the customer’s feedback surveys, customers the customer invites to review it on Agoo Reviews, people on the customer’s watchlist, people recorded in paper logbooks the customer imports, and people who scan the customer’s tracked QR codes.
Personal data	Names and contact details; staff profile photos, the names staff go by and their pronouns, their choices of how Agoo notifies them, and the scheduled reports they get or stopped; the teams staff are in and who leads them, where a walk-in asking for a member of staff goes first, and whether visitors can find them by name; visit and booking details (the host or hosts, the team or front desk a visit is for, purpose, visitor type, site, times), and what visitors tell their host from their pass (that they are running late and by how much, a time they ask for with their note, a reason for cancelling); for a visitor who waits for someone to see them, who they asked for, who received them, who was asked and what each answered (including an answer the front desk records for a colleague), staff notes, and how it ended (seen by a host, booked in for another time, or turned away, with any reason recorded); photos; signatures and signed documents (the version agreed to and a fingerprint of its exact wording, the time and method, the signer’s typed name and drawn signature, and, when signed online, the IP address and browser used); one-time codes that confirm a visit request, a booking or a place on a waitlist, and the phone number or email address they were sent to (kept only as hashes, and deleted within a day); booking waitlist entries (name, the contact confirmed, the day, length and way of meeting wanted, and their place, deleted once that day has passed); whether a booked guest attended; for staff who connect a calendar or Zoom account, the account's name, email address and kind, the names and colours of their calendars, the start and end of their busy times on the calendars they choose (never titles, people or descriptions; deleted a day after they end), the IDs of the events and meetings Agoo adds for their bookings and the meeting links, and the encrypted tokens the provider issues (deleted when they disconnect); each member of staff's private calendar link (kept encrypted, with when and by which calendar app it was last used); the record that a visitor was given the customer’s guest Wi-Fi (the visit, the network, when and how, and the version of the customer’s Wi-Fi terms accepted; never anything about their devices); the customer’s staff Wi-Fi networks shared with each member of staff, when a network’s password was sent to their phone and each time they showed it in the Agoo Workspace app; for a pass a visitor adds to Apple Wallet or Google Wallet, the pass’s details as shown on it, and, for Apple Wallet, the identifier the visitor’s device registers for the pass’s updates; vehicle register entries (plates, times in and out, purpose, who the vehicle was for, the driver’s name and passengers where recorded, photos of vehicles where the customer asks for them, and the customer’s known and barred vehicles); parcels (who each is for, what it is, the sender, courier and tracking number, where it is kept, photos of its label and of the parcel, what the AI read on the label where the customer turns label reading on, the courier's name and phone number where the customer asks for them, the messages and reminders sent, the one-time collection code, which only the recipient or their team is shown, and how, when and by whom it was collected, including a drawn signature, or that it was sent back or refused; photos, the AI's reading, phone numbers and signatures are deleted 90 days after the parcel is closed unless the customer sets between one day and two years, and the record itself after the customer's period, a year by default, never while it waits); ID details where the customer asks for them (ID numbers stored sealed, with only the last four characters shown; ID images, never of a Ghana Card, opened only by the customer’s Owners, Admins and Security leads and deleted on the customer’s schedule; a Ghana Card never photographed: its number read on the device, with the picture discarded at once, or typed, under L.I. 2523); answers to the customer’s own form fields; feedback answers (ratings, what stood out, comments and answers to the customer’s survey questions, the contact a visitor leaves when they ask for a reply, follow-up notes and replies) and the record that a visitor was asked; review invitations (for customers the customer names, their name, email address and mobile number, sealed and deleted 30 days after the invitation's link ends, and a masked line kept with the record; for each invitation, the branch, how it was made, the channel, when it went or why it didn't, kept for the customer's period, a year by default and between 90 days and two years; and totals of invitations opened and that led to reviews, never which); the customer's replies to reviews and its flags, with who made them; AI reply drafts and review summaries, kept for a year; attendance records (clock-in times, method, device, the location or Wi-Fi check result for mobile clock-in and, where the customer turns them on, selfies taken at clock-in, exact clock-in locations and Wi-Fi network names; shifts, overtime, leave and timesheets); guard sign-ins at the gate (who signed in on which device, how, and when and why they signed out, linked to what they did there); staff clock-in credentials (one-way fingerprints of PINs, cards and printed badges; for a badge on a phone, the public part of its key, the phone’s name and when it was added); for staff who turn on notifications in the Agoo Workspace app, each device’s push token, kind of device, app version, language and time zone, when it was last used and whether each notification was delivered, and a host’s reply to an arrival notification (coming, or how long the visitor should wait); emergency roll calls (who was on site, how and by whom each was accounted for, and, only while the roll call is active, their phone numbers for the customer’s marshals); notices to staff, acknowledgements and consent records; messages and delivery status; WhatsApp replies from visitors and guests to the customer's messages (what they wrote and sent, the name and number or username ID WhatsApp gives, and when), kept as long as the customer keeps its visit records and erased with the visitor; QR code scans (time; the country, region and city estimated from the network; kind of device, operating system, browser and language; the outcome; and a one-way scanner code that changes daily, never an IP address); contact details the customer puts in its QR codes; device and usage logs; staff employment details (line manager, start and leaving dates, employment type and contracted hours), each worked day's breaks (and, where the customer switches them on, the break punches staff make and what about a day's breaks needs a look), the dates of a nursing hour HR switches on (no pregnancy or birth details) and the customer's attendance rules and work-rule sets, with which set each member of staff follows and from when; each worked day's counted, regular and overtime hours, work on a rest day or a public holiday and, where the customer pays a night allowance, time at night; decisions on extra time (who approved all or part of it or declined it, when, how much and the reason given to the member of staff), kept with the customer's attendance records; timesheet records (the customer's timesheet periods and payroll dates; each member of staff's timesheet for a period with its totals and status; whether and when they confirmed it and any note; each approval step, who decided it, when, in what capacity and with what note; who sent it back or reopened it, when and their note or reason; and whether anything arrived after it was locked), kept with the customer's attendance records; where the customer's plan has the payroll export, payroll files made by the customer's HR from approved timesheets (each member of staff's name, employee number, department, site and employment type, with their hours and days by the customer's pay codes, including the kinds of leave they took, and any correction to an earlier file), the customer's pay codes and file layouts, and who made each file, when, for which period and sites, and each download, kept with the customer's attendance records; leave records (the customer's leave types and settings; each leave taken or asked for, with its kind, dates, the days it counts, whether it is paid, who approved, declined, recorded, cancelled or ended it and any reason, including requests staff send from the Agoo Workspace app; each person's balances, with every day granted, accrued, taken, given back, carried over, expired or adjusted, by whom and why; the customer's choice of who approves leave; each request's approval record (each step, who decided it, when, in what capacity and with what note); and the deputies the customer's staff name to approve while away, with their dates); leave certificates (a document or photo the customer's HR or the member of staff adds); kinds of leave the customer marks private are shown to line managers and other approvers only as “away”, and to integrations without their kind, except in payroll files, which name every kind and which only the customer's HR, Owners and Admins, and integrations the customer gives payroll access, can make or download; where the customer plans rosters, the shifts each member of staff is rostered on (site, day, times, the shift's name, label and break, and notes the customer's managers add), the patterns and rotations they are on, each publication (what changed, who published it and who was told) and when staff saw a change; open shifts staff claim and shifts they offer, take, refuse or withdraw (who, to whom, notes, and each approval step with who decided it, when and their note); records of a member of staff's consent to night work or overtime under section 55 of Act 651 (the kind, the dates, a note and who recorded or ended it; no pregnancy or birth details, and shown only to those who may see the person's private leave), all kept with the customer's attendance records; HR records (legal name, date of birth, gender, nationality, marital status where the customer asks for it, personal email and phone, home address and GhanaPost GPS address, languages; the department and position, grade, contract type and end, probation, notice, working pattern, cost centre and continuous service; Tier 2 and Tier 3 pension schemes; up to five emergency contacts, next of kin and beneficiaries with their shares; statutory numbers (Ghana Card PIN, which is also an individual's TIN, SSNIT number, an older TIN, passport, work and residence permits, driver's licence, voter ID and others the customer records) and bank and mobile money pay accounts, all kept encrypted, with only their last four characters shown and a full number shown only to the customer's Owner and HR for a reason recorded in the audit trail; job history lines with their dates, who made them and why; change requests and their approval records; and, when a member of staff says a change to their pay accounts wasn't them, that the accounts are held until the customer's HR checks them); HR documents (the file, its type, title, version, the dates it was issued and runs out, and who added it; each file encrypted with a key of its own and opened only through Agoo by people its type allows, photos stripped of their location first; medical certificates and police clearance seen only by the member of staff and the customer's HR; never a copy of a Ghana Card, which L.I. 2523 forbids relying on); and audit trail entries.
Special personal data	Depending on how the customer uses Agoo: data about children; data that may reveal religious belief (for example church attendance), health (for example hospital visits, health questionnaires or leave certificates) or criminal behaviour (for example a watchlist entry). Leave certificates, such as medical certificates and the certificate maternity leave needs (Act 651, section 57), are treated as special personal data about health (Act 843, sections 37 and 96), processed where necessary for the customer's rights and obligations as an employer (section 37(3)): they are kept as private files that only the person and the customer's HR can open, never available to the person's line manager, integrations or the API, with each one added, opened or removed recorded in the audit trail, and deleted 24 months after the leave they support unless the customer sets between 30 days and 2 years, or sooner by the customer's HR, unless a legal hold applies. Face templates for staff clock-in are created and kept, encrypted, on the kiosk where the employee enrols, only after the customer has published a notice to its staff and recorded its basis (its legal basis as the employer, or the employee’s consent); they are never exported to Agoo’s servers, reports, the API or anyone else, and are never used for visitors. A disability a member of staff chooses to declare on their HR record, so the customer can notify the Public Employment Centre (Act 651, section 47), is special personal data about health, recorded only with their consent and seen only by them and the customer's HR. Services whose name reveals a health condition send no review invitations, since the message itself would say where someone was treated. Medical certificates and police clearance reports in a member of staff's HR documents are special personal data (health and alleged offences), seen only by them and the customer's HR, every opening recorded, and never sent through the API, webhooks or notifications.

4. Nkonso’s obligations

Nkonso processes customer personal data only to provide Agoo to the customer. It does not sell it, use it for its own marketing, combine it with other customers’ data, or use it to train AI models.
Nkonso gives access to customer personal data only to staff and contractors who need it for their work and are bound by a duty of confidentiality. Support access to a customer’s data is read-only unless one of the customer’s Owners approves changes, is limited in time, needs a recorded reason, is notified to the customer’s Owners when it begins, can be ended by the customer at any time, and is recorded in the customer’s audit trail. Emergency access without prior approval is limited to Nkonso’s platform owner, for events that cannot wait (such as no administrator being able to sign in, a security incident or a safety emergency), after verifying the request through contact details already held; every Owner and administrator is notified when it begins and receives a written report of what was done within 72 hours. Support access never includes exporting data, changing billing, erasing data or granting anyone access.
Nkonso resets a user’s two-step verification only after the user has confirmed their email address and either one of the customer’s Owners or administrators of at least the same seniority has approved it, or Nkonso has verified the user’s identity itself, in which case the reset takes effect no sooner than 24 hours later. Nkonso makes a new person the customer’s Owner only on documented evidence, verified through contact details already held, and only after notifying the customer’s Owner and administrators at least 72 hours in advance, during which any of them may stop it. Each such event is recorded in the customer’s audit trail.
Nkonso keeps the security measures in section 5 in place and reviews them regularly.
Nkonso keeps records of its processing for customers and makes relevant information available to the customer on request.
Privacy and security questions about this DPA can be sent to agoo@ardentafrica.com.

5. Security measures

Section 28 of Act 843 requires appropriate, reasonable technical and organisational measures to protect personal data. Agoo is designed with the measures below. Agoo is in early access, so each measure applies to each part of the platform as it launches.

Technical measures

Encryption in transit with TLS, and encryption at rest (AES-256) for the database, backups and stored files.
Field-level encryption for ID numbers, with a secure hash for matching so the full number need not be shown.
Tokens to staff members' connected Google, Microsoft and Zoom accounts sealed with a key of their own, bound to each connection, rotatable without downtime and never readable by users or support; only the access each feature needs is asked for (no mail, contacts, files or recordings), busy times are kept without titles, people or descriptions, and disconnecting withdraws Agoo's access where the provider allows it.
Tenant isolation: every customer record belongs to one customer, and isolation enforced at the data layer refuses access to other customers’ records.
Role-based access with site permissions, so users see only what their role and sites allow.
Two-step verification for customer administrators, mandatory two-step verification for Nkonso staff with access to internal systems, time-limited sessions, Google and Microsoft sign-in on every plan, and further single sign-on on plans that include it.
Kiosks paired as individual devices with hardware-bound keys, which can be revoked at any time.
Private file storage reached only through short-lived signed links or through the API by signed-in users, with location data removed from uploaded photos. Staff profile photos are re-encoded when uploaded, which removes all metadata, are served only to signed-in users allowed to see the customer’s directory, and are deleted within the hour of being replaced or removed, or of the person being deactivated, unless a legal hold applies.
An append-only, hash-chained audit trail of sign-ins, views, exports, changes, deletions and Ardent support access, with hourly checkpoints.
Automatic deletion on the customer’s retention schedule, with every deletion logged; ID images deleted after a day by default and after 30 days at most, and clock-in selfies and exact locations after 90 days by default, leave records after 7 years by default (1 to 10 years), leave certificates 24 months after the leave by default (30 days to 2 years), HR records 6 years after the person leaves by default (1 to 10 years) and identity numbers not needed for tax a year after they leave by default (up to 6 years), with HR documents following the class of their type, and health documents 2 years after they stop being current by default (30 days to 6 years).
Unsaved work kept as drafts only for the user who typed it, in that customer: removed from the device when they sign out, never visible to other users (the customer’s Owners included) or part of the customer’s export, deleted when they lose access to the customer, and kept for at most 7 days when it holds visitors’ details (30 days otherwise; 24 hours for a visitor’s own form on their phone). Passwords, one-time codes, payment details, keys, secrets and protected answers are never kept as drafts.
Visitors’ passes signed with a key Agoo derives for each customer from a secret kept outside the database: only public keys are stored, the customer can replace its key at any time, a pass waiting for approval is never signed, and passes that stop early (for example, when a visit is cancelled) are listed so devices refuse them offline.
Published versions of the customer’s documents can’t be changed, and each agreement records the hash of the exact wording agreed to. Erasing a visitor removes their typed name, drawn signature, IP address and browser from their agreements.
One-time codes that confirm a visit request are stored only as hashes, expire within minutes, are limited for each phone number, email address and customer, and are sent from Agoo’s own sender.
Daily encrypted backups, and the ability to restore service from them.
A web application firewall, rate limits and bot protection in front of the API and public forms; credentials and secrets kept out of code, encrypted, and scanned for automatically before code is merged.

Organisational measures

Least-privilege access to production systems, reviewed when people join, change role or leave.
Confidentiality obligations for everyone with access to customer personal data.
Reviewed changes: code and database changes are reviewed before they reach production.
An incident response procedure, including the notification steps in section 9.
Due diligence on sub-processors, and written contracts with each of them.

Nkonso may improve these measures over time but will not reduce the overall level of protection. More detail is on our security page.

6. Sub-processors

The customer authorises Nkonso to use the sub-processors on our sub-processor list. Some process data only when the customer turns on the related feature, such as WhatsApp or Agoo AI.
When a visitor chooses to add their pass to Apple Wallet or Google Wallet, Nkonso sends the pass, and later its updates, to Apple or Google on the visitor’s request. Apple and Google hold it for the visitor under their own terms, as services the visitor chose, and are not Nkonso’s sub-processors; the sub-processor list names them, what they receive and when, for transparency.
When a member of the customer's staff connects their own Google, Microsoft or Zoom account, Nkonso adds the events and meetings for their bookings to that account on their instruction. Google, Microsoft and Zoom hold them for that person or the customer under their own agreement, and are not Nkonso's sub-processors; the sub-processor list names them, what they receive and when, for transparency.
Nkonso puts a written contract in place with each sub-processor that requires it to protect customer personal data to a standard at least as protective as this DPA, and remains responsible to the customer for its sub-processors.
Nkonso will tell customers at least 30 days before a new sub-processor starts processing customer personal data, by email to the Owner and by updating the list. If a sub-processor must be replaced urgently, for example because it has failed, Nkonso will tell customers as soon as possible.
The customer may object to a new sub-processor on reasonable data protection grounds within that notice period. Nkonso will then work in good faith to address the objection, for example by not using that sub-processor for the customer’s data. If that isn’t possible, the customer may end the affected service and receive a refund of fees paid for the period after it ends.

7. Requests from data subjects

Agoo gives the customer tools to find, export, correct and erase a person’s data, including records hidden by the customer’s plan, so the customer can answer requests under sections 32, 33 and 35 and objections under sections 20 and 39 of Act 843. The customer's staff can see their own HR record in the Agoo Workspace app and ask the customer's HR to correct it there.
If Nkonso receives a request about customer personal data directly, it will pass it to the customer within five working days and won’t answer it, other than to say it has been passed on, unless the customer asks it to.
Where the tools aren’t enough, Nkonso will help the customer respond, taking into account the nature of the processing.

8. Help with compliance

Nkonso will give the customer reasonable help with its data protection impact assessments (including the template Agoo provides for face clock-in), its records of processing, consultations with the Data Protection Commission, and any inquiry by the Commission about the processing, by providing information about Agoo and how it processes data.

9. Security compromises

Nkonso will tell the customer without undue delay, and within 72 hours, after becoming aware of a security compromise affecting customer personal data.
The notice will describe, as far as Nkonso then knows, what happened, the kinds of data and approximate number of people affected, the likely consequences, what Nkonso has done and will do about it, and who to contact. Nkonso will add information as it becomes available.
Nkonso will help the customer meet its duty under section 31 of Act 843 to notify the Data Protection Commission and the people affected as soon as reasonably practicable, and will take steps to restore the integrity of the affected systems. Nkonso will not notify the customer’s data subjects itself unless the customer asks or the law requires it.
Nkonso will also make any report the law requires of it, including to the Cyber Security Authority under the Cybersecurity Act, 2020 (Act 1038) where that Act applies.
Telling the customer about a security compromise is not an admission of fault.

10. International transfers

Customer personal data is stored mainly in the United Kingdom, and is processed in the other locations shown on the sub-processor list, which include the European Union, the United States, Ghana and Nigeria. The customer authorises these transfers.
Nkonso protects transferred data with written contracts with each sub-processor, encryption in transit and at rest, access controls, and by sending each provider only what it needs.
Where a customer is subject to another country’s data protection law that requires specific transfer terms, such as the GDPR or UK GDPR, the Nigeria Data Protection Act, 2023 or Kenya’s Data Protection Act, 2019, Nkonso will agree reasonable additional terms on request.

11. Return and deletion

The customer can export its data at any time. On every plan, including the Free plan, this includes a full export of the organisation, with records hidden by the plan and the files still kept, requested from the console by an Owner or Admin and downloaded from the console for 7 days. It leaves out passwords, keys and other secrets, face templates, and full ID numbers, staff statutory numbers and pay account numbers, which never leave Agoo (their last four characters are included). Cancelling a paid plan moves the organisation to the Free plan and does not end this DPA or delete data. Moving to any lower plan never deletes data by itself: records older than the new plan’s history are kept, hidden, and come back when the customer moves to a plan with a longer history.
When the customer asks for its organisation to be deleted, or the agreement ends, Nkonso deletes customer personal data within 30 days, or after the export period in the terms of service where that applies. Copies in encrypted backups expire within a further 30 days and are not restored in the meantime except to recover from an incident.
Nkonso may keep data that the law requires it to keep, protected and used for no other purpose. Nkonso will confirm deletion in writing on request.
Data deleted under the customer’s retention settings, or by erasing a person, is deleted in the same way, and each deletion is logged.

12. Information and audits

Nkonso will make available the information reasonably needed to show that it meets this DPA, such as descriptions of its security measures, sub-processor details and any independent reports it holds, and will answer one reasonable security questionnaire a year.
If that information is not enough, or the Data Protection Commission requires it, or after a security compromise affecting the customer, the customer may audit Nkonso’s compliance. The customer must give at least 30 days’ notice, use an independent auditor bound by confidentiality, audit during business hours without disrupting the service or accessing other customers’ data, and bear its own costs. Audits are limited to once in any 12 months, except after a security compromise or at the Commission’s request.
Sub-processors are audited through their own reports and certifications.

13. Liability

Each party’s liability under this DPA is subject to the limits in the terms of service. Each party is responsible for its own compliance with Act 843 and for its share of any compensation awarded to a data subject (section 43), in proportion to its responsibility for the damage.

14. Duration, precedence and changes

This DPA lasts as long as Nkonso processes customer personal data.
On matters of personal data, this DPA takes priority over the terms of service. An order form takes priority only where it expressly changes this DPA.
Nkonso may update this DPA as the terms of service describe, and will not reduce the protection it gives customer personal data without the customer’s agreement, except where the law requires a change.

15. Contact

Nkonso Technologies Ltd
10A Mega Street, Adentan Municipality, Accra, Ghana
Email: agoo@ardentafrica.com (put “Privacy” in the subject line)
Phone: +233 30 398 3393