OneDirectory acts as a data processor for the employee information your organisation chooses to sync or enter, and your organisation remains the data controller. This article explains what data we process, where it lives, who our subprocessors are, and how we support GDPR, UK GDPR, and US state privacy laws.
Who controls your data
Under data-protection law your organisation is the controller of your employee data and OneDirectory is the processor. We only process your data to provide the OneDirectory service to you, on your instructions. We don't use it for unrelated purposes, and we don't sell it.
What data we process
We process the employee profile information you configure or sync, which may include:
Name, job title, and photo
Email address and phone numbers
Office location, department, and reporting line (manager)
Professional biography, skills, and interests
Birthday, hire date, and custom fields
This data is used for employee search and directory display, organisational-structure mapping, and helping authorised users find and connect with colleagues.
No special categories of personal data (for example health, ethnicity, or religious beliefs) are processed. The people whose data is processed are your employees, contractors, and guest users.
Where your data is stored
United States: the default region for non-EU tenants.
European Union: for EU tenants, or any customer who requests EU data residency.
Australia: available on request for customers requiring Australian data residency.
Our subprocessors
We use a small set of vetted subprocessors, each bound by data-protection terms equivalent to our own:
Microsoft: data storage, hosting, backup, firewall, and security (Microsoft Azure).
Cloudflare: firewall, DDoS protection, TLS/SSL encryption, CDN, and DNS.
Intercom: customer support and Help Center services.
We give customers at least 30 days' notice of any new or replacement subprocessor, so you have the opportunity to object.
International transfers
Where data is transferred outside the EEA, we rely on appropriate safeguards, including the EU Standard Contractual Clauses (Module Two: Controller to Processor) or an equivalent valid mechanism.
Data subject rights
Your employees' rights, including access, rectification, erasure, restriction, portability, and objection, are exercised through your organisation as the controller. If we receive a request directly, we notify you promptly (within two working days) and assist you in responding.
Retention, return and deletion
We retain your data only for as long as needed to provide the service. When your agreement ends, or at your request, we will return or securely delete your data and all copies, and confirm deletion in writing, except where law requires us to retain it.
US state privacy laws
For customers covered by US state privacy laws such as the CCPA/CPRA, OneDirectory acts as a service provider. We do not sell your data, do not use it for cross-context behavioural advertising, and do not combine it with data from other sources except as permitted to provide and secure the service.
Need the full documents? Our complete Data Protection Addendum (DPA) and Security Overview are available on request. Email security@onedirectory.com for security questions, or accounts@onedirectory.com for the DPA. |