Summary: Your clients' data is yours. We only use it to run Ngozi CRM for you, we keep it secure, we tell you within 24 hours of confirming a breach, and we give it back and delete it when you leave.
1. Parties and Scope
This Data Processing Agreement ("DPA") is between the business that subscribes to Ngozi CRM ("you", the controller) and A-One Global Resourcing Ltd (AOGRL), a company incorporated in Mauritius ("we", the processor). It forms part of our Terms of Service and applies whenever we process personal data about your clients and staff on your behalf.
It is written to meet the Mauritius Data Protection Act 2017 and, where they apply to you, UK GDPR and EU GDPR. If this DPA and the Terms conflict on data protection, this DPA prevails.
2. What We Process
- Purpose: providing Ngozi CRM — bookings, client records, reminders and messages, payments and deposits, reports and the other features you choose to use.
- Duration: for as long as you have an account, then as set out in section 9.
- People: your clients, your staff, and people who book with you online.
- Data: names, phone numbers, email addresses, dates of birth, appointment history, treatment notes, photos, payments and messages, and any other information you or your clients enter.
- Special categories: health information you record, such as allergies, medical notes, skin conditions and pregnancy.
3. Your Responsibilities
- You decide what data is collected and why, and you need a lawful basis for it — including, where the law requires it, your clients' consent for health information and for marketing messages.
- You give your clients the information the law requires about how you use their data.
- You keep your staff logins secure and remove access for people who leave.
4. Our Responsibilities
- We process your data only on your instructions — your use of Ngozi CRM and its settings are those instructions — unless the law requires otherwise, in which case we tell you first where the law allows.
- We don't use your clients' data for our own purposes, sell it, or use it to train AI models.
- Everyone at AOGRL who can access your data is bound by confidentiality.
- We don't open your workspace or your clients' records unless you ask us to (for example for setup, an import or a problem you report) or the law requires it. Our internal admin pages show your clients' names as initials and their contact details as the last digits only.
5. Security
We keep appropriate technical and organisational measures in place, including:
- encryption of all connections (HTTPS, TLS 1.2+, with HSTS);
- nightly backups encrypted with AES-256, kept for 30 days;
- passwords stored only as salted hashes, and connected-account tokens encrypted;
- separation of each business's data, and role-based access for your staff.
The current measures are described on our Security page. We may improve them over time but will not reduce the overall level of protection.
6. Sub-processors
You authorise us to use the providers listed in section 6 of our Privacy Policy to deliver parts of the service. We only pass each one what it needs. We will tell you by email at least 14 days before adding a provider that receives your clients' personal data, and you may object or close your account before the change takes effect.
7. International Transfers
Your data is stored and processed outside Mauritius, mainly in the United States. We transfer it only to providers that commit to protecting it, as the Mauritius Data Protection Act 2017 requires, and for UK and EU data we rely on Standard Contractual Clauses or equivalent safeguards.
8. Breaches and Assistance
- Breaches: if we become aware of a personal data breach affecting your data, we will tell you without undue delay and in any case within 24 hours of confirming it, with what we know about what happened, the data and people affected, and what we are doing about it — so you can notify the Data Protection Commissioner and your clients where the law requires it.
- Your clients' requests: if a client asks us directly to access, correct or delete their data, we pass the request to you. You can answer most requests yourself in Ngozi CRM, and we help where you can't.
- Information: we give you the information you reasonably need to show that this DPA is being followed, and answer reasonable written questions from you or your auditor.
9. When You Leave
- You can export your data at any time, and we will provide a full export on request within 30 days of cancellation.
- We keep your account data for 90 days after cancellation so you can come back, then delete it permanently. You can ask us to delete it sooner.
- Deleted data remains in our encrypted backups until they expire, at most 30 days later.
10. Liability, Law and Changes
Each party's liability under this DPA is subject to the limits in our Terms of Service, except where the law does not allow it to be limited. This DPA is governed by the laws of Mauritius. We will give you at least 14 days' notice by email of material changes.
For a copy signed by AOGRL, email compliance@aogrl.com.
Contact
A-One Global Resourcing Ltd (AOGRL)
Souillac, Mauritius
Email: compliance@aogrl.com