Roles
For personal data a customer puts into NewBoarding (for example its employees' names, work email, job details, and work logins), the customer is the controller (or “business”) and ODYSSEYDEVELOPMENTS LLC is the processor (or “service provider”). We process that data only on the customer's documented instructions, and we do not sell it, share it for advertising, or use it outside our relationship with the customer. The customer's own administrators control and access that data in the application; ODYSSEYDEVELOPMENTS LLC does not view or manage employees' credentials in the ordinary course of providing the service, and accesses customer data only to operate, secure, and support the service, or when the customer asks us to.
Details of processing
| Item | Description |
|---|---|
| Subject matter and purpose | Providing the NewBoarding hosted service: employee onboarding, credential storage and display, password-reset workflow, and audit logging |
| Duration | The customer's subscription term, plus the deletion period below |
| Data subjects | The customer's employees (and administrators) |
| Categories of personal data | Name, work email, job title, department, manager, office location, employee ID, hire date, work mobile number, account status; work-system usernames and encrypted passwords; reset requests and notes; activity-log entries with IP address |
| Sensitive data | None intended. Do not store regulated or sensitive categories (see How NewBoarding Works) |
What we commit to
- Keep personnel who touch customer data under confidentiality duties.
- Maintain the safeguards described on the Security page.
- Notify the customer within 72 hours after confirming a security incident that affects its data.
- Help the customer answer individual rights requests and assessments, and make information available to show compliance, including one audit per year on reasonable notice.
- Return or delete customer data within 30 days after the term, at the customer's choice (routine backups are overwritten in the ordinary course).
- Flow these obligations down to subprocessors, and give customers at least 15 days' notice of a new subprocessor, with a right to object on reasonable data-protection grounds.
- Where personal data moves from the EEA, UK, or Switzerland, use the Standard Contractual Clauses (and UK Addendum) as needed.
Subprocessors
The providers that may process customer or visitor data on our behalf:
| Provider | Purpose | Location | Data |
|---|---|---|---|
| Vercel Inc. | Application hosting and delivery | United States | Requests, logs, application traffic |
| Neon, Inc. | Managed Postgres database | United States | Application data (encrypted credentials; consultation requests) |
| Microsoft Corporation | Customer sign-in and directory sync (Entra ID, Microsoft Graph) and IT email, for customers who use them | As configured by the customer | Directory profile data, sign-in, IT notification email |
| Resend, Inc. | Email delivery of consultation requests to our team, if enabled | United States | Consultation request contents |
Request our DPA
To receive the full Data Processing Addendum, or to ask a privacy or security question, email newboarding@odysseydevelopments.dev.