Data Processing Agreement

Version: 2026-10-11 · Part of the Terms of Service · Written for Ghana's Data Protection Act, 2012 (Act 843)

1. Roles

The Customer (the company using Viszio Workspace) is the data controller of the personal data it puts into the service. Viszio Technologies is its data processor and processes that data only on the Customer's documented instructions — which are these terms and the Customer's use of the app's features.

2. What is processed

People	The Customer's staff, contractors, and client contacts it adds
Data	Name, contact details, job and role; login details (passwords stored only as one-way hashes); attendance times and the location at clock-in/out; live location if the employee switches sharing on; field visits, daily reports, photos, claims and receipts, leave; ID numbers (e.g. Ghana Card, SSNIT, TIN) if the Customer records them; device notification tokens; activity logs
Purpose	Providing Viszio Workspace to the Customer: running its attendance, field work, reporting, claims, projects and safety records
Duration	For as long as the Customer uses the service, then as in section 8

3. Our commitments

Use the data only to provide the service — never for advertising, never sold.
Make sure our people who can access it are bound to confidentiality, and give access only where needed to run or support the service.
Keep appropriate security measures in place (section 4).
Help the Customer answer people's requests to see, correct or delete their data — the app's export, edit and erasure tools do most of this directly.
Tell the Customer without undue delay, and within 72 hours of becoming aware, of a personal data breach affecting its data, with the information we have, so it can meet its own duties to the Data Protection Commission and to the people affected.
Make available the information reasonably needed to show we meet this agreement, and answer reasonable audit questions in writing.

4. Security measures

Each company's data is held in its own separate database; every request is checked against the signed-in person's company and permissions.
All connections are encrypted (HTTPS). Passwords are stored only as one-way hashes; owners and admins confirm new devices with an emailed code.
The owner console and maintenance tools sit behind an additional access control (Cloudflare Access).
Activity logs record who did what; employees can see who viewed their location.
Nightly backups are kept for 14 days; live location points are deleted after 7 days.

5. Sub-processors

The Customer authorises these providers, each used only for the purpose shown:

Provider	Purpose
Cloudflare, Inc.	Hosting, databases, file storage, security
Expo (650 Industries, Inc.)	App delivery, over-the-air updates, push notifications
Google LLC — Firebase Cloud Messaging	Delivering push notifications to Android phones
Google LLC — Gemini	Only when someone uses an AI feature (e.g. reading a receipt photo)
Resend, Inc.	Sending account emails (sign-in details, codes, receipts, reports)
The Customer's own SMS provider	Only if the Customer switches SMS on

We will give at least 30 days' notice (by email or in the app) before adding or replacing a sub-processor; the Customer may object and, if we cannot address the objection, end the service. We require each sub-processor to protect the data to a standard no lower than this agreement.

6. Transfers outside Ghana

Our providers operate internationally, so data may be stored or processed outside Ghana. We use providers that apply strong security and contractual data-protection commitments, and transfer only what each needs for its purpose.

7. The Customer's commitments

Have a lawful basis for the data it puts in, and tell its staff how the app uses their data (the privacy policy and in-app consent screens help with this).
Register with Ghana's Data Protection Commission as a data controller where the law requires it.
Give staff access only to what their work needs, and remove leavers promptly.

8. End of service

The owner can download all data at any time. When the service ends, the data is archived and permanently deleted within 30 days of the owner's written request (or returned first, if asked); backups are overwritten within 14 days after deletion. We may keep only what the law requires us to keep, and only for as long as it requires.

9. Contact

Data protection questions and requests: [email protected] · Viszio Technologies, Accra, Ghana