GDPR overview

Our role

You are the data controller. Accolade is the data processor. You decide what data to collect, we process it on your instructions.

Data Processing Agreement (DPA)

A signed DPA is available free on Enterprise and Agency. Email privacy@accolade.live to request.

Subject access requests

If a nominee, judge, or guest asks you for their data, search their email in Accolade and export the result. Takes 2 minutes per request.

Right to be forgotten

You can delete any individual's records on demand. We support hard-delete (no soft-delete recovery) for GDPR erasure requests.

Data residency and international transfers

The application runs on Render, in Render’s Frankfurt region. The database is Aiven managed MySQL, reached over TLS. Both are within the European Economic Area.

Hosting and the database are within the European Economic Area. Not every sub-processor is: payments are processed by Stripe in the United States under the UK Addendum to the EU Standard Contractual Clauses. The sub-processor table on our GDPR page lists every third party that touches your data and where each one processes it, and it is the authoritative list.

Sub-processors

List of every third party that touches your data (Aiven, Render, Stripe, Claude, etc) is at our GDPR page. We notify of any changes 30 days in advance.