GDPR and Data Protection

Roles, because everything else follows from them

You are the controller of the records in your workspace. ExecCortex is the processor, acting on your documented instructions, which are the Data Processing Agreement plus whatever you do in the product.

This is not a formality. It decides who answers a subject access request, who decides a retention period, and who is accountable if a record should never have been collected. Those are yours. What is ours is keeping the data safe, keeping it separated, doing only what you asked, and helping you when somebody asks you a question you need our help to answer.

Lawful basis

For the website, our basis is consent for analytics and legitimate interest for the rest: running a website, answering a message you sent us, and keeping the thing secure.

For workspace records, the lawful basis is yours to determine, because you decided to collect them. We do not assert one on your behalf.

How isolation is actually enforced

Every record carries the workspace it belongs to, and the separation is applied at the point the data is read rather than filtered in the interface afterwards.

The distinction is the whole thing. A filter in the interface fails open: forget it in one place and that screen shows everybody's data. Applied where the read happens, a query that forgets its workspace returns nothing rather than everything, so the failure is a visibly empty screen instead of a silent breach.

Data minimisation and purpose limitation

The product asks for a field because a feature needs it. Where a field is genuinely sensitive, such as a national identifier, a date of birth or a bank detail, it is encrypted before it is stored and it is shown only to roles that have been granted it, rather than to anyone who can open the record.

Reports that could identify a small group are suppressed below a minimum group size rather than shown with a caveat. A diversity breakdown over three people names them, whatever the header says.

Subject requests

A person can ask you for their data, and for most requests you can serve that yourself with the export and deletion tools in the product, which is faster for them and does not require you to raise a ticket with us.

If they come to us instead, we do not act on the record. We tell them which organisation controls it, pass the request to you, and tell them we have done so. Acting unilaterally would mean overriding your control of your own data, which is exactly what a processor must not do.

If you need help with a request you cannot serve yourself, write to support@execcortex.com and say what you have been asked for.

Breach notification

If we become aware of a breach affecting your workspace we tell you without undue delay and within 72 hours, with what we know at that point rather than waiting until we have a complete picture.

The first message will usually be incomplete and will say so. A notification that arrives late because it was being polished is worth less than a rough one that arrives in time for you to act.

International transfers

Where personal data moves outside the region it was collected in, it moves under the standard contractual clauses. The sub-processors page names each third party and where it operates, and it is the page to read if data location is a decision factor for you.

AI and automated decisions

The regulation is specifically concerned with decisions made about people without a human involved. The position here is narrow and deliberate.

• No feature in this platform makes a decision about a person on its own. Everything an AI feature produces is a draft or a suggestion that a named person accepts or rejects.
• Nothing ranks or scores candidates in recruitment. That is a permanent product decision, not a feature that has not shipped yet.
• Nothing scores an individual employee for flight risk or performance. Where a signal is useful it is reported for a group, above a minimum size.
• Where an AI feature has influenced something, a record is written of what it proposed and what the human did with it, so the decision has a trail rather than a vibe.

What is still yours to do

Buying a compliant platform does not make an organisation compliant, and any vendor implying otherwise is selling you a false sense of the work.

• Decide your lawful basis for the records you collect, and your retention periods.
• Keep your own record of processing activities.
• Tell the people whose data you hold what you are doing with it.
• Configure roles so that access matches need. The tools are there; the decisions are yours.
• Sign the Data Processing Agreement, which is the instruction we act on.