A performance system holds objectives, feedback, review content and the relationships between people, so almost everything in it is personal data. This page sets out the roles the GDPR and UK GDPR give each of us, the agreement that has to be in place before we process anything, and the questions to put to us in writing during an evaluation.
Discuss your data protection requirementsYour organisation is the controller of your employees’ data. You decide to run a review cycle, what it asks, who takes part and how long the records are kept, and you answer to your people and your regulator for those decisions. We would be the processor, acting on your documented instructions and on nothing else.
For this website the roles are different. New Dynamics LTD is the controller of what you submit here: a demo enquiry, a guide or template download, a job application. Our privacy notice covers that processing, its lawful bases, the providers involved and how to exercise your rights.
Getting the split written down early matters more than it sounds. It decides who answers a subject access request, who assesses a breach, who holds the retention decision and who signs the agreement below.
Article 28 requires a written contract wherever a controller uses a processor, and it has to cover specific ground: the subject matter and duration, the nature and purpose of the processing, the types of personal data and categories of people, processing only on your instructions, confidentiality, security measures, the use of sub-processors, assistance with individual rights and with your own obligations, deletion or return at the end, and your right to audit.
Ours is part of the agreement for the service rather than a file on this website. Ask for the current version at the start of your evaluation, by writing to contact@new-dynamics.com, and send us your own template if your procurement process needs that instead. Read it before a trial rather than after, because a trial with real employee data is processing like any other.
We are a United Kingdom company and our service providers operate internationally, so personal data may be processed outside the UK or the European Economic Area. Where a transfer is restricted, it needs a lawful mechanism: an adequacy regulation where one applies, or approved contractual safeguards with any additional measures the destination calls for. Which mechanism applies depends on the destination and the provider arrangements, so the specifics belong in the agreement rather than in a claim on a web page. The Information Commissioner's Office’s international transfers guidance sets out what to check.
If data residency is a requirement rather than a preference, raise it in the first conversation. Ask where the service is hosted, where support staff access it from, where any AI processing happens, and get the answers in writing for your assessment.
For this website, the providers are named in our privacy notice: Vercel hosts the site and its form endpoints, Google Sheets and Apps Script receive enquiry records, Slack receives internal alerts when it is configured, and Google Analytics and PostHog receive optional analytics after consent.
For the product, the sub-processor list belongs with the agreement, where it can be kept current and where your right to notice of a change is written down. We do not publish a product sub-processor list here, because a list on a marketing page goes stale and a stale one is worse than none. Ask for it, and ask how far in advance you would be told about an addition.
Access, rectification, erasure, restriction, portability and objection are rights people exercise against the controller, so an employee asks their employer, not us. As processor our duty is to help: to find what is held about a person, to correct or delete it on your instruction, and to export it in a usable form. Ask during evaluation how each of those is done in practice and how long it takes, because a right you cannot exercise inside the statutory deadline is a problem you inherit.
Performance records carry a particular difficulty. Feedback written by one person about another is personal data about both of them, so an access request can engage somebody else’s rights too. The Information Commissioner's Office’s UK GDPR guidance covers how to approach that, and it is worth agreeing your approach before the first request arrives.
Article 22 restricts decisions based solely on automated processing where they have a legal or similarly significant effect, and a decision about someone’s employment is exactly that. Our design does not rely on the exceptions, because the system does not make the decision: AI assistance prepares context, and the person responsible checks the evidence and decides what to record. No rating, ranking or employment outcome is produced on its own.
That position is set out at length on our EU AI Act page, where worker management is a high-risk use, and our AI performance management page describes where the assistance applies. Ask which features involve AI, what each one is generated from, and what a manager sees before they decide.
A new system processing employee data across an organisation is the kind of processing that usually calls for a data protection impact assessment. It is yours to carry out as controller, and the Information Commissioner's Office’s DPIA guidance explains when one is required and what it has to contain. Ask us for the information you need to complete it rather than guessing at it: what is processed, where, by whom, for how long, and what the security measures are.
On a personal data breach the duties divide. A processor notifies the controller without undue delay; the controller then assesses the risk and decides whether the supervisory authority has to be told within 72 hours, and whether the people affected need telling. Agree the notification route and the contacts in the agreement, while nobody is under pressure.
A privacy or procurement team needs four things from a supplier, and all four come from one address. Write to contact@new-dynamics.com and you will get a written answer and the current version of any document that applies. Written answers are what an assessment can rely on, so ask early and attach them.
The Article 28 terms: the scope and duration, processing on your instructions, confidentiality, security, sub-processors, help with individual rights, deletion or return, and your right to audit. Send your own template if your process needs that.
Who would process your data besides us, what each one does and where. Ask how much notice you would get before one is added, so the answer is in your agreement rather than on a page that can go stale.
Where the service runs, where support staff access it from, where any AI processing happens, and which transfer mechanism covers each. Raise it early if residency is a requirement rather than a preference.
Encryption in transit and at rest, key and secret handling, identity and access control, logging, retention and deletion, and the answers to your own security questionnaire in writing.
None of these is a download on this website, and that is deliberate. A hosting location or a vendor list published on a marketing page goes out of date quietly, and a buyer who relies on a stale one is worse off than one who asked. What you receive by email is current on the day it is sent.
Our security and data protection page lists the questions worth asking about hosting, encryption, access, retention and deletion, and our certification page states plainly that ISO 27001, SOC 2, ISO 42001 and ISO 27701 are in progress and that no certificate has been issued. Written answers are what an assessment can rely on, so ask for them in writing and attach them.
The official texts are the GDPR (Regulation (EU) 2016/679), the UK GDPR and the Data Protection Act 2018. This page is general information about those rules and our position under them, not legal advice. Your obligations depend on your own processing, and the wording for your organisation should be settled with your own counsel.
That is a conclusion your own assessment reaches, not a badge we can award ourselves, so we do not print it as a claim. What we can give you is the controller and processor split, a data processing agreement, written answers on hosting, transfers, access, retention and deletion, and the information you need for a DPIA.
Your organisation is the controller of your employees' data: you decide to run the cycle, what it asks and how long records are kept. We would be the processor, acting on your documented instructions. For this website we are the controller of what you submit, which the privacy notice covers.
Yes. Ask for the current version at the start of your evaluation by emailing contact@new-dynamics.com, or send us your own template if your procurement process requires that. It is part of the agreement for the service rather than a download on this website.
Our providers operate internationally, so personal data may be processed outside the UK or the EEA, under an adequacy regulation or approved contractual safeguards depending on the destination. If data residency is a requirement, raise it in the first conversation and ask for the answer in writing.
The website providers are named in our privacy notice. The product list belongs with the agreement, where it is kept current and where your right to notice of a change is written down. Ask for it, and ask how much notice you would get before an addition.
No. AI assistance prepares context and a person checks the evidence and decides. No rating, ranking or employment outcome is produced by the system on its own, which is why our design does not rely on the Article 22 exceptions.
Processing employee data across an organisation in a new system usually calls for one, and it is yours to carry out as controller. The Information Commissioner's Office publishes guidance on when a DPIA is required and what it must contain. Ask us for the processing information you need to complete it.
Explore the review experience, then put your controller obligations, transfer and retention requirements to our team in writing.
Try the interactive preview
