01GDPR Scope & Our Commitment
The General Data Protection Regulation (GDPR) is the world's most comprehensive data privacy law, applying to any organization that processes personal data of EU/EEA residents — regardless of where that organization is located. As a platform serving HR teams who may manage EU-based employees, OnTap is committed to full GDPR compliance.
We act as a Data Processor when handling personal data on behalf of our customers (who are Data Controllers). We also act as a Data Controller for data we collect directly — such as account information and usage data.
02Lawful Bases for Processing
Under GDPR, we process personal data only where a lawful basis exists:
- Contract Performance: Processing necessary to provide our platform services to you.
- Legal Obligation: Processing required to comply with employment law, tax regulations, and statutory reporting.
- Legitimate Interests: Security monitoring, platform improvement, and fraud prevention — where we have assessed these interests do not override your rights.
- Consent: Marketing communications and optional analytics — which you can withdraw at any time.
03Data Processing Agreement (DPA)
OnTap provides a comprehensive Data Processing Agreement (DPA) for all enterprise customers who need one for GDPR compliance. Our DPA includes:
- Clear specification of processing activities, purposes, and data categories
- Sub-processor list and notification obligations
- Technical and organizational security measures (TOM)
- Data subject request handling procedures
- Breach notification timelines (72-hour obligation)
- International transfer mechanisms (Standard Contractual Clauses)
To request a DPA, contact legal@ontapke.com. Enterprise customers can access DPA signing directly through their account settings.
04International Data Transfers
When we transfer personal data outside the EU/EEA (including to our servers in Kenya and other regions), we rely on appropriate safeguards:
- Standard Contractual Clauses (SCCs): EU Commission-approved transfer mechanism for all international transfers.
- Adequacy Decisions: Transfers to countries recognized by the EU Commission as providing adequate protection.
- Supplementary Measures: Technical measures including end-to-end encryption to supplement SCCs where required.
05Data Subject Rights Under GDPR
We support all GDPR data subject rights and have processes to respond within required timeframes:
Right of Access (Art. 15)
Provide a copy of all personal data we hold about you within 30 days.
Right to Rectification (Art. 16)
Correct inaccurate personal data within 30 days.
Right to Erasure (Art. 17)
Delete personal data where no overriding legal basis exists for retention.
Right to Restriction (Art. 18)
Restrict processing in specified circumstances.
Right to Data Portability (Art. 20)
Receive personal data in structured, machine-readable format.
Right to Object (Art. 21)
Object to processing based on legitimate interests.
Rights re: Automated Decisions (Art. 22)
Not be subject to solely automated decisions with significant effects without human review.
Submit data subject requests to info@ontapke.com or through your account settings under Privacy & Data.
06Data Breach Notification
In the event of a personal data breach, OnTap commits to:
- Notifying affected Data Controllers within 72 hours of becoming aware of a breach
- Providing full details of the breach, including data categories affected, estimated individuals affected, and likely consequences
- Documenting all breaches in our internal breach register, even if no notification is required
- Implementing immediate containment measures and post-incident remediation
07Data Protection Officer
OnTap has appointed a Data Protection Officer (DPO) responsible for overseeing our GDPR compliance program:
You have the right to lodge a complaint with your local EU/EEA data protection supervisory authority if you believe we have not complied with GDPR.
Questions about this policy?
Our legal and compliance team is happy to help.