Privacy Policy

This Policy explains how STRANSFORM Limited handles personal data in connection with the Alignis website, demonstration requests, customer contracting, account administration, support, security and customer workspaces. A customer organisation may provide an additional privacy notice for its own use of Alignis.

STRANSFORM Limited is normally a data controller for website enquiries, demonstration requests, commercial relationships, its own account administration, support, service security and business operations.

A customer organisation is normally the controller for employee, officer, contractor and organisational performance data placed in its Alignis workspace. We normally process that workspace data as a processor for the customer, on documented instructions and under the applicable customer agreement. The exact roles can depend on the activity and contract.

• Identity and contact data, including name, work email, staff number, job title and organisation.
• Account and access data, including user identifier, role, organisation assignment, invitation status and authentication records managed through our authentication provider.
• Organisation data, including departments, directorates, divisions, units, reporting lines and administrator assignments.
• Performance data, including priorities, KRAs, objectives, KPIs, targets, weights, commitments, progress, actual results, reviews, appraisals, competencies, comments, approvals, signatures and calculated scores.
• Dispute and improvement data, including concerns, requested outcomes, responses, actions, support arrangements and review assessments.
• Sales and support data, including demo request details, organisation type and size, messages and support correspondence.
• Technical and security data, including source page, user agent, hashed IP address for demo requests, audit events, rate-limit events, notification delivery status, timestamps and error diagnostics.
• Commercial and contracting records held outside the product where needed to manage a customer relationship.

We receive data directly from website visitors and users, from customer organisations and their administrators, from authorised imports, from supervisors and other workflow participants, and automatically from service operation and security controls. Customers may obtain workforce data from their own personnel and administrative systems.

• Respond to enquiries and arrange product demonstrations.
• Create, secure and administer invited accounts and customer workspaces.
• Provide configured performance planning, review, appraisal, reporting, dispute and improvement workflows.
• Send invitations, password reset messages, workflow notifications and service communications.
• Provide support, diagnose faults, prevent abuse and maintain auditability.
• Manage customer relationships, contracts, service delivery and legal obligations.
• Improve the reliability, usability and security of Alignis using proportionate operational information.

Depending on the activity, we rely on steps requested before a contract, performance of a contract, compliance with legal obligations, legitimate interests in operating and protecting the service, or consent where the law requires a freely given choice. We do not treat this Policy as a lawful basis by itself.

Customer organisations must identify and document their own lawful basis for workforce and performance processing. Public authorities may need to consider statutory functions or public interest grounds. Employers should not rely on employee consent where the employment relationship prevents a genuinely free choice.

A demo request records the name, work email, organisation name and type, optional workforce range and message, source page, user agent and a one-way hash of the requesting IP address. We use these details to respond, prevent abuse, maintain the sales record and deliver the request to our support address. Support communications are used to investigate and answer the issue raised.

Accounts are invitation-based and use a contracted authentication service. Essential session cookies maintain a signed-in session. Password reset and invitation emails support account access. Customer and Alignis administrators can create invitations and assign authorised roles. Alignis does not provide social sign-in or public self-registration.

We use workspace data to provide the functions configured by the customer. Access is scoped by organisation, role, assignment and workflow relationship. Customer administrators determine much of that configuration. A person seeking access, correction, restriction or deletion of customer-controlled workspace data should normally contact the relevant customer organisation first. We will assist the customer as required by the applicable agreement and law.

Performance comments, disputes, improvement plans and supporting descriptions may reveal sensitive or consequential information even where the system does not require a formal sensitive-data field. Customers should minimise entries, restrict access and avoid adding medical, biometric, political, religious, trade union or other sensitive information unless it is necessary, lawful and covered by appropriate safeguards.

Alignis calculates totals and summaries from customer-configured weights, measures and entered results. Alignis does not use artificial intelligence to make recommendations or solely automated employment decisions. Customer organisations remain responsible for human review and for all employment, disciplinary, promotion, compensation and similar decisions.

Personal data may be available to authorised users and administrators within the relevant customer organisation, to our authorised personnel where needed to operate or support Alignis, and to professional advisers or authorities where lawfully required.

We use contracted service providers for application hosting, database and file storage, authentication, transactional email delivery, and limited error and performance monitoring. They process data under their service terms and our arrangements with them. Relevant customer contracts may include a maintained subprocessor schedule.

We do not promise Nigerian-only hosting or a particular cloud region unless this is stated in the relevant customer agreement. Service providers may process data outside Nigeria. Transfer locations, safeguards and an appropriate transfer basis should be documented for regulated customer data under the Nigeria Data Protection Act 2023 and applicable NDPC directives.

We retain personal data only as long as reasonably necessary for the relevant purpose, contract, security need and legal obligation. Certain read platform notices expire after 60 days. Retention periods for demo requests, workspace records, audit logs, authentication records and backups depend on operational and contractual requirements.

Customer-specific retention, export, return and deletion must be agreed and managed operationally. Deletion may be limited by legal holds, public records duties, dispute needs, security records and backup cycles.

Implemented measures include organisation and role-based controls, database row-level security, server-side privileged operations, same-origin checks, rate limiting, security headers, audit records and hashed IP storage for demo requests. Security cannot be guaranteed. We investigate suspected incidents and will notify affected customers, data subjects or the Nigeria Data Protection Commission where the applicable law and our role require it.

Subject to applicable law and exceptions, you may request information about processing and access to, correction or deletion of personal data. You may also request restriction, object to certain processing, withdraw consent where processing relies on consent, and request portability where applicable.

Send a request to support@alignis.app with enough information to identify the relevant interaction or workspace. We may need to verify identity. For customer-controlled workspace data, we may refer the request to the customer or act on its instructions. You may also complain to the Nigeria Data Protection Commission through its official channels.

Alignis is intended for organisational and workforce use, not for children. We do not knowingly offer accounts directly to children. A customer planning to process information about a child must first establish a lawful purpose, authority and suitable safeguards and agree the use with us.

Our website may link to external websites. Their operators are responsible for their own privacy practices, and this Policy does not apply to those sites.

We may update this Policy to reflect legal, product or operational changes. The current version and effective date will appear on this page. Material contractual changes will also follow the notice process in the applicable customer agreement.

Contact support@alignis.app for privacy questions or rights requests. You may lodge a complaint with the Nigeria Data Protection Commission at ndpc.gov.ng or use its official data subject request and complaint channels.