Clear roles for business data
This page explains the practical allocation of data-protection responsibilities when an organisation uses PeopleVanta for employee, customer and operational records.
Last updated 17 October 2026The customer organisation normally decides why business and employee information is collected, which records are entered, who may access them and how long the organisation must retain them. The customer must have an appropriate lawful basis and provide any notices required for its use of the information.
PeopleVanta processes customer content to host, secure, back up, troubleshoot and provide the configured service. Access by support personnel should be limited to authorised support, security and maintenance needs. We do not sell customer employee records or use them for unrelated advertising.
Infrastructure, email, support and payment providers may process limited information where needed to deliver the service. Payment credentials and mobile-money PINs remain in the payment-provider or network experience. Customers should contact us for information relevant to their own supplier and transfer assessments.
PeopleVanta maintains measures intended to protect confidentiality, integrity and availability and will assess suspected incidents affecting customer data. Requests from an individual may need to be referred to the customer organisation that controls the relevant employment or business record.
This public explanation does not replace a signed data-processing agreement or sector-specific terms. Organisations that require contractual schedules, audit information or tailored retention commitments should contact PeopleVanta before placing regulated or unusually sensitive workloads in the service.
Need a clear answer?
