1. Roles
The customer organization determines why and how workforce data is processed and is the controller of that data. Ridier Consultancy Group LLC acts as the processor and processes the data only to provide the RIDIER service under the customer's instructions.
A countersigned data processing agreement incorporating this schedule is available on request from Executive@ridier.com. This page is informational and does not by itself replace a signed agreement.
2. Subject matter and duration
Processing covers the operation of the RIDIER platform for the customer's workforce and lasts for the term of the customer relationship, plus the wind-down period described under retention.
3. Purposes of processing
- Delivering the conversational employee experience.
- Extracting structured, dimension-level signals from conversation content.
- Calculating deterministic, versioned PSI™, Adoption Readiness, trajectory, and intervention results.
- Producing threshold-protected aggregate reporting and summaries for authorized leaders.
- Securing the service and supporting the customer.
4. Categories of data subjects and data
- Data subjects: the customer's employees who take part in conversations, and the customer's leaders and administrators who use the platform.
- Employee data: conversation content while it is being processed, structured signals, and broad organizational attributes such as department, approved site, and broad role group.
- Leader data: name provided at sign-up, email address, organization membership, and role.
- Not processed: employee names, employee IDs, exact job titles, manager identities, GPS or address data, raw IP addresses, device fingerprints, or persistent cross-conversation identifiers.
- No special-category or health data is requested, and RIDIER produces no clinical or diagnostic output.
5. Retention and deletion
- Conversation content: temporary working data, redacted or deleted after signal extraction.
- Voice audio: not retained.
- Structured signals, aggregate scores, and historical periods: retained for the term so trend reporting stays accurate.
- Account and configuration records: retained while the account is active.
- On written request from an authorized contact: deletion or return of customer records within 30 days, excluding limited records kept for legal obligations.
6. Technical and organizational measures
- Tenant isolation enforced in the database with row-level security on customer tables.
- Role-based leader authorization (owner, admin, analyst, viewer) checked on the server.
- Employee access links stored as hashes only, with expiry, closure, revocation, rate limiting, and optional PIN.
- Server-side validation of every submission; sensitive credentials held as server-side secrets and never exposed to the browser.
- Encryption in transit (TLS) and encryption at rest provided by our managed hosting platform.
- Minimum reporting thresholds and differencing protection applied before any leader-facing result is shown.
- Restricted internal data paths: research and evidence tables are reachable only by privileged server-side roles, not by leader accounts.
7. Subprocessors
RIDIER uses the subprocessors listed on our Subprocessors page, each engaged under terms requiring confidentiality and appropriate security. Customers are notified before a new subprocessor begins processing their data.
8. Assistance to the customer
- We will assist with data subject requests to the extent the data can be located — conversations are collected without identifiers, so individual conversation records often cannot be linked to a person by design.
- We will notify the customer's authorized contact without undue delay after becoming aware of a personal data breach affecting their data, with the information available at the time.
- We will make available the information reasonably needed to demonstrate compliance with these processing terms.
9. Audit and certification status
Ridier Consultancy Group LLC has not completed a SOC 2, ISO 27001, or equivalent third-party audit, and holds no compliance certification or attestation at this time. Our Security page states our current control and audit status directly. We will publish audit status changes there rather than implying coverage we do not have.
10. International transfers
RIDIER and its subprocessors operate in the United States. Where a transfer mechanism such as the EU Standard Contractual Clauses is required, we will enter into it as part of the signed data processing agreement.
Contact
Questions about this document, a data request, or a security concern can be sent to Executive@ridier.com. Ridier Consultancy Group LLC will acknowledge written requests and respond with the information available to us.