Empuls is designed as a privacy-aware SaaS platform, and Xoxoday’s ISMS and compliance framework help your organisation align with GDPR-style requirements.
Clear controller–processor model
- your organisation remains the data controller; Xoxoday acts as data processor and operates Empuls under documented contractual, statutory, and regulatory obligations defined in its compliance framework.
Data protection & privacy of personal information
- Data protection and privacy requirements identified by Xoxoday’s Infosec, Legal, and Engineering teams are embedded into policies and procedures, and communicated to all staff involved in processing personal data.
- Access to personal information is enforced on a strict “need-to-know” basis, supporting GDPR principles of data minimisation and access limitation.
Lawfulness, purpose limitation & acceptable use
- Organisational records and customer data are handled in line with data-classification and acceptable-use policies, reducing the risk of use outside agreed purposes (Article 5 GDPR).
Security of processing (Article 32 GDPR)
- Empuls is operated under an ISO-aligned ISMS with controls for access management, network security, incident management, supplier management, and operations security, all monitored for ongoing compliance.
- Annual third-party technical assessments and audits are carried out to identify vulnerabilities and verify control effectiveness.
Accountability, oversight & auditability
- A designated Information Security Officer oversees legal / regulatory mapping, control implementation and periodic reviews, with results reported to senior management.
- Formal internal audits, non-conformance tracking and CAPA processes ensure issues are logged, corrected and evidenced, supporting GDPR accountability and audit requirements.
Support for your organisation’s GDPR processes
- Empuls provides role-based access, detailed activity logs and export/reporting capabilities so your organisation can evidence who accessed what data and when, and respond to regulatory or internal audit requests.
- Xoxoday’s compliance and security documentation (ISMS policies, procedures, audit reports) can be shared with your organisation to support DPIAs, vendor risk assessments and ongoing regulator-facing compliance.
Is Empuls GDPR compliant for EU and UK employee data?
Empuls is fully GDPR compliant for EU and UK, hosting staff data in AWS EU/UK regions under ISO 27001, SOC 2 Type II controls, and a signed DPA.
Is Xoxoday Empuls compliant with GDPR and data privacy laws?
Xoxoday Empuls is fully compliant with GDPR, CCPA, and HIPAA, with built-in encryption, role-based access controls, and data subject rights…