Talk to us
Menu
Talk to us

Trust and data

Your data stays yours.

You are the controller. We are the processor. This page is the exact account of what we read, in what order, and what happens afterwards.

Written for the people who have to check it: IT, legal and your data protection officer. It says what we do, in the order we do it.

In short

Controller
You
Processor
MonoWorks Lab
Phase 1
Documents only
Phase 2
Emails, after you have told your staff
Afterwards
We delete your data. We keep only anonymous supplier prices.

01 Roles

You are the controller. We are the processor.

We only touch your data on your instructions and only for the cost audit.

Controller

You

  • You choose what we read.
  • You give the instructions.
  • From youYour instructions
  • From youWhat you choose for us to read
  • To youThe report, about costs and suppliers

Processor

MonoWorks

  • We only touch your data on your instructions.
  • Only for the cost audit.

The first step

A data processing agreement, signed by you and by us. The audit starts after that.

02 What we read

What we read, and what we never read.

We read

  • Invoices, ledgers and contracts. Phase 1. They have little personal data.
  • Supplier emails. Phase 2, after you have told your staff. Only supplier emails. Shared mailboxes first, such as accounts@ and orders@. A fixed date range.
  • Records from other systems, such as a CRM. Only the records you choose to give us, on terms we agree with you in writing before we read them. The same rules apply: your instructions only, the cost audit only, reports about costs and suppliers, never about a person.

We never read

  • HR folders.
  • Personal folders.
  • Any email before you have told your staff. Phase 2 starts only after that.
  • Anything outside your instructions. You choose what we read.

03 Two phases

Documents first. Emails only after you have told your staff.

Invoices, ledgers and contracts have little personal data.

Emails are the hard part. They have personal data of your staff and of people outside your company. So we do the audit in two phases.

  1. Phase 1

    Documents only.

    We start as soon as the contract is signed.

    • Invoices
    • Ledgers
    • Contracts

  2. Not before you have told your staff. You update the email policy, tell staff and sign off the data protection impact assessment (DPIA), using our templates.

  3. Phase 2

    Emails.

    We start after you have told your staff and done the paperwork.

    • Only supplier emails
    • Shared mailboxes first
    • A fixed date range
    • No HR or personal folders

04 The steps

The steps for each client, in order.

For each client

  1. Sign the data processing agreement

    WhoYou and us

    TimeA few days to 2 weeks

  2. Phase 1 audit on documents

    WhoUs

    TimeStarts right after signing

  3. Update the email policy, tell staff, sign off the data protection impact assessment (DPIA)

    WhoYou, using our templates

    Time2 to 6 weeks

  4. Phase 2 audit on emails

    WhoUs

    TimeAfter that

The times are estimates.

05 The rules we keep

Four rules we keep.

We describe what we do. “EU hosting where we can” means what it says: we do not promise EU-only hosting.

Emails

Shared mailboxes first, such as accounts@ and orders@. Only supplier emails. A fixed date range. No HR or personal folders.

Reports

Reports are about costs and suppliers. Never about a person.

AI providers

EU hosting where we can. No training on client data.

Deletion

We delete client data after the audit. We keep only anonymous supplier prices.

06 Afterwards

After the audit we delete your data. We keep one thing.

We keep only anonymous supplier prices. We say it here, plainly, so that you know it before you sign.

Your data
Deleted
Anonymous supplier prices
Kept

Questions

You choose what we read. We read all of it.

If something on this page is not clear, ask us before you sign anything.

Talk to us

IT, security and legal

Nothing leaves your control.

You are the controller. We are the processor.

For IT, security and legal

The whole sequence

From first call to one vendor.

Four steps. The first one costs you nothing.

How it works

This website

This site collects nothing.

No cookies, no analytics, no forms.

Privacy

See what your company can’t.

The cost audit is free. If we find nothing, you pay nothing.

Talk to us