Privacy and retention
Mark answers personal or sensitive, keep sensitive answers sealed, choose how long answers are kept, and know what respondents are told, under Ghana's Data Protection Act.
Agoo is in early access. This page describes the feature as it ships to early-access organisations; screens are illustrative.
Whoever makes a form decides what it asks and why, and is responsible for the answers under the Data Protection Act, 2012 (Act 843). Agoo processes them for you. Ask only what you need, and say why in the form's words.
Personal and sensitive answers
Each question has privacy marks in the inspector:
| Mark | What it does |
|---|---|
| Personal | The answer says who someone is or how to reach them. Listed in your records of personal data |
| Sensitive | The answer is sealed as it arrives. It's never in a summary or an email, only in an export when someone allowed ticks the box, and shown only after Reveal |
| Masked | Shown partly hidden on screen until revealed |
Ghana Card questions are always sensitive and masked, and can't be marked otherwise. Even an export that includes sensitive answers shows a Ghana Card number masked (GHA-•••••••89-0); the full number is shown only by revealing it on one response. Mark health details, and anything else that could harm someone if it got out, as sensitive too.
A checked email (Forms Plus): when a form asks people to confirm their email, the confirmed address is kept with each response, shown to the people who read responses and included in exports, and deleted with the response. It's also kept with the person's Agoo ID, so one response a person works however they come back. Receipts go only to a confirmed address, and never carry a sensitive answer.
Who can reveal: a workspace's Owners, and on Forms Team, the people you allow form by form. Each reveal, and each export that includes sensitive answers, is recorded.
How long answers are kept
Choose a time, and Agoo deletes what's past it, checking every hour:
- For a question: in its privacy marks. When its time is up, that answer is blanked and the rest of the response stays.
- For a form: under the responses table, Change.
- For the whole workspace: under Exports (Owners and Admins).
A form's own time comes before the workspace's. Responses in the bin go after 30 days. A team workspace that's deleted can be restored for 30 days, then everything in it is deleted.
What respondents are told
Every form shows:
- who receives the answers: the workspace's name, or your organisation's;
- that the maker sees the answers and when they were sent, and that Agoo keeps a scrambled form of the connection's address for 30 days to stop abuse. A form says "This form doesn't ask who you are" only when nothing in it says who someone is; the word "anonymous" alone is never used;
- "Agoo Forms will never ask for your password or PIN";
- Your data, where they can ask you about their answers, and Report this form (see Reporting a form and your data).
What someone types is kept in their own browser for up to a day, so a dropped connection loses nothing; a Ghana Card number is never kept there. No cookies are set on a form to answer.
Answering data requests
Someone who answered your form can ask you, from Your data on the form, for a copy of their answers, a correction, deletion, or for you to stop using them. They confirm their email with a code first, so you know the address is theirs.
- A team or personal workspace: the request reaches Data requests, in the workspace's side bar on agooforms.com, and its Owners and Admins are emailed. Open it to read what they asked, add notes for your team, or reply by email; replying moves it to In progress. When you're done, choose Completed or Refused and write what you did or why not: that's emailed to them.
- Your organisation's workspace: requests go to the organisation's own inbox in the Console (Settings → Data & privacy → Data requests), with the form named, and are answered there with the organisation's other requests.
| Request | Due within |
|---|---|
| A copy | 40 days |
| A correction | 30 days |
| Deletion | 30 days |
| Stop using it | 30 days |
Agoo reminds your Owners and Admins before a request is due and when it's past due. If one goes unanswered, Agoo follows it up with you and may help the person directly, as Ghana's Data Protection Act provides. A closed request is kept for two years.
Your workspace's data
Owners export the whole workspace whenever they like. For an organisation's workspace, its forms and responses are part of the organisation's own export and deletion.
Read more in the privacy notice, the terms and the acceptable use policy.
Responses and exports
Read responses in a table across every version, filter them, open one at a time, see a summary of each question, use the bin, export CSV or Excel, and choose your emails.
Safety, holds and appeals
How Agoo Forms checks a form when you publish it, why a form can be held, what a person on Agoo's safety team may decide, what a takedown or a paused workspace means, and how to appeal.