# Employee Handbook — Privacy & Monitoring Section

> **Document Version:** 1.0  
> **Document Owner:** Acme Inc  
> **Next Review Date:** 2027-03-19


**Effective Date:** 2026-03-19
**Last Updated:** 2026-03-19

**Organization:** Acme Inc

> **Internal document.** This section is intended for inclusion in the Acme Inc employee handbook. It describes the company's policies on workplace monitoring, device usage, email monitoring, and employee data privacy. All employees and contractors are expected to read and acknowledge this section.

---

## 1. Purpose & Scope

This section of the employee handbook establishes Acme Inc's policies regarding:

- **Workplace monitoring** — what tools are used and what data they collect
- **Device usage** — policies for company-issued and personal (BYOD) devices
- **Email and communication monitoring** — what is monitored and why
- **Employee data privacy** — your rights and our obligations

These policies apply to all employees, contractors, interns, and temporary workers who use Acme Inc's systems, networks, or devices.

## 2. Workplace Monitoring Policy

### 2.1 Monitoring Principles

Acme Inc monitors certain workplace systems for the following legitimate purposes:

- **Security** — detecting and preventing unauthorized access, data breaches, and cyber threats
- **Compliance** — meeting regulatory obligations and audit requirements
- **Performance** — ensuring system reliability, uptime, and error resolution
- **Legal** — preserving evidence where required by law or regulation

Monitoring is conducted on the principle of **proportionality** — we collect only what is necessary for the stated purposes and do not engage in excessive surveillance.

### 2.2 Active Monitoring Tools

The following monitoring and analytics tools are currently deployed in Acme Inc's systems:

| Tool | Type | What It Collects |
|------|------|-----------------|
| Sentry | Error/Performance Monitoring | Application error tracking — captures stack traces, request metadata, and device information when errors occur. |
| PostHog | Analytics | Product analytics — tracks feature usage, page views, and user interactions. |

> **Important:** These tools collect technical and behavioral data to improve our products and systems. They are **not** used for individual employee performance evaluation or disciplinary purposes unless a specific security investigation requires it.

## 3. Device Usage Policy

### 3.1 Company-Issued Devices

Company-issued devices (laptops, phones, tablets) are provided for business purposes. Acme Inc reserves the right to:

- Install and maintain security software (antivirus, endpoint detection, MDM)
- Monitor device compliance with security policies (encryption, OS updates, screen lock)
- Access company data stored on the device
- Remotely wipe the device if lost, stolen, or upon termination of employment

**Expectations:**
- Keep devices updated with the latest security patches
- Do not install unauthorized software that could compromise security
- Report lost or stolen devices immediately to IT
- Reasonable personal use is permitted, but company policies apply to all activity on company devices

### 3.2 Personal Devices (BYOD)

If Acme Inc permits use of personal devices for work:

- Only approved applications may access company data
- Mobile Device Management (MDM) software may be required
- Acme Inc can remotely wipe **company data only** (not personal data) from the device
- Employees must maintain minimum security standards (screen lock, OS updates, encryption)

### 3.3 Software & Cloud Services

Acme Inc uses 8 third-party services that may process employee data in the course of business operations. Employees should:

- Only use approved software and cloud services for company work
- Not store company data in personal cloud storage accounts
- Report any suspected security incidents involving third-party services

## 4. Email & Communication Monitoring

### 4.1 Email Policy

Company email accounts are provided for business communications. Employees should be aware that:

- **Company email is not private.** Acme Inc may access, monitor, or review company email accounts for legitimate business purposes including security, compliance, legal proceedings, and business continuity.
- Email metadata (sender, recipient, timestamp, subject line) may be logged and retained.
- Email content may be scanned by automated systems for malware, phishing, and data loss prevention (DLP).
- Reasonable personal use of company email is permitted, but such messages are subject to the same monitoring policies.

### 4.2 Email Services in Use

The following email services are currently integrated into Acme Inc's systems:

| Service | Purpose |
|---------|---------|
| Resend (email API — logs delivery status and engagement metrics) |


### 4.3 Messaging & Collaboration Tools

Acme Inc may monitor usage of company-provided collaboration tools (e.g., Slack, Teams, project management tools) in the same manner as email. Employees should:

- Treat all messages on company platforms as potentially accessible to the company
- Use appropriate channels for sensitive discussions
- Not share confidential information in public channels
- Report any suspicious messages or phishing attempts

## 5. AI Tools in the Workplace

Acme Inc uses the following AI services in its systems:

| AI Service | Data That May Be Processed |
|------------|---------------------------|
| openai | user prompts, conversation history, generated content |

**Employee responsibilities when using AI tools:**

- Do not input sensitive employee personal data (health information, financial details, performance reviews) into AI tools unless explicitly authorized
- Review AI-generated outputs for accuracy before using them in business decisions
- Be aware that prompts and interactions may be logged by the AI service provider
- Report any concerns about AI tool behavior to your manager or IT department
- Follow any additional AI usage guidelines provided by Acme Inc

## 6. Employee Data Privacy Rights

### 6.1 What Data We Collect About Employees

In addition to standard HR data (identity, employment, payroll), Acme Inc may collect technical data through the monitoring tools described above, including:

- IP addresses and device identifiers
- Login timestamps and access logs
- Application usage patterns and error logs
- Email metadata and communication logs

### 6.2 Your Rights

Under applicable data protection laws (including GDPR where applicable), employees have the right to:

| Right | Description |
|-------|-------------|
| **Access** | Request a copy of the personal data we hold about you |
| **Rectification** | Request correction of inaccurate data |
| **Erasure** | Request deletion of data (subject to legal retention requirements) |
| **Restriction** | Request limitation of processing |
| **Objection** | Object to processing based on legitimate interests |
| **Data Portability** | Receive your data in a machine-readable format |

### 6.3 How to Exercise Your Rights

To exercise any data privacy rights or raise concerns about monitoring:

- **Email:** legal@acme.com
- **Data Protection Officer:** Jane Mueller (dpo@acme-saas.com)
- **Response time:** Within 30 days of receiving your request

## 7. Enforcement & Consequences

Violations of the policies described in this section may result in disciplinary action, up to and including termination of employment. Specifically:

- Attempting to circumvent monitoring systems is prohibited
- Unauthorized access to monitoring data or other employees' data is prohibited
- Misuse of company devices, email, or communication tools may result in disciplinary action
- Employees who report privacy concerns or violations in good faith are protected from retaliation

## 8. Changes to This Policy

Acme Inc reserves the right to update these policies as monitoring tools, business needs, or legal requirements change. Employees will be notified of material changes before they take effect.

### Employee Acknowledgment

By signing below, I acknowledge that I have read and understood the Privacy & Monitoring section of the Acme Inc employee handbook.

| Field | Value |
|-------|-------|
| **Employee Name** | ______________________ |
| **Employee Signature** | ______________________ |
| **Date** | ______________________ |
| **Manager Name** | ______________________ |
| **Manager Signature** | ______________________ |

---

*This Employee Handbook Privacy Section was auto-generated by [Codepliant](https://github.com/joechensmartz/codepliant) based on a scan of the project's codebase. It should be reviewed by your legal and HR teams before distribution to employees.*