Data Processing Information
1. Categories of data subject
The categories of data subject whose Personal Data may be processed comprise:
(a) Users of the Platform, primarily employees, consultants, contractors and other staff associated with the Customer; and
(b) individuals whose Personal Data is held in the Customer’s connected data sources or who receive communications sent through the Platform, including the Customer’s own customers, learners, employers and their staff.
2. Types of Personal Data
The types of Personal Data to be processed include names, email addresses, and other Personal Data contained within Records processed through the Customer's connected Data Feeds and Actions.
3. Purposes of processing
The Personal Data may be processed for the following purposes only:
(a) delivery of the Hosted Services;
(b) provision of Support Services and customer support;
(c) system maintenance, security monitoring and incident management;
(d) service-related notifications and communications necessary for the operation of the Platform;
(e) reporting and statistical analysis relating to the Customer's use of the Platform; and
(f) compliance with applicable legal obligations.
For the avoidance of doubt, Customer Personal Data shall not be processed for the purposes of product development, benchmarking, marketing, or the training, retraining, fine-tuning or improvement of any artificial intelligence or machine learning model by the Provider.
4. Security measures for Personal Data
Security measures for Personal Data include encryption of Personal Data at rest and in transit, firewall protection, secure access controls, use of anonymisation where feasible, and ongoing staff training on data protection best practices.
5. Recipients and Sub-processors of Personal Data
The Provider uses the following Sub-processors to deliver the Platform. The Provider imposes data protection obligations on each Sub-processor equivalent to those set out in the Agreement and ensures that each has robust security measures in place.
Sub-processor | Purpose | Personal Data processed | Location |
|---|---|---|---|
Umbraco A/S (Umbraco Cloud) | Platform hosting, deployment and administration | All Customer Personal Data held on the Platform | United Kingdom (hosting); Denmark (company) |
Microsoft Corporation (Microsoft Azure, provided via Umbraco Cloud) | Database and file storage infrastructure | All Customer Personal Data held on the Platform | United Kingdom (UK South region) |
Customer-connected services: where the Customer connects the Platform to third-party systems, or uses its own accounts with messaging or communications providers (for example Twilio for SMS and WhatsApp messaging, or Microsoft Azure Communication Services for email), those providers are engaged by the Customer under the Customer's own terms and are not Sub-processors of the Provider. Personal Data is transmitted to such services only on the Customer's instructions, as configured by the Customer within the Platform.
Other than as described above, our Sub-processors are the only recipients of Customer Personal Data except as required by law.
6. International Transfers
Any transfers of Personal Data outside of the EEA/UK are done with appropriate safeguards, ensuring the receiving country has an adequacy decision or through International Data Transfer Agreements (IDTAs) in a form approved by the ICO or other appropriate mechanisms to provide adequate safeguards for data subjects.
7. Retention
On termination of the Agreement between the Provider and Customer and any surviving provisions which require the continued processing of Personal Data, the Provider shall (unless required by Data Protection Laws) either:
(a) promptly destroy all copies of the Customer Personal Data in its possession; or
(b) at the Customer's written request received prior to termination of the Agreement return one complete copy of all Customer Personal Data in its possession to the Customer at the Customer's expense (calculated on the time spent by the Provider at its standard rates in securely locating, separating and transmitting such Customer Personal Data), and destroy all remaining copies in its possession,
provided, in either case, where prompt destruction is not practical, particularly but without limitation with regard to copies made for backup purposes and not for active use, the Personal Data concerned may be retained until the Provider's next deletion or destruction cycle for such data.
Note: this Schedule is subject to evaluation to reflect the evolving functionality of the Platform and changes in Data Protection Law and may accordingly be revised by the Provider from time to time.