Data processing agreement

1. Scope

This agreement covers the personal data we process for you on your Business account. It does not cover a person's personal account and training record, our contract with you, invoices and accounting records, our correspondence with you and the messages your people send us, the usage and technical records we keep to run, secure and improve the Service, or the count of what we delivered to you. We are the controller of those, and our privacy notice applies.

Terms defined in the UK GDPR (such as controller, processor and personal data breach) or in the terms of service have the same meaning here.

2. Roles

You are the controller of the personal data this agreement covers, and we are your processor. We process it to provide the Service and on your instructions. We may also anonymise it to create the aggregated statistics that section 9 of the terms of service describes. We do not use it to train AI models.

3. Your instructions

Your documented instructions are this agreement, the terms of service, the subscription you bought and the settings you choose in the Service. If you connect single sign-on or a directory, what your identity provider sends us is also your instruction.

We tell you immediately if we think an instruction breaches data protection law. We process only on your instructions unless the law requires otherwise, and then we tell you before processing unless that law forbids it.

4. Our obligations

We:

• process the data only on your documented instructions, including on transfers outside the United Kingdom;
• make sure the people authorised to process it are bound by confidentiality;
• take the measures Article 32 of the UK GDPR requires, including those in Annex 2;
• engage subprocessors only as the subprocessors section allows;
• help you answer requests from your people, so far as the nature of the processing allows;
• help you with security, breach notification, impact assessments and prior consultation, taking account of the nature of the processing and the information available to us;
• delete or return the data at the end of the service, as you choose;
• make available the information you need to show that we meet these obligations, and allow and contribute to audits, including inspections, as the audits section sets out.

5. Security

We apply the technical and organisational measures in Annex 2, and we may change them if the change does not materially reduce the protection they give.

6. Personal data breach

If we become aware of a personal data breach affecting your data, we tell your administrators without undue delay, with what we know, and update you as we learn more. Notifying the ICO (ico.org.uk), another supervisory authority or your people is your decision.

7. Confidentiality

We keep your data confidential. We disclose it only as this agreement allows, or where the law or legal process requires, in which case we tell you where the law allows.

8. Subprocessors

You give general authorisation for us to engage the subprocessors in Annex 3. We engage each one under a written contract that imposes the data protection obligations Article 28(4) of the UK GDPR requires, and we remain responsible to you for its performance of them.

We tell you before a new subprocessor starts processing your data. If we have to replace one urgently to protect the Service or your data, we tell you as soon as we can.

You may object on reasonable data protection grounds. If we do not resolve the objection before the change takes effect, you may end the affected subscription at once, and that is your remedy.

9. International transfers

Some subprocessors process personal data outside the United Kingdom. For each one, Annex 3 states where it processes and the transfer mechanism its terms carry, or links the terms that state them. You instruct us to make those transfers.

Transfers to us from the European Union rely on the European Commission's adequacy decision for the United Kingdom.

10. Requests from your people

If one of your people makes a request or a complaint to us about their data, we tell them that we act for you and pass it to your administrators promptly.

11. Your controls and obligations

You decide who in your organisation sees named results, through the visibility level and groups in your team settings. Aggregate figures are shown only where a group meets a minimum size. Our product documentation describes the levels and the minimums; it is information and does not form part of this agreement.

You are responsible for the lawfulness of your instructions, including your lawful basis for assessing your people, telling them about the processing, and any impact assessment or consultation the law requires, including with a works council. You also make sure that free-text fields, such as review notes, hold no special category or criminal offence data, no secrets or credentials, and no personal data about anyone else.

12. People who leave

When you remove someone from your organisation, their assessment records stay in your records unchanged. When someone deletes their own account, their assessment records stay with their identifier replaced by a stable placeholder. That is pseudonymisation, so the records are still personal data you control. You can instruct us to delete a person's assessment records instead.

13. End of the service

When your account ends, as the terms of service define it, you choose return, deletion or both. Return is the export, available while the account is live and for 90 days after it ends. We then delete the account's records, unless you set an archive of up to seven years in your team settings: the export stays available until the archive ends, and we delete the records then. If you want them deleted sooner, tell us. Deleted data remains in our backups for up to 30 days.

We may keep data longer where the law or legal process requires it. We keep a count of what we delivered to you, which names no person.

14. Information and audits

We answer first with information: this agreement, our security page and written answers to reasonable questions. If that is not enough, you or an auditor you appoint may audit our compliance with this agreement once in any 12 months, on 30 days' notice, during working hours, without unreasonable disruption and under confidentiality. The yearly limit does not apply where the ICO or another supervisory authority requires more, or after a personal data breach affecting your data. Your auditor must not be a competitor of ours.

For our subprocessors, we share the audit reports they make available to us, where their terms allow. You bear the cost of an audit, including our reasonable costs, unless it finds that we have materially breached this agreement.

15. Liability, changes and law

The limits and exclusions of liability in the terms of service apply to this agreement, and claims under both count towards one limit. If this agreement conflicts with the terms of service on data protection, this agreement prevails. We may change it in the same way as the terms of service. It lasts as long as we process personal data for you, the general provisions of the terms of service apply to it, and it is governed by the law of England and Wales.

Annex 1: details of the processing

Annex 2: security measures

• Access control: each customer's data kept apart, and administrative access limited to the people who need it, with multi-factor authentication.
• Sign-in with a second factor available to users.
• Encryption in transit and at rest.
• Logging and monitoring.
• Secure development and change control.
• Vulnerability and dependency management.
• Encrypted backups and recovery.
• Supplier management, as the subprocessors section sets out.
• A published responsible disclosure policy, also at /.well-known/security.txt.

Annex 3: subprocessors