Ends in1d 13h 19m 24s

Data Processing Addendum

Effective

This Data Processing Addendum (“DPA”) forms part of the agreement between PingMyNetwork SAS (“we”, “us”) and the organisation that buys licences under our Business Terms (the “Customer”). It applies automatically to every order and does not need to be signed. A signed copy is available on request at contact@pingmynetwork.com.

On matters of personal data, this DPA prevails over the Business Terms. It is intended to meet the requirements of the EU General Data Protection Regulation (GDPR), the UK GDPR and other data protection laws that apply to the Customer.

1. Roles

For the data about the Customer’s members that we make available to the Customer in its organisation workspace (“Organisation Data”), the Customer is the controller and we are its processor.

For each member’s personal account, and for our own purposes such as account security, billing, fraud prevention, service improvement and compliance with the law, we act as an independent controller under our Privacy Policy. This DPA does not apply to that processing.

2. Details of the processing

Item

Description

Subject matter and purpose

Providing PingMyNetwork to the Customer’s members and showing the Customer’s admins and instructors their members’ learning activity

Duration

The term of the agreement, and until deletion or return under section 7

Data subjects

Members invited by the Customer (such as employees and students), and the Customer’s admins and instructors

Personal data

Name, email address, organisation membership and role, licence assignment, learning progress and results, activity dates

Special categories

None. The Customer must not send us special categories of data about its members

3. Our commitments

When we process Organisation Data, we:

  • process it only on the Customer’s documented instructions, which are the agreement and the Customer’s use of the admin features, and inform the Customer if, in our opinion, an instruction infringes data protection law;

  • ensure that persons authorised to access it are bound by confidentiality;

  • protect it with the security measures described on our Trust Center (section 9);

  • assist the Customer in responding to requests from its members to exercise their rights and, where relevant, in meeting its obligations regarding security, impact assessments and prior consultation;

  • do not sell it, and do not use it for advertising or for any purpose other than providing the service to the Customer.

4. Personal data breaches

We notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Organisation Data. We provide the Customer with the information available to us that it needs to meet its own obligations, and we take reasonable steps to contain the breach and limit its effects.

5. Sub-processors

The Customer authorises us to use the sub-processors listed on our Trust Center (section 9). Each sub-processor is bound by a written contract imposing data protection obligations equivalent to those in this DPA, and we remain liable for its performance.

We give at least 30 days’ notice before adding or replacing a sub-processor, by updating the list on our Trust Center and by email to Customers who have requested these notices at contact@pingmynetwork.com. The Customer may object on reasonable data protection grounds. If we cannot resolve the objection, the Customer may terminate the affected part of the service and receive a pro-rata refund of the unused prepaid period.

6. International transfers

Our servers are located in the United States. Where Organisation Data is transferred from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on the EU-US Data Privacy Framework and its UK and Swiss extensions where the recipient is certified, and otherwise on the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), with the UK International Data Transfer Addendum where UK law applies. Where the Standard Contractual Clauses are required between the Customer and us, they are incorporated into this DPA by reference.

7. Deletion, return and audits

The Customer can export Organisation Data in CSV or JSON, free of charge, during the agreement and for 30 days after it ends. Within 60 days after the end of the agreement, we delete or return Organisation Data, except data that members have chosen to keep in their personal accounts, data we are required to retain by law, and backups, which are overwritten in the normal course.

We make available to the Customer the information necessary to demonstrate our compliance with this DPA, and we respond to one reasonable security questionnaire per year. An on-site audit takes place only where a supervisory authority requires it or after a personal data breach, with 30 days’ notice, at the Customer’s cost, and subject to confidentiality.

8. Other data protection laws

Where other data protection laws apply to the Customer, such as U.S. state privacy laws, we process Organisation Data only to provide the service, and we do not sell or share it.

Liability under this DPA is governed by the Business Terms.

9. Security measures and sub-processors

The security measures referred to in section 3 and the list of sub-processors referred to in section 5, with their purpose, the data they receive and their location, are published on our Trust Center. We may update the security measures, provided the overall level of protection of Organisation Data is not reduced.