These service levels apply where the Client is purchasing web-based electronic assessment Services from the Company:
In-company training course programs can produce significant savings where a client has a number of participants wishing to attend public training courses. Fees for these courses will be provided on request.
This Data Processing Protocol (the "Protocol") explains how the Company handles personal data on behalf of the Client.
Where this Protocol uses terms which are defined in the General Data Protection Regulation (Regulation (EU) 2016/679) (the "Regulation"), then the definitions set out in that Regulation shall apply.
With respect to personal data processed by the Company on the Client's behalf (see Annex 1), the Company will comply with the following requirements:
Limitations on Use. The Company will process personal data only to deliver the relevant service, as instructed in writing by the Client from time to time, or as otherwise required by law.
Confidentiality. The Company will hold personal data in confidence and require Company personnel who will process personal data to protect all personal data in accordance with the requirements of this Protocol.
Information Security Program. The Company will maintain a written information security program and keep in place appropriate administrative, technical and physical safeguards to protect personal data against anticipated threats or hazards to its security, confidentiality or integrity.
Assistance. The Company will:
The Company may charge a reasonable fee for all such assistance described above, save where assistance was required directly as a result of the Company's own acts or omissions, in which case such assistance will be at the Company's expense.
Audit. The Client shall provide the Company with thirty (30) days advance notice of any audit request; may not engage in an audit which would compromise confidentiality obligations to any other clients and customers of the Company and, if it wishes to nominate another auditor to undertake the audit, shall ensure that the auditor enters into a confidentiality agreement with the Company in such form as the Company shall reasonably require.
Security Incident. The Company will without undue delay notify the Client whenever the Company reasonably believes that there has been a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data processed by the Company in the context of this Protocol ("Security Incident"). After providing notice, the Company will investigate the Security Incident, take necessary steps to eliminate or contain the impact of the Security Incident and keep the Client advised of the status of the Security Incident and all related matters.
Erasure of Personal Data. Unless the Client or the Candidate requests the Company to anonymize personal data sooner, the Company will retain personal data for a period of 24 months following the latest date the Candidate was invited to take an Assessment to assist the Client in complying with any data subject requests or other obligations, after which the Company will retain the right to anonymize the personal data (and such anonymized data will be used by the Company for research purposes).
The Client understands that the Company may use infrastructure providers to provide the services under the Contract. The infrastructure providers used by the Company can be found here. The Company shall remain primarily responsible for the performance of its obligations under this Protocol and shall ensure that its agreements with such infrastructure providers are at least as restrictive as this Protocol. The Company may change or add infrastructure providers from time to time upon giving reasonable notice in writing to the Client so that the Client may express an objection, on reasonable grounds, to the proposed change.
The Client confirms that the Company may transfer personal data to its affiliates and infrastructure providers inside and outside the European Economic Area (EEA) for purposes of support and back-up. The Company has established safeguards to protect personal data transferred to countries outside the EEA, including appropriate contractual protections.
Data Processing Protocol Relating to the California Consumer Protection Act
Amendments for Client or Candidate where the collection, selling, or sharing of Personal Information takes place within the state of California:
Appendix 5a is entered into for the purpose of confirming Company's role under the California Consumer Privacy Act as amended by the California Privacy Rights Act, Cal. Civ. Code § 1798.100 et seq., and any applicable regulations (the "CCPA"). Appendix 5a hereby incorporates by reference any defined or capitalized terms not otherwise so defined herein as they are set forth in the underlying agreement between Company and any Client or Candidate to which this Addendum applies.
Appendix 5a applies to the extent Company acts as a "Third Party" under the CCPA.
As a Third Party, the Company confirms that Client has made Personal Information available to it only for the following limited and specific purposes and Company confirms that it will only use Personal Information for the following limited and specific purposes:
Client has a right to take reasonable and appropriate steps to help ensure that the Company uses the personal information transferred in a manner consistent with Client's obligations under the CCPA.
Company shall notify Client if it makes a determination that it can no longer meet its obligations under the CCPA.
To the extent permitted by the CCPA, Client may, upon notice, take reasonable and appropriate steps to stop and remediate Company's unauthorized use of Client Personal Information.
Company shall comply with all requirements of the CCPA in its role as a Third Party. This includes providing the same level of privacy protection as required of Client by the CCPA, including cooperating with Client in responding to and complying with verified consumer requests under Applicable Privacy Law and subject to the terms herein, and implementing reasonable security procedures and practices appropriate to the nature of the Client Personal Information to protect it from unauthorized or illegal access, destruction, use, modification, or disclosure.
Amendments for Client or Candidate from the People's Republic of China (which for this purpose only, excludes the Hong Kong and Macau Special Administrative Regions and Taiwan):
Where this Protocol uses capitalized terms or other expressions which are used or defined in the Personal Information Protection Law of China ("PIPL"), the definitions or meanings set out in the PIPL shall apply.
You should contact your relationship manager at the Company with who you deal to discuss any matters relating to this Agreement. Any request or feedback, including any rights to which a Client or data subject has under the PIPL, can also be directed to the Company or [email protected].
In sending Personal Information to the Company for it to provide services, a Client confirms that it has complied with the relevant requirements for the Company to handle the Personal Information as per this Protocol and under the PIPL.
The Company will, taking into account the nature of the processing and the information available to it:
Each Client confirms that the Company may transfer Personal Information to its affiliates and infrastructure providers inside and outside of China for the purposes of support and back-up. The list of such affiliates and infrastructure providers can be obtained from the Company and, to the extent practicable, the Company will inform the Client of the countries or regions in which such recipients are likely to be located. The Company also uses contractors and service providers under appropriate security requirement to provide Information Technology services to the Company in general.
All processing activities (including the collection, organization and analysis of personal data) as are reasonably required to facilitate or support the provision of the services described under clause 14.4 of the Contract.
The Company will process the personal data for as long as it provides the Services to the Client. The Company retains Assessment Data for a period of 24 months, after which time the Company may anonymize the data and use it for research purposes. The Company will also anonymize Assessment Data at the request of the Client or the Candidate.
The data subjects are the Candidates.
The services under the Contract may involve the processing of the following types of personal data:
From time to time, Candidates may volunteer additional personal information about themselves to the Company, which may include special categories of personal data. For example, Candidates may inform the Company about a health issue or disability which may impact the way in which they undertake the Assessment. The Company will obtain explicit consent before further processing any special categories of personal data that a Candidate provides. If consent is obtained, this information will be communicated to the Client requesting the Assessment whose responsibility it is to take any decisions regarding the impact on the Assessment process as a result of the information.
The personal data processed by the Company on behalf of the Client in connection with clause 14.4 may include:
Last updated: 4 September, 2023.
© 2023 Saville Assessment. All rights reserved.
© 2024 Saville Assessment. All rights reserved.