Data Processing Agreement
How we process personal data on your behalf.
This Data Processing summary describes how DriftCore processes personal data on behalf of its Customers. It supplements our Terms of Service and Privacy Policy. Enterprise customers may request a signed Data Processing Agreement (DPA).
Roles of the parties
For personal data that a Customer enters about its personnel, the Customer is the data controller and DriftCore is the data processor. DriftCore processes such data only on the Customer's documented instructions, which include operating and supporting the Service.
Subject matter & duration
Processing lasts for the term of the subscription and any agreed data-retention or data-return period after termination.
Nature & purpose of processing
Hosting, storing, organising and making available employee training and competency records; generating certificates, reports and compliance views; and providing security, backup and support.
Categories of data & data subjects
- •Data subjects: the Customer's employees, contractors and personnel, and the Customer's authorised users.
- •Data: identity and employment details, training/competency/assessment records, signatures, certificates, training hours, and usage/audit data.
Sub-processors
DriftCore uses vetted sub-processors to host and operate the Service and requires them to protect data under obligations no less protective than our own. Current sub-processors include our cloud hosting/object-storage provider and our email-delivery provider. A current list is available on request, and we will give notice of material changes.
Security measures
DriftCore maintains technical and organisational measures including role-based access control, tenant isolation, encryption in transit and at rest, audit logging, and automated backups with an immutable off-site option. See our Security page.
International transfers
Where personal data is transferred across borders, we apply appropriate safeguards as required by applicable law.
Assistance & data-subject requests
Taking into account the nature of processing, DriftCore will assist the Customer in responding to requests from data subjects seeking to exercise their rights.
Breach notification
DriftCore will notify the affected Customer without undue delay after becoming aware of a personal-data breach affecting that Customer's data.
Return & deletion
On termination, DriftCore will, at the Customer's choice, return or delete Customer personal data within a reasonable period, except where retention is required by law.
Contact
To request a signed DPA or our current sub-processor list, contact privacy@driftcore-lms.com.