Data processing terms
Part of the terms of service. They cover the personal data you put in, mostly about your own people.
Roles
The customer is the controller (under the GDPR) or data fiduciary (under India’s DPDP Act 2023) for the personal data in its workspace. The Openn Group is the processor and acts only for the customer.
What is processed
Names, email addresses and roles of the people in the workspace; who agreed to which policy version and when; risk owners, notes and history; tool owners in the AI tool register; saved scan summaries (counts per rule, never text) with who saved them; alerts; and the activity trail of changes. The purpose is to provide Openn Shield to the customer, for as long as the customer uses it.
Text and files checked with the scanner are processed only in the user’s browser and never reach us.
Instructions
We process this data only to run the service as the customer uses and configures it, and as these terms describe. If the law ever requires us to do something else, we tell the customer first unless the law forbids it.
Confidentiality and security
Only people who need access to run or support the service have it, and they are bound to keep it confidential. We apply the measures described on the security page and keep them at least as strong over time.
Sub-processors
The customer authorises the sub-processors on the sub-processors page. We bind each to data protection terms at least as protective as these. We give workspace owners 30 days’ notice of a new one; a customer that objects on reasonable grounds may end the affected service and receive a pro-rata refund of prepaid fees for it.
Helping the customer
The service lets owners and admins find, correct, export and delete records themselves. Where that is not enough, we help the customer answer requests from the people in its data, and with security reviews and impact assessments, as far as is reasonable.
Breaches
If we become aware of a breach affecting personal data in a workspace, we tell the customer without undue delay, with what we know, what we are doing about it, and updates as we learn more.
International transfers
Data is hosted in the United States and handled by the providers on the sub-processors page. Where a transfer needs safeguards, we rely on the providers’ terms, including the European Commission’s standard contractual clauses where they apply.
Retention and end of service
The customer’s owners set how long saved scan summaries and read alerts are kept, and can export everything at any time. When an owner deletes the workspace, every record it holds is erased 14 days later, and backups containing it expire on a rolling basis after that, unless the law requires us to keep something.
Information and audits
On request we provide the information reasonably needed to show we meet these terms. On-site audits can be agreed in a separate written agreement.
Contact
Questions about these terms, or a signed copy for your records: privacy@theopenngroup.com.