Data Processing Addendum

1. Definitions

“Data Protection Law” means the laws that apply to Beacon’s processing of Customer Personal Data, including the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended (“CCPA”) and the other US state privacy laws. “Personal data,” “processing,” “controller,” “processor,” “service provider,” “data subject” and “personal data breach” have the meanings those laws give them. “Customer Personal Data” means personal data that Beacon processes on the Customer’s behalf under the Agreement. “Subprocessor” means a third party Beacon engages to process Customer Personal Data.

2. Roles and scope

For Customer Personal Data, the Customer is the controller (or, where it acts for another controller, a processor) and Beacon is the Customer’s processor and service provider. The Customer is responsible for having a lawful basis to give Beacon the data, for the instructions it gives, and for telling the people concerned what is needed. Annex I describes the processing.

3. Instructions

Beacon will process Customer Personal Data only on the Customer’s documented instructions, which are the Agreement, this DPA, and the Customer’s use of Beacon’s features, unless the law requires otherwise (in which case Beacon will say so first, if the law allows). If Beacon believes an instruction breaks Data Protection Law, it will tell the Customer and may pause that processing until the instruction is confirmed or changed.

4. California and other US state law

To the extent the CCPA or another US state privacy law applies, Beacon:

• processes Customer Personal Data only for the business purposes in Annex I, and not for any other purpose, including its own commercial purposes;
• will not sell or share (as those laws define the terms) Customer Personal Data;
• will not retain, use or disclose it outside its direct business relationship with the Customer, or combine it with personal data it receives from anyone else or collects from its own interactions with a person, except as those laws allow a service provider to;
• will give the same level of privacy protection the law requires, and tell the Customer within a reasonable time if it can no longer meet its obligations;
• agrees that the Customer may take reasonable steps to make sure Beacon uses the data consistently with the Customer’s obligations, and to stop and remedy any unauthorized use.

Beacon certifies that it understands and will comply with these restrictions.

5. Confidentiality and personnel

Beacon allows access to Customer Personal Data only to people who need it to provide the service, and who are bound by a duty of confidentiality.

6. Security

Beacon maintains appropriate technical and organizational measures to protect Customer Personal Data, at least those in Annex II, and may update them provided it does not lower the level of protection.

7. Subprocessors

The Customer gives Beacon general authorization to use the Subprocessors listed at beaconapp.pro/subprocessors (Annex III). Beacon will give the Customer at least 30 days’ notice, by email to the contact in the Agreement, before a new Subprocessor starts processing Customer Personal Data. The Customer may object on reasonable data protection grounds within that period. Beacon will try to resolve the objection in good faith, and if it cannot, the Customer may end the affected service and receive a pro rata refund of prepaid fees for it. Beacon binds each Subprocessor to data protection terms no less protective than these, and is responsible for each Subprocessor’s performance.

8. Data subject requests

If Beacon receives a request from a person about Customer Personal Data, it will tell the person to ask the Customer and will pass the request to the Customer within five business days, and will not respond itself unless the law requires. Beacon will help the Customer respond, taking into account the nature of the processing. Members can also export their data and delete their account themselves from Settings.

9. Assistance

Beacon will give the help the Customer reasonably needs, given what Beacon does and the information it has, with the Customer’s security, breach notification, data protection impact assessment and prior consultation duties. Where that help takes significant effort beyond what the service normally involves, Beacon may ask the Customer to cover its reasonable costs, and will say so first.

10. Personal data breaches

Beacon will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as Beacon then knows, what happened, the kinds and approximate number of people and records involved, the likely consequences, and what Beacon has done and proposes to do. Beacon will keep the Customer updated and help it meet its own notification duties. A notice is not an admission of fault.

11. Return and deletion

When the Agreement ends, Beacon will, at the Customer’s choice, make Customer Personal Data available for export or delete it, within 30 days, unless the law requires it to keep some. Copies held in routine backups are overwritten in the ordinary course of backup rotation. Beacon will confirm deletion in writing on request.

12. Information and audits

On request, Beacon will give the Customer the information needed to show that it is meeting this DPA, including a reasonable security questionnaire once a year. If that is not enough, or a regulator or a breach requires it, Beacon will allow an audit by the Customer or an auditor it appoints, on reasonable notice, during business hours, no more than once a year (unless a breach or a regulator requires more), subject to confidentiality, without disrupting the service or exposing other customers’ data, and at the Customer’s expense.

13. International transfers

Beacon processes Customer Personal Data in the United States. Where Data Protection Law restricts a transfer of Customer Personal Data from the European Economic Area, the United Kingdom or Switzerland to Beacon, the parties agree to the Standard Contractual Clauses adopted by European Commission Implementing Decision (EU) 2021/914, which are incorporated into this DPA: Module Two (controller to processor) where the Customer is a controller, and Module Three (processor to processor) where it is a processor, with the following choices. Clause 7 (docking) applies. Clause 9(a): option 2, general written authorization, with the notice period in section 7. Clause 11: the optional independent dispute resolution language does not apply. Clause 17: option 1, the law of Ireland. Clause 18: the courts of Ireland. Annex I of the Clauses is Annex I below, Annex II is Annex II below, and Annex III is Annex III below. The competent supervisory authority is the one that supervises the Customer.

For transfers from the United Kingdom, the parties also agree to the International Data Transfer Addendum to the Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0), whose tables are completed by this DPA and the Agreement, and which either party may end as its Section 19 allows. For transfers from Switzerland, the Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Federal Data Protection and Information Commissioner as the supervisory authority. If the Clauses conflict with this DPA, the Clauses prevail. Beacon is not currently certified under the EU–US Data Privacy Framework and does not rely on it.

14. Liability

Each party’s liability under this DPA is subject to the limits and exclusions in the Agreement, except where the law or the Standard Contractual Clauses do not allow that.

15. Term, changes and precedence

This DPA takes effect when the Agreement incorporates it and lasts as long as Beacon processes Customer Personal Data. Beacon may update it to reflect a change in the law or in the service, and will give the Customer 30 days’ notice of a change that matters to it; a Customer who objects reasonably may stay on the version it signed until the Agreement renews. If this DPA conflicts with the Agreement about the processing of Customer Personal Data, this DPA prevails. Otherwise the Agreement’s governing law and dispute terms apply.

Annex I: Details of the processing

• Subject matter and nature. Hosting and running Beacon accounts: storing and displaying lessons progress, answers and scores; saving figures a member chooses to enter; sending the emails and notifications a member has not turned off; and providing support.
• Business purposes. Providing the Beacon service to the Customer’s members as set out in the Agreement; account security and fraud prevention; support; and legally required record keeping. No other purpose.
• Duration. The term of the Agreement, plus the return and deletion period in section 11.
• People. The Customer’s employees, members, students or clients who are given or create Beacon accounts.
• Categories of personal data. Name and email address; account and sign-in records (time, network address, browser type); timezone and language; learning activity (lessons, answers, XP, scores, achievements, bookmarks); settings and notification choices; and any figures the member chooses to enter in a simulator or the net worth tracker. Beacon does not ask for bank account numbers, card numbers (held by Stripe), government identifiers or credit reports.
• Sensitive data. None is intended or requested.
• Frequency. Continuous, for as long as accounts are active.
• Competent supervisory authority. As stated in section 13.

Annex II: Security measures

• Access. No passwords: single-use sign-in links that expire in 15 minutes, or Google sign-in. Session cookies are HTTP-only, Secure and SameSite, with a separate anti-forgery token on every change. Role checks on every administrative request. Production access limited to people who need it.
• Encryption. HTTPS with HSTS for all traffic in transit. Sign-in links and session tokens are stored only as keyed hashes. Payment card data is handled only by Stripe.
• Application security. A strict Content Security Policy with a per-request nonce, anti-framing and content-type protections, input validation on every request, parameterized database queries and rate limiting on sign-in, account and billing actions.
• Logging. A security log of sign-ins, failed sign-ins and account changes, with network addresses removed after one year.
• Data minimization and retention. Product analytics, page views and the email log are deleted after 90 days; deleted accounts are erased immediately apart from the records the Privacy Policy lists.
• Resilience. Routine database backups.
• Vendors. Subprocessors are limited to those on the Subprocessors page and are bound by written data protection terms.
• Incident response. A documented process to investigate, contain and notify, with the 72-hour customer notice in section 10.

Annex III: Subprocessors

The current list, with what each does and the data it handles, is at beaconapp.pro/subprocessors, and is part of this DPA as it stands when the Customer signs, as updated under section 7.