SCRUM ALLIANCE

TRAINING PARTNER TERMS AND CONDITIONS

Last Updated: August 25, 2026

These TRAINING PARTNER TERMS AND CONDITIONS (these “Terms”), together with any other signed agreement that incorporates these Terms by reference and any attachments, exhibits, appendices and documents attached thereto or referenced therein (collectively, the “Agreement”) are entered into between Scrum Alliance, Inc., a Colorado nonprofit corporation (“SAI”), and you, the applicable training partner specified in the Agreement licensing rights from SAI ("Licensee”) as set forth herein. 

SAI and Licensee are referred to herein collectively as the “Parties” and each individually as a “Party.” 

  1. GRANT OF LICENSE

    1. License.  Subject to the terms and conditions herein, SAI grants to Licensee, and Licensee accepts, the revocable, limited, non-transferrable, non-exclusive license during the Term (defined below) to use the SAI Provided Content and the Licensed Marks (both defined below) in a manner approved by SAI solely in connection with the permitted activities identified in a signed exhibit (each, an “Exhibit”) giving rights relating to certain SAI courses that result in SAI credentials (each, a “Course”) (collectively, the “Permitted Activities”). 

    2. Sublicensing.  Licensee may sublicense certain of the Permitted Activities only if, as, and to the extent set out in an Exhibit.

    3. Licensed Marks.  The “Licensed Marks” are those trademarks owned by SAI which correspond with the Permitted Activities including any Courses Licensee is permitted by SAI to offer.  

    4. SAI Provided Content.  The “SAI Provided Content” is all materials provided to Licensee by SAI in connection with the Permitted Activities including, but not limited to, learning objectives, course descriptions, course materials, marketing materials, educational content, and course content. Collectively the Licensed Marks and the SAI Provided Content are the “Licensed Materials.” SAI may replace, remove, or update the Licensed Materials at any time. Licensee shall always use the then-current version of any Licensed Materials and promptly cease use of any deprecated Licensed Materials. 

    5. No Assignment. This Agreement or any of the rights granted hereunder may not be assigned by Licensee without SAI’s express written consent.

  2. LICENSED MATERIALS

    1. Licensed Materials Belong to SAI.  Licensee acknowledges the validity of the Licensed Materials and that all rights, title, and interest in and to the Licensed Materials as well as any and all goodwill existing therein, belongs exclusively to SAI.  Nothing herein shall give Licensee any right, title, or interest in or to the Licensed Materials, and Licensee’s sole right to use the Licensed Materials arises only out of this Agreement.  All use of the Licensed Materials by Licensee and any resulting goodwill inures solely to the benefit of SAI.  Licensee may create co-branded marketing or educational materials incorporating the Licensed Materials provided that (a) all use of the Licensed Marks is in accordance with the trademark guidance and brand usage requirements included in the then-current version of the Training Partners Marketing Toolkit located at  https://trainingpartners.brand.scrumalliance.org/ or as otherwise listed in an Exhibit (the “Brand Guidelines”), (b) all such materials are subject to SAI’s prior written approval, and (c) Licensee makes it clear that, as between the Parties, Licensee is solely responsible for the delivery and performance of the Permitted Activities.  

    2. General Restrictions on Use of the Licensed Materials.  Licensee shall not (i) during or after the Term assert the invalidity of or contest the ownership by SAI of the Licensed Materials or any registrations thereof in any manner in any country, whether as a complete or partial defense to any claim made by SAI, as a basis of a claim against SAI or otherwise; (ii) during or after the Term take any action that may prejudice the validity of, or SAI’s title to, the Licensed Materials; (iii) during or after the Term register or attempt to register in its name or for the benefit of any other party the Licensed Materials, in any manner; (iv) during or after the Term use any trademark that is confusingly similar to the Licensed Marks including, but not limited to, the re-ordering of the wording of the Licensed Marks; (v) during or after the Term tarnish the Licensed Marks; (vi) during or after the Term register any of the Licensed Materials as or as part of a trade name, business name, corporate name, domain name, social media user name, or the like, without SAI’s express prior consent; (vii) use the Licensed Marks in a manner to cause a material adverse impact on the value or source-signifying ability of the Licensed Marks; (viii) use the Licensed Marks in a manner that violates or infringes on any third-party patents, trademarks, copyrights, trade dress, trade secrets or any other intellectual property rights; or (ix) copy, modify, translate, or create derivative works based on the Licensed Materials, without SAI’s express written consent.   

    3. Domain Names and Social Media Accounts.  If, with SAI’s express written consent, Licensee registers a domain name, social media account, username, or the like (each, a “Registration”) that relates to the Licensed Materials, such Registration shall be deemed the property of SAI, and Licensee will hold it in trust for SAI and maintain such Registration on SAI’s behalf until such time that control of the Registration can be transferred to SAI or its designee.  Licensee shall not be permitted to register any Registration containing the Licensed Marks without the express prior written consent of SAI.  Upon receiving SAI’s written request at any time or upon expiration or termination of this Agreement for any reason, Licensee will assist SAI at no additional cost in transferring the Registration to SAI, or its designee, within ten (10) business days of such request, expiration, or termination. 

    4. Documents Required.  Licensee agrees to execute any documents reasonably required to effect any of the above provisions.

    5. Injunctive and Other Equitable Relief.  Licensee expressly recognizes that the Licensed Materials possess a special unique and extraordinary character that makes it difficult to assess the amount of monetary damages that SAI would sustain by Licensee’s unauthorized use.  Licensee expressly recognizes and agrees that an irreparable injury would be caused to SAI by such unauthorized use that may not be properly measured in the award of money damages and, as such, agrees that preliminary and permanent injunctive and other equitable relief would be appropriate in the event of a breach of this Agreement by Licensee, provided that such remedy shall not be exclusive of legal remedies otherwise available.

    6. Infringement of the Licensed Materials.  Licensee shall promptly notify SAI in writing of any infringements or imitations by others or other unauthorized use of the Licensed Materials that may come to Licensee’s attention.  SAI shall have the sole and exclusive right to determine whether or not any action shall be taken as a result thereof and to conduct any enforcement, and is under no obligation to take any enforcement actions.  Licensee may not take action against an infringement without SAI’s prior written consent that may be withheld for any reason. Licensee shall execute and deliver such documents and shall assist SAI in conducting any such legal proceedings, at the expense of SAI, as SAI may deem reasonably necessary for the protection of the Licensed Materials.  Licensee will promptly notify SAI of any inquiry, investigation, inspection or other action by any third party concerning the Permitted Activities

    7. Reservation of Rights.  All rights not expressly licensed to Licensee herein are reserved by SAI.

  3. LICENSEE OBLIGATIONS

    1. Partner Requirements.  SAI’s partner requirements and other relevant requirements related to Courses or otherwise (collectively the “Requirements”) shall be set out in an Exhibit, including in documents linked from an Exhibit.  Licensee acknowledges that compliance with these Requirements is a material condition of the licenses granted hereunder and agrees that it has reviewed the Requirements and that it will at all times comply fully with all Requirements.  SAI may update the Requirements from time to time.  Licensee will have thirty (30) days from the effective date of any changes to, or new, Requirements to comply.  

    2. Quality Control.  Licensee agrees that it will use the Licensed Materials in connection with the Permitted Activities only in a manner that shall be of a consistent and high standard of quality, commensurate with the prestige of SAI and the Licensed Materials.  Licensee shall not use the Licensed Materials in any unlawful, scandalous, defamatory or offensive manner likely to bring SAI or the Licensed Materials into disrepute, diminish SAI’s goodwill, tarnish SAI’s image or otherwise be prejudicial to SAI or the Licensed Materials.    

      1. Licensee agrees to comply with the trademark guidance and brand usage requirements included in the Brand Guidelines, which may be updated, or added to, by SAI from time to time. 

      2. SAI will have the right to randomly review and inspect Licensee’s Permitted Activities incorporating the Licensed Materials (including but not limited to review of student and instructor feedback, and Licensee’s compliance with this Agreement and all applicable requirements) and Licensee will cooperate in providing SAI access to such activities.  Licensee agrees to promptly make, at its own cost, any modifications to the Permitted Activities incorporating the Licensed Materials that may be requested by SAI or are required to comply with the terms of this Agreement.

      3. SAI will have the right to request from Licensee, and Licensee will provide within fifteen (15) days of receiving such a request, detailed data as needed to satisfy SAI in its sole discretion that Licensee is complying with Licensee’s requirements under this Agreement (collectively the “Records”).  During the Term and for a period of three (3) years thereafter, Licensee will maintain a complete and accurate accounting of Records which may be requested by SAI pursuant to this Agreement. Licensee will comply with any requirements for Records set out in an Exhibit.  

      4. Licensee acknowledges and agrees that it does not have the authority to grant any of SAI’s credentials, that Licensee’s students are not guaranteed to receive an SAI credential, and that Licensee will ensure that its advertising and marketing regarding the Permitted Activities do not misrepresent Licensee’s authority or imply otherwise. 

    3. Anti-Defamation, Disparagement, or Dilution. Licensee shall not make any statement, directly, by implication or by concerted action, to a third party regarding SAI including, without limitation, its officers, directors, employees, representatives, certified instructors, courses, procedures, certifications, credentials, or any of its products or services that is defamatory or disparaging. Further, Licensee will not make any statement, directly, by implication or by concerted action, to a third party that dilutes, tarnishes or impairs the value of the Licensed Materials and/or their associated goodwill.  

    4. Not Intended for Children. The Permitted Courses are intended for individuals 13 years or older, and Licensee may not offer SAI credentials to individuals under the age of 13 or upload the personal data of individuals under the age of 13 to SAI.

    5. Feedback. If Licensee provides any feedback to SAI regarding the Courses, including through post-course surveys or otherwise (“Feedback”), Licensee hereby grants SAI a fully-transferable, royalty-free, perpetual, sublicensable, non-exclusive, worldwide license to use the Feedback without any restriction, compensation, or attribution to Licensee. By accepting such Feedback, SAI does not waive any rights to use similar or related Feedback previously known to SAI developed by employees, contractors, or obtained from other sources.

  4. LICENSEE REPRESENTATIONS AND WARRANTIES 

    1. Licensee Representations and Warranties.  Licensee represents and warrants that (i) it has the right, power and authority to enter into this Agreement and to perform its obligations hereunder; (ii) at all times, the Permitted Activities and its use of the Licensed Materials will comply with all applicable laws; and (iii) at all times, it shall comply with SAI’s Code of Ethics located at https://www.scrumalliance.org/code-of-ethics.

  5. FEES

    1. License Fees.  In consideration for the right to use the Licensed Materials and conduct the Permitted Activities, Licensee agrees to pay to SAI the fees set out in an Exhibit. Late payments of any fees to SAI will incur interest at the rate of one-and-a-half percent (1.5%) per month (or the greatest rate permitted by law) from the date such payments were originally due. Late payments of fees are a material breach of this Agreement and may result in termination of the Agreement. Failure to pay any fees when due may result in suspension of Licensee’s SAI account until payment is received. All fees paid by Licensee to SAI are non-refundable.  Payments are to be made in U.S. dollars and in accordance with SAI’s instructions. Unless otherwise stated in an attached Exhibit, all invoices are due 30 days from Licensee’s receipt of the applicable Invoice.

    2. Payments upon Expiration or Termination.  Upon expiration or termination of this Agreement, all fees shall be accelerated and shall immediately become due and payable. Neither expiration nor termination of this Agreement will relieve Licensee from paying any fees due to SAI under this Agreement. Upon any lapse and reinstatement of this Agreement for any reason, SAI may charge Licensee a reinstatement fee of up to twenty (20%) of the annual fees hereunder.

    3. Inaccurate Payments or Statements.  The receipt or acceptance by SAI of any Records, statements or fees paid hereunder shall not preclude SAI from questioning the correctness thereof at any time, and if any inconsistencies or mistakes are discovered in such statements or fees, SAI shall notify Licensee of such inaccuracies and such inaccuracies shall be rectified and the appropriate payment shall be made by Licensee within fifteen (15) days of the date that such notice of inaccuracies is sent to Licensee.

    4. Taxes. Each Party shall be responsible for its own taxes and related reporting obligations, including relating to sales, income, VST, GST, or otherwise. Each Party shall indemnify the other Party against any claims arising against it as a result of such Party’s failure to comply with its own tax or reporting obligations. 

  6. DATA PROCESSING

    1. Learner Data. Licensee will provide to SAI the name and email address of all learners who attend and successfully complete Licensee’s listed Scrum Alliance Courses (“learner data”). SAI will then directly contact those learners using the provided learner data asking them to register directly with SAI to activate certification and membership. Licensee will ensure that it has provided all necessary choice and obtained all necessary consent from the learners to disclose their learner data to SAI, and for SAI to contact them for the foregoing purpose. 

    2. SAI Obligations. With respect to the learner data it receives from Licensee, SAI agrees to (1) process the learner data only for the limited and specified purpose above; (2) notify Licensee if it makes a determination it can no longer meet its obligations under applicable data protection law with respect to the learner data; (3) not sell or share the learner data; (4) not retain, use, or disclose the learner data for any purpose, including a commercial purpose, other than the purpose specified above; (5) not retain, use, or disclose learner data outside of the direct business relationship between the parties other than for the purpose specified above; and (6) not combine the learner data with personal data that it collects from its own interaction with the learner.

    3. Independent Controllers. Each Party is an independent controller with respect to any personal data it processes in connection with this Agreement, and each Party will comply with its respective obligations under applicable data protection law with respect to such personal data. Except where prohibited by applicable data protection law, the Parties will not be deemed to be jointly processing personal data, and Licensee is solely responsible for its collection, use, and processing of learner data. To the extent SAI obtains personal data independently of the learner data it receives from Licensee (even if the name and contact information is the same), SAI may use such personal data without restriction under this Agreement in accordance with its privacy policy.

    4. European Union Personal Data. For any transfers of personal data subject to European data protection law to countries (or territories or sectors within a country) or international organizations which do not benefit from an adequacy decision under European data protection law, the Parties hereby agree to transfer the personal data pursuant to the standard contractual clauses set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj) (“Standard Contractual Clauses”), which are incorporated herein as follows:

a. Module One will apply.

b. In Clause 7 (Docking clause), the optional docking clause will apply.

c. In Clause 11 (Redress), the optional language shall not apply.

d. In Clause 17 (Governing Law), Option 1 will apply, and the member state will be Ireland.

e. In Clause 18 (Choice of Forum and Jurisdiction), the member state will be Ireland.

f. Annex I is completed as follows:

i. List of Parties: Licensee is the data exporter and SAI is the data importer. The address, contact details and activities relevant to the transfer for the data exporter and data importer are set out in this Agreement. By signing this Agreement, the data exporter and data importer will be deemed to have signed Annex I. 

ii. Description of Transfer: The required information is set out in Schedule 1 of Appendix 1. 

iii. Competent Supervisory Authority: The data exporter’s competent supervisory authority will be determined in accordance with applicable data protection law.

g. Annex II is completed as follows: The required information is set out in Schedule 2 of Appendix 1.

  1. United Kingdom Personal Data. For UK data transfers, the parties hereby agree to transfer the personal data pursuant to the Standard Contractual Clauses, subject to the UK Addendum. With respect to the UK Addendum, Table 1 is completed using the information set out in “List of Parties” above. Table 2 is completed using the version of the Standard Contractual Clauses listed above. Table 3 is completed using the information set out in “List of Parties” and “Description of Transfer” above, and in Appendix 1. Table 4 is completed so that either the data importer or data exporter may end the UK Addendum when the approved Addendum changes.

  1. INDEMNIFICATION AND LIABILITY

    1. Indemnification by Licensee.  Licensee shall defend and indemnify SAI and its licensees, and its and their affiliates, successors and officers, directors, employees, and agents, against and hold them harmless from, any and all claims, actions, liabilities, losses, and expenses of any nature (including without limitation reasonable attorney’s fees and costs) arising out of any third-party claim concerning any actual or alleged breach by Licensee or its sublicensee of any representation, warranty or covenant made in this Agreement, or otherwise arising out of Licensee or its sublicensee’s activities or omissions under this Agreement, including but not limited to claims arising from the actions or inactions of instructors with whom Licensee works; claims for damages caused by the use of the Permitted Activities; intellectual property infringement; false advertising; or any other actions of Licensee or its sublicensee whatsoever.

    2. Indemnification by SAI.  SAI shall defend and indemnify Licensee and its licensees, and its and their affiliates, successors and officers, directors, employees, and agents, against and hold them harmless from, any and all claims, actions, liabilities, losses, and expenses of any nature (including without limitation reasonable attorney’s fees and costs) arising out of any third-party claim that the Licensed Materials, when used in accordance with this Agreement, infringe third-party intellectual property.  

    3. Limitation of Liability. To the fullest extent permitted by law, SAI will not be liable to Licensee for any consequential, incidental, indirect, exemplary, special, punitive, or enhanced damages whether arising out of breach of contract, tort (including negligence), or otherwise, regardless of whether such damage was foreseeable and whether or not Licensee has been advised of the possibility of such damages.  To the fullest extent permitted by law, SAI will not be liable to Licensee for any direct damages, losses, or liabilities of any kind arising out of or relating to this Agreement. To the extent that this waiver is determined to be unenforceable for any reason, Licensee agrees that SAI’s total aggregate liability, whether in contract, tort, or otherwise, shall in no event exceed one hundred dollars ($100.00 USD).

  2. TERM, TERMINATION, AND EFFECTS OF EXPIRATION OR TERMINATION

    1. Term. The term of the Agreement shall commence on the Effective Date and shall extend for the “Term” recited in each Exhibit unless sooner terminated under the provisions herein.

    2. Termination for Breach.  Either Party shall have the right to terminate this Agreement on written notice to the other Party if such other Party materially breaches any provision of this Agreement and such material breach (if capable of being cured) is not cured within thirty (30) days of receipt of written notice describing such material breach.

    3. Termination for Insolvency.  Each Party shall have the right to terminate this Agreement immediately upon written notice to the other Party if such other Party: (a) elects to be wound-up and dissolved; (b) becomes insolvent; (c) files a voluntary petition in bankruptcy for reorganization or is adjudicated as bankrupt or insolvent; (d) has an involuntary petition under bankruptcy or insolvency law filed against it that is not dismissed within sixty (60) days.  

    4. Termination for Convenience.  In addition, either Party may terminate this Agreement or any Exhibit hereto for any reason or no reason upon sixty (60) days notice to the other Party. 

    5. Cessation of Rights.  Upon the expiration or termination of this Agreement, all rights granted to Licensee hereunder shall immediately cease and Licensee shall immediately cease all use of, and delete or otherwise destroy all copies of, the Licensed Materials. 

  3. CONFIDENTIALITY 

Licensee acknowledges that in connection with this Agreement, SAI may provide Licensee with confidential and proprietary information and materials (“Confidential Information”).  Licensee agree that, during and after the Term, they will maintain in strict confidence, and take every reasonable precaution to safeguard, the Confidential Information and that Licensee will not disclose any of the Confidential Information to any third party nor make any use of the Confidential Information except as necessary to conduct the Permitted Activities or as otherwise expressly permitted by SAI or this Agreement.

  1. MISCELLANEOUS

    1. Severability.  If any provision or provisions of this Agreement shall be determined by a court of competent jurisdiction to be illegal or unenforceable, the remaining provisions hereof shall be deemed severable and enforceable in accordance with their terms.

    2. Survival.  Any provision which must, in order to be effective, survive the termination of this Agreement shall survive termination.  

    3. Governing Law.  This Agreement and the rights and obligations of the Parties hereunder shall be governed by and construed in accordance with the internal laws of the State of New York applicable to agreements made and to be performed wholly within such State (other than the conflict of laws principles of such State to the extent the application of the laws of another jurisdiction would be required thereby). 

    4. Binding Effect.  This Agreement shall be binding upon and inure solely to the benefit of the Parties and their respective successors and assigns.  Nothing expressed or mentioned in this Agreement is intended or shall be construed to give any person other than the Parties hereto and their respective successors and assigns any legal or equitable right, remedy or claim under or in respect of this Agreement or any provision herein contained.  In the event of a conflict between this Agreement and any other agreement between SAI and Licensee, this Agreement will prevail.   

    5. No Waiver.  The failure of any Party hereto to enforce, or the delay by any Party in enforcing, any of its rights under this Agreement shall not be deemed a continuing waiver or a modification thereof and any Party may, within the time provided by applicable law, commence appropriate legal proceedings to enforce any or all of such rights.  

    6. Entire Agreement.  This Agreement contains the entire agreement between the Parties relating to the subject matter hereof and supersedes any prior oral or written understandings between the Parties relating to the subject matter hereof.

    7. Relationship of Parties.  No agency, partnership, joint venture, franchise or employment is created between the Parties as a result of this Agreement.  Neither Party shall have any power to obligate or bind the other Party in any manner whatsoever.

    8. Counterparts.  This Agreement may be executed in one or more counterparts, each of which when so executed and delivered shall be an original, but all such counterparts together shall constitute one and the same instrument.

    9. Notices.  All notices sent pursuant to this Agreement must be in writing.  Notices to SAI shall be sent to: 1580 N Logan St Ste 660, PMB 865611, Denver, Colorado 80203-1994 USA, ATTN: Legal, with a copy by email to [email protected].  The contact information for Notices for Licensee shall be as provided by Licensee to SAI from time to time. 

    10. Disputes.  The Parties agree to attempt in good faith to resolve any dispute, claim, or controversy arising out of or relating to this Agreement by negotiation.  If the Parties are unable to reach a resolution through negotiation within thirty (30) days, they shall submit the dispute to mediation under the auspices of Judicial Arbitration and Mediation Services, Inc.  (JAMS), with the mediation to take place at the JAMS office in New York, NY.  If mediation does not resolve the dispute, the matter shall be submitted to arbitration administered by the American Arbitration Association (AAA) in accordance with its applicable rules.  Each Party shall bear its own costs and expenses, including attorneys’ fees, unless otherwise awarded by the arbitrator. 

    11. Export Controls. Licensee warrants that it and its learners are not located in, under the control of, a national of, or ordinarily resident in, any country that is subject to any applicable U.S. laws and regulations, or laws of its local jurisdiction, preventing SAI from providing Licensee or its learners access to the Licensed Courses. Use of a virtual private network service, IP routing services, or other similar service for the purpose of circumventing these laws is strictly prohibited. Licensee warrants that it is not named on, or controlled by anyone named on, any government prohibited, sanctioned, debarment, exclusion, or export-controlled related restricted party list (collectively, “Sanctions Lists”). Licensee will immediately discontinue use of the Licensed Courses if You, or a party exercising control over Licensee, are placed on any Sanctions List. Licensee warrants that it will not export, re-export, or transfer the Licensed Courses to any country against which the U.S. has embargoed goods or services or to an entity or person on any Sanctions List, and will comply with all applicable U.S. Export Administration Regulations. Notwithstanding anything to the contrary herein, SAI may suspend performance of or terminate any further obligations to Licensee, effectively immediately, if Licensee is in breach of the obligations in this section or if the continued provision of Licensed Courses to Licensee may, in SAI’s sole discretion, result in our commercial or reputational harm.

 

APPENDIX 1: DATA PRIVACY SCHEDULES

Schedule 1 to Appendix 1

Details of Processing Activities

  • Subject Matter: The subject matter is the processing of personal data.

  • Duration: The duration of the processing is for the term of the Agreement.

  • Categories of Data Subjects: The categories of data subjects whose personal data is processed include students of Licensee.

  • Categories of Personal Data: The categories of personal data processed include name, email address, and other contact information provided by Licensee. 

  • Sensitive Data: There is no sensitive personal data.

  • Frequency of Transfers: The frequency of the transfer of personal data will be on a continuous basis.

  • Nature of Processing: The nature of the processing is the relationship as described in the Agreement.

  • Purpose: The purpose of the processing is for SAI to be able to allow students to activate their certifications and membership.

  • Retention: Personal data will be retained as necessary for the purpose above.


APPENDIX 1: DATA PRIVACY SCHEDULES

Schedule 2  to Appendix 1

Technical and Organizational Measures to Ensure the Security of Personal Data

This Schedule 2 describes the technical and organizational measures implemented by the receiving party to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

Minimum Technical and Organization Measures

  1. The receiving party shall implement and maintain appropriate technical and organizational measures to protect personal data against accidental loss, destruction or alteration, unauthorized disclosure or access, or unlawful destruction, including the policies, and procedures and internal controls set forth in this Schedule 2.      

  2. More specifically, the receiving party’s security program shall include, at a minimum:

Access Control of Systems and Processing Areas

The receiving party shall implement and maintain appropriate technical, physical, and organizational measures, proportionate to the sensitivity of the personal data and current industry standards, to prevent unauthorized access to systems and equipment that processes and stores personal data (including telephones, mobile devices, databases, servers, virtual machines, cloud services, and all related systems where the data is used).

Access Control to Data Processing Systems

The receiving party shall implement and maintain appropriate technical, physical and organizational measures to prevent unauthorized access to systems that process personal data, including:

  • industry-standard encryption for data in transit and at rest;

  • automatic screen lock on idle devices and session re-authentication;

  • account lockout after repeated failed login attempts, with logging and alerting for suspected intrusion attempts; and

  • logging, monitoring, and tracking of access to personal data.

Access Control to Use Specific Areas of Data Processing Systems

The receiving party shall implement and maintain appropriate measures to ensure users may access personal data only within the scope of their authorized permissions, and that personal data cannot be read, copied, modified, or removed without authorization. Measures shall include:

  • employee policies and regular training with regard to access rights to personal data;

  • unique user identification and assignment of accounts with user-specific, role-based, least-privilege access;

  • logging of create, modify, delete and access actions;

  • controlled release of data only to authorized persons, using different and role-specific access permissions;

  • industry‑standard encryption for data at rest and in transit; and

  • documented file control and secure, auditable data destruction.

Availability Control

The receiving party shall implement and maintain appropriate measures to ensure that personal data is protected from accidental destruction or loss, including:

  • infrastructure redundancy; and

  • backup is stored at an alternative site and available for restore in case of failure of the primary system.

Transmission Control

The receiving party shall implement and maintain appropriate technical and organizational measures to prevent personal data from being read, copied, altered or deleted by unauthorized parties during transmission or while media are transported. Measures shall include:

  • industry-standard protections including firewalls, VPNs and encryption technologies to protect the data in transit;

  • transfer integrity checks such as: end-to-end verifications, alerts for incomplete or failed transfers; and

  • logging key actions and active monitoring of transmissions and media movements.

Input Control

The receiving party shall implement and maintain appropriate input control measures, including:

  • a documented authorization policy for data input, access, modification and deletion;

  • unique authentication credentials for users and strong authentication controls;

  • technical protections for data in memory and storage during input, reading, modification and deleting;

  • unique role-based authentication credentials with minimal privilege;

  • locked access to data processing areas with controlled entry and access logs;

  • automatic log-off of inactive user sessions after a substantial period of inactivity; 

  • proof established within the receiving party’s organization of input authorization; and

  • electronic logging of data entry access, creation, modification and deletion events.

Separation of Processing for Different Purposes 

The receiving party shall implement and maintain appropriate measures to ensure that data collected for different purposes can be processed separately, including:

  • access controls that restrict users to purpose-specific data via application security;

  • logical separation of data by module or function so each purpose uses only necessary and designated data;

  • database-level separation, for example, distinct normalized tables or schemas per module and function; and

  • purpose-limited interfaces, batch processes and reports that restrict access to the specific intended purpose.

Documentation

The receiving party shall implement and maintain logs and information about system usage in case of audits. Employees and everyone at the receiving party’s place of work are made aware of and comply with the technical and organizational measures set forth in this Schedule 2.

Monitoring

The receiving party shall implement and maintain measures to ensure data collected for different purposes is processed appropriately, and that they act in accordance with provided instructions, including:

  • individual appointment of system administrators with documented roles and responsibilities;

  • registration and secure retention of system-administrator access logs for the infrastructure and systems;

  • regular audits of system-administrator activity to verify compliance with assigned tasks and applicable law;  and

  • maintain an up-to-date list of system administrators with identification details (name, role, organizational area) and assigned tasks.

Limits on Retention/Destruction

The Receiving Party must implement and maintain appropriate technical and organizational measures to remove user information from its systems and to securely destroy personal data in accordance with the applicable data-retention schedule. Destruction must render the data irrecoverable and may include methods such as:

  • deleting users data from systems based on user requests;

  • secure wiping through a third party disk deleting utility;

  • physical destruction of the drive, such as by degaussing, shredding, or other means of physically destroying the media (and data on the drive);

  • includes the use of a qualified third-party service provider to implement these measures; and

  • the receiving party shall document destruction actions and retain certificates of destruction where applicable.