Data Processing Agreement

1. Parties, scope and roles

This agreement supplements the hilighter Terms between SkillsBoard SAS, 509 avenue des Églantines, 62176 Camiers, France, RCS Boulogne-sur-Mer 978 379 709 (the “Processor”), and the contracting Customer Organization (the “Controller”) in respect of personal data processed by SkillsBoard on the Organization's behalf in its workspace. It satisfies the requirements of GDPR Article 28(3). It does not apply to SkillsBoard's separate-controller activities concerning independent personal accounts, personal portfolios, its own contractual administration, security or optional direct marketing; those are covered by the Privacy Policy and separate lawful grounds. This DPA prevails over the general Terms on processor matters.

2. Instructions and purposes

The Processor shall process personal data only on documented instructions from the Controller, including workspace configuration, authorized access and written instructions within the Service, unless otherwise required by applicable law, in which case the Processor informs the Controller to the extent lawful. The Processor informs the Controller if an instruction appears to infringe data protection law. The Controller determines the legal basis, lawful purposes and retention of its employee assessments and complies with employment law, transparency and employee representative obligations.

3. Processing particulars – Schedule I

Subject matter: hosted skills, roles, evidence, learning, assessments and team analytics. Duration: while the organizational workspace and contractual exit period exist, subject to lawful retention. Operations: collection, storage, structuring, authorized access, comparison, AI-assisted generation of suggested ratings, backup, correction, export and erasure. Purposes: workforce competence and development activities specified by the Controller, not SkillsBoard's own partner marketing. Data subjects: personnel, managers, administrators, contractors, lawful candidates and persons incidentally described in evidence. Data types: business identifiers and contact details, job assignment, role and skill descriptions, performance evidence, self and manager ratings, levels, learning histories, evaluator identity, voluntarily supplied CV/LinkedIn information and relevant technical metadata. GDPR Article 9 special-category data must not be deliberately entered without a specific lawful condition, explicit instructions and additional safeguards.

4. Authorized personnel and confidentiality

The Processor will restrict access to staff and contractors requiring it to provide the Service and subject to a confidentiality undertaking or statutory duty, with appropriate access management and withdrawal procedures. The Controller manages the permissions of its own staff, administrators and devices.

5. Security – Schedule II

SkillsBoard applies risk-appropriate GDPR Article 32 controls and the technical measures in Schedule II. Observed controls: AWS infrastructure in France; ALB TLS 1.3; access and network restrictions, Secrets Manager and AWS administrator IAM/MFA; logical organization-level permissions in a shared database; CloudWatch/Sentry monitoring; daily database backups retained 30 days; CloudWatch production logs 30 days, nonproduction 7 days. Application-user MFA is not yet deployed; security audit trails are partial, restoration testing is manual, vulnerability processes are partly automated and no formal incident-response playbook has been evidenced. Planned controls are not promised as implemented, and material degradation of protection requires appropriate notice/remediation.

6. Subprocessors – Schedule III

The Organization grants general authorization for subprocessors identified on a versioned list. Material changes are notified normally 30 days in advance and may be objected to on reasonable data-protection grounds. Relevant providers include AWS (hosting, data, service email), OpenAI (AI API) and Sentry (error diagnostics potentially containing identifiers). The precise contracting entities, locations and transfer mechanisms must be documented. LinkedIn, Google analytics tools, Clarity, reCAPTCHA and Brandfetch require role analysis per purpose: being named in the Privacy Policy does not automatically make each an Organization subprocessor. SkillsBoard requires Article 28-equivalent obligations and remains responsible as prescribed by GDPR.

7. International transfers

AWS core hosting is in France, but the OpenAI API project currently uses Global residency. Inputs including professional skills and evidence may therefore be processed outside the EEA. International transfers require a valid GDPR Chapter V mechanism (adequacy or relevant SCCs) and necessary assessment and supplementary measures. SkillsBoard must document OpenAI's contractual entity, DPA incorporation, subprocessors, training opt-in settings and response-storage settings. AWS EU hosting is not a guarantee of EU-only OpenAI inference.

8. Assistance and data-subject rights

Taking into account the nature of processing and information available, SkillsBoard reasonably helps the Controller fulfil data-subject access, correction, erasure, objection, portability, restriction and GDPR security, breach notification, DPIA and prior-consultation duties. Requests addressed to SkillsBoard concerning organization-controlled records will be promptly referred to the Controller unless unlawful. Requests about SkillsBoard-controlled independent personal portfolios will be addressed by SkillsBoard itself.

9. Personal data breaches

The Processor notifies the Controller without undue delay after becoming aware of a personal data breach concerning processed customer records, providing available details of affected data and persons, likely consequences and remedial measures. Further information may follow in phases. The Controller remains responsible for required notifications to regulators and affected persons, with Processor assistance. Both parties inform one another of incidents with shared impact.

10. Verification and audits

The Processor shall make available information reasonably necessary to demonstrate Article 28 compliance and permit legally required audits under appropriate confidentiality, advance notice and third-party data protection. Existing independent reports and attestations may be offered first where sufficient. Exceptional assistance costs may be agreed in advance without limiting mandatory audit rights.

11. Termination, return and deletion

On termination, authorized Organization representatives may request export or deletion of the Organization-controlled data via contact@hilighter.io. SkillsBoard verifies authority and separates employer confidential records from independent personal portfolios. Subject to applicable switching laws and justified exceptions, the target is 30 days for secure structured export (e.g. CSV/JSON and permissible files) or eligible active deletion. Daily backups expire after 30 days. S3 files have no verified global automatic expiry, so object deletion must be expressly run and tested. Backup restoration must replay deletion requests. An employee's independent personal account is not deleted merely because the employer terminates.

12. No separate marketing reuse or unauthorized AI training

SkillsBoard shall not repurpose records received solely as processor for SkillsBoard's own or partners' marketing or ad targeting, even if an employee opts into personal marketing emails. Any different purpose requires an appropriate independent legal basis and authorization. The Processor will not intentionally instruct an AI provider to train its models on Controller data without specific instructions, lawful grounds and safeguards; SkillsBoard keeps the live API settings under internal review.

13. Governing law and acceptance

French law governs this DPA insofar as permitted by EU law. The DPA remains binding while SkillsBoard processes Controller personal data and may be accepted electronically by an authorized representative. The French version prevails.

---

Schedule II – Observed technical and organizational measures

Schedule III – Provisional subprocessor register

Related documents

• Privacy Policy
• Legal Notice
• Terms of Use and Sale
• Cookie Policy