Data Processing Agreement
The terms under which Niceplace processes your students' and contacts' personal data on your behalf.
This is a translation. If it differs from the Spanish version, the Spanish version prevails.
01 Parties and purpose
This agreement is part of the Terms of Service and applies when Niceplace processes personal data on your behalf, in compliance with Article 28 of the General Data Protection Regulation (GDPR) and equivalent laws in other countries.
You are the controller and Niceplace is the processor. If you need a signed copy, write to us and we will send it.
02 What data and for what
| Item | Detail |
|---|---|
| People | Your students, members, contacts, buyers and visitors to your site. |
| Data | Identification and contact details, payments, progress and grades, messages and posts, conversations with the guide, technical data. |
| Sensitive data | We don't ask for it. If you upload it, you are responsible for having a legal basis to do so. |
| Purpose | Providing the contracted service: hosting your site and campus, managing enrollments and payments, sending emails on your behalf, answering with the guide and showing you analytics. |
| Duration | While you have the account, plus the deletion period described in this agreement. |
03 Our obligations
- Process the data only according to your instructions, which are the terms and the settings you choose in the product.
- Make sure the Niceplace people with access are bound by confidentiality.
- Apply the security measures described in Security.
- If you can't handle a student's rights request with Niceplace's tools, help you on request, within reason.
- Use your students' data only to provide the service to you, without selling it.
We may use technical and usage data from the service, in aggregated or anonymized form, to operate, protect and improve Niceplace.
04 Subprocessors
You authorize us to use providers in the categories published in Providers that process data. The list with each one's name is available on request. Each of them has signed obligations with us equivalent to those in this agreement.
When we add or change a provider, we update that list. If you have a well-founded data protection concern, you can object in writing within 7 days of the change. In that case, your only option is to stop using the service and cancel your plan, with no refund of amounts already paid.
05 Security breaches
If we detect a breach affecting your students' data, we notify you without delay and within 48 hours at most, with what we know: what happened, what data and how many people are affected, and what we are doing. That way you can notify the authority within the 72 hours the law requires.
06 International transfers
When a subprocessor handles data outside the European Economic Area, we do it with the safeguards described in the Privacy Policy. This agreement incorporates the European Commission's standard contractual clauses, processor-to-processor module, where needed.
07 Audits
We give you the information needed to show that we comply with this agreement. If an authority requires it or you have concrete signs of non-compliance, you can request an audit with 30 days' notice, once a year, at your cost and with an auditor bound by confidentiality.
08 At the end
When you close your account, we delete your students' data as described in Data deletion, except what the law requires us to keep. Before that, you can download your contacts and files.