Data Processing Information
Contact Mentrast before providing institutional information that needs a specific processing agreement, location or security commitment. The points below explain topics to confirm in writing.
1. Preamble
For personal accounts, Mentrast handles information as described in the Privacy notice. If an organization arranges access, the responsibilities of each party depend on the actual agreement. No signed institutional agreement is implied by this page.
2. Definitions
- "CCPA" means the California Consumer Privacy Act of 2018.
- "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council.
- "Personal Data" means any information relating to an identified or identifiable natural person.
- "Processing" means any operation performed on Personal Data, such as collection, recording, storage, adaptation, or destruction.
- "Subprocessor" means any third party appointed by or on behalf of Processor to process Personal Data.
3. Processing Instructions
A written arrangement should identify the purpose, scope and duration of processing, authorized instructions and the information involved. The details to discuss are summarized in Annex A.
4. Confidentiality
Access to personal information should be limited to the purpose involved and authorized people. Any additional institutional confidentiality requirements need to be confirmed in the applicable agreement.
5. Security of Processing (TOMs)
Mentrast uses authenticated access, ownership checks, restricted service credentials and encrypted network connections. Confirm any required institutional security commitments before sharing information.
6. Subprocessing
Ask the team about providers involved in your proposed use and any contractual notification requirements. Examples appear in Annex C. Provider roles and responsibilities depend on the service and written arrangement.
7. Data Subject Rights
Individuals may have rights under applicable privacy law. An institutional arrangement should explain how requests are received, verified and handled by each party.
8. Personal Data Breach
Mentrast will make legally required personal-data-breach notifications. Any additional institutional contacts, notification terms and response responsibilities should be confirmed in writing.
9. International Transfers
This page does not create transfer safeguards. Ask the team about the lawful mechanism relevant to your information, such as an adequacy decision or approved contractual safeguards.
10. Audit Rights
Any audit access, evidence or inspection rights must be established in the applicable agreement. This page does not promise an existing audit program or unrestricted access to infrastructure.
11. Liability
Responsibilities and liability depend on applicable law and the terms actually agreed. Mandatory rights cannot be removed by this informational page.
Annex A: Details of Processing
The intended learning service, features and information to be processed.
The agreed service period, deletion process and any lawful retention requirements.
The learners or other people covered by the proposed arrangement.
Annex B: Security Measures
Confirm the measures needed for your proposed use rather than assuming every control below is an existing contractual commitment:
- Identity and access: Account authentication, access scope and any required institutional identity controls.
- Service security: Ownership checks, restricted credentials and the safeguards relevant to the deployment.
- Hosting: Applicable cloud providers, processing locations and available assurance evidence.
- Incident handling: Relevant contacts, escalation responsibilities and required notifications.
- Ongoing review: Requirements for security evidence, changes and periodic review.