Data processing agreement
Terms governing CMS Global's processing of personal data on behalf of a customer.
This Data Processing Agreement (DPA) applies where a customer institution (the "Customer") uses IdeaScore to collect and process personal data of applicants, evaluators and other individuals in connection with a programme. It forms part of the agreement between the Customer and CMS Global and sets out how CMS Global processes that data.
1. Roles
1.1 For programme data, the Customer is the Data Fiduciary (controller) and determines the purposes and means of processing, including which fields an application form collects and who may evaluate it.
1.2 CMS Global is the Data Processor and processes personal data only on the Customer's documented instructions, including as set out in this DPA and the Customer's configuration of the platform.
1.3 Where the Customer self-hosts IdeaScore on its own server, CMS Global processes personal data only to the extent it provides support services the Customer has requested.
2. Instructions
2.1 CMS Global will process personal data only to provide the platform, follow the Customer's configuration choices (form fields, roles, rubrics, retention settings), and comply with applicable law.
2.2 If an instruction would, in CMS Global's reasonable view, breach applicable data protection law, CMS Global will notify the Customer before carrying it out.
3. Sub-processors
3.1 CMS Global may engage sub-processors to provide the platform: categories include a hosting provider, an email delivery provider, and an error-monitoring provider. Named sub-processors are listed on the Trust page. // PLACEHOLDER: sub-processor names to be confirmed by the owner.
3.2 CMS Global remains responsible for a sub-processor's compliance with the data protection obligations in this DPA and will notify the Customer of a material change to its sub-processors.
4. Security measures
4.1 CMS Global implements the technical and organisational measures described on the Security page, including role-based access with organisation isolation, encryption in transit, encrypted and scheduled backups, an audit log of administrative actions, rate limiting, and staged deployments using sanitised data.
4.2 CMS Global does not currently hold SOC 2 or ISO 27001 certification and will update this section and the Security page if that changes.
5. Personal data breach
5.1 CMS Global will notify the Customer without undue delay, and in any event within 72 hours of becoming aware, of a personal data breach affecting the Customer's programme data, together with the information reasonably available to enable the Customer to meet its own notification obligations.
6. Audits
6.1 On reasonable written notice, and no more than once per year unless required by a regulator or following a breach, the Customer may request evidence of CMS Global's compliance with this DPA, such as the security measures described in section 4. CMS Global will provide relevant documentation and, where a physical or technical audit is necessary and proportionate, reasonably cooperate with it.
7. Location of processing
7.1 For CMS Global's cloud service, data is hosted in India by default. A Customer that requires data to remain within its own premises or a specific jurisdiction may self-host IdeaScore on its own server, in which case CMS Global does not hold the underlying data at rest.
8. Return and deletion of data
8.1 On termination of the underlying agreement, or earlier on the Customer's written request, CMS Global will make the Customer's data available for export and will delete it in accordance with the retention period described in the Privacy policy, unless retention is required by law.
9. Liability
9.1 Liability under this DPA is subject to the limitations of liability set out in the Terms of service.
10. Contact
10.1 Questions about this DPA can be sent to privacy@ideascore.online.