Privacy

2A. European Economic Area, United Kingdom, and Switzerland

This section applies if you are in the European Economic Area, the United Kingdom, or Switzerland. It supplements Part 1 and is provided under the EU General Data Protection Regulation, the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection.

Controller and processor

For personal data processed through the platform (your account, your survey responses, scopes of work, rate cards, and the audit records attached to them), the organization that gave you access is the controller, and Alliansis Inc. is a processor acting on its documented instructions under Article 28 GDPR. That organization is responsible for telling you what it collects and why, for choosing the legal basis, and for deciding on requests you make about your data. We will assist it in doing so.

Alliansis Inc. is the controller for our marketing website, enquiries sent to us, billing records for the organizations we contract with, and the security and system logs we keep to operate and protect the service.

Legal bases

Where Alliansis acts as controller, we rely on:

– Legitimate interests (Article 6(1)(f)): to operate, secure, and improve the service, to maintain the integrity of audit records, and to establish, exercise, or defend legal claims.

– Performance of a contract (Article 6(1)(b)): to administer subscriptions and provide contracted services.

– Legal obligation (Article 6(1)(c)): where a law requires us to retain or disclose data.

We do not rely on consent as the basis for processing platform data, because you use the platform in the course of your employment rather than as a matter of personal choice. This means there is no consent for you to withdraw, and it is also why a request about your data is normally a matter for the organization that gave you access.

Your rights, and how they apply here

You have the right to request access to your personal data, and its rectification or erasure; to restrict or object to processing; and to data portability. You may exercise these against the controller, normally your own organization, and we will support it. You can also write to us at [email protected] and we will route your request.

Two limits are especially relevant on this platform:

– Erasure is not absolute. Under Article 17(3), the right to erasure does not apply where processing is necessary for compliance with a legal obligation, or for the establishment, exercise, or defense of legal claims. Records showing who approved a scope of work, who changed a commercial value, or who submitted an evaluation may fall within that exception, because they may be required as evidence in a contractual or employment dispute. Where a controller relies on this, it must be able to justify it and must keep the record only for as long as such a claim remains realistically possible.

– Restriction as an alternative to erasure. Under Article 18, personal data can be restricted rather than erased. Restricted data is stored but not otherwise processed, except with your consent, for the establishment, exercise, or defense of legal claims, or on the other limited grounds set out in Article 18(2). In practice this means the record is taken out of everyday use and reporting while remaining retrievable if a dispute arises. Where a full erasure is not available, we support restriction as the alternative.

Replacing your name and email address with a placeholder reduces how visible you are, and we can do that on a controller’s instruction. It is pseudonymization, not anonymization: because the underlying link has to be preserved for the audit record to serve its purpose, the data remains personal data under Recital 26 GDPR, and your rights continue to apply to it.

Automated decision-making. The service includes AI-assisted analysis, summary, and reporting features. Their output is analysis for review by people at your organization. We do not carry out automated decision-making, including profiling, that produces legal or similarly significant effects concerning you within the meaning of Article 22 GDPR.

International data transfers

Your data is primarily processed in the United States. For transfers of personal data from the European Economic Area, the United Kingdom, or Switzerland, we rely on our certification under the EU-U.S. Data Privacy Framework and the UK Extension to the EU-U.S. Data Privacy Framework (see below), and on Standard Contractual Clauses (SCCs) approved by the European Commission, together with the UK International Data Transfer Addendum, along with supplementary measures where required. Our Transfer Impact Assessment, which documents these safeguards and supplementary measures, is available to customers on request.

EU-U.S. Data Privacy Framework and UK Extension 

Alliansis Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF as set forth by the U.S. Department of Commerce. Alliansis Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, please visit https://www.dataprivacyframework.gov/. To view our certification, please visit the Data Privacy Framework List at https://www.dataprivacyframework.gov/list.

Scope of our certification. Alliansis Inc. has no U.S. subsidiaries or affiliated entities covered by this certification, and has no establishment in the European Union. Alliansis Inc. commits to subject to the EU-U.S. DPF Principles all personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom in reliance on the UK Extension to the EU-U.S. DPF. Our certification does not cover human resources data, because we have no personnel in the European Union or the United Kingdom.

Personal data covered. The personal data we receive from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom in reliance on the UK Extension to the EU-U.S. DPF comprises account identifiers (name, business email address), business contact data (job title and organization), authentication data, technical identifiers such as IP address and session identifiers, activity and audit logs recording who took which action, responses to business relationship surveys, and any personal data our customers include in the scopes of work and supplier rate cards they manage on our platform. That may include the names, roles, and seniority of individuals identified as assigned resources, together with the rates and time allocations attributed to them. We collect and use this data to provide, maintain, secure, and support our service, as described elsewhere in this policy.

Onward transfers and our liability. We disclose personal data to the types of service providers listed under Information Sharing, each of which acts as our agent under contract. Where we transfer personal data received in reliance on the EU-U.S. DPF or the UK Extension to the EU-U.S. DPF to a third party acting as an agent on our behalf, we remain liable under the EU-U.S. DPF or the UK Extension to the EU-U.S. DPF Principles if that agent processes the data in a manner inconsistent with the Principles, unless we prove that we are not responsible for the event giving rise to the damage.

Lawful requests by public authorities. We may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Your right of access. If you are an EU or UK individual whose personal data we received in reliance on the EU-U.S. DPF or the UK Extension to the EU-U.S. DPF, you have the right to access the personal data we hold about you, and to have it corrected, amended, or deleted where it is inaccurate or has been processed in violation of the EU-U.S. DPF or the UK Extension to the EU-U.S. DPF Principles. Access may be limited where the burden or expense of providing it would be disproportionate to the risks to your privacy, or where the rights of other people would be violated. See Your Rights in Part 1, or email [email protected].

How to raise a complaint. In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, Alliansis Inc. commits to resolve DPF Principles-related complaints about our collection or use of your personal data transferred to the United States in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. European Union and United Kingdom individuals with such inquiries or complaints should first contact Alliansis Inc. at [email protected]. We will respond to you within 45 days of receiving your complaint.

Independent recourse mechanism. Alliansis Inc. has further committed to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF to an independent dispute resolution body, at no cost to you.

For personal data received from the European Union, the designated body is the panel established by the European Union data protection authorities (the DPA Panel), the first of the three types of independent recourse mechanism recognized by the EU-U.S. DPF Principles. For personal data received from the United Kingdom and Gibraltar in reliance on the UK Extension to the EU-U.S. DPF, the designated body is the UK Information Commissioner’s Office and, where applicable, the Gibraltar Regulatory Authority.

Alliansis Inc. commits to cooperate with the DPA Panel and with the UK Information Commissioner’s Office, and to comply with the advice given by them. If you do not receive timely acknowledgment of your complaint from us, or if we have not resolved your complaint to your satisfaction, please contact your local data protection authority, which will refer the matter to the DPA Panel. Contact details for European Union data protection authorities are available at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. The UK Information Commissioner’s Office can be contacted at https://ico.org.uk/make-a-complaint/. These services are provided to you at no cost.

Regulatory oversight. Alliansis Inc. is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC).

Binding arbitration. Under certain conditions, more fully described on the Data Privacy Framework website at https://www.dataprivacyframework.gov/, you may be able to invoke binding arbitration when other dispute resolution procedures have been exhausted.

Complaints to a supervisory authority

You have the right to lodge a complaint with a supervisory authority. In the EEA this is the data protection authority of the country where you live or work, or where the alleged infringement took place. In the United Kingdom it is the Information Commissioner’s Office (https://ico.org.uk/). In Switzerland it is the Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch/).

Switzerland

If you are in Switzerland, this policy should be read with the Swiss Federal Act on Data Protection. References to the GDPR should be read as references to the equivalent provisions of Swiss law, references to the EEA include Switzerland, and the supervisory authority is the Federal Data Protection and Information Commissioner. Transfers of personal data from Switzerland to the United States are made under the Standard Contractual Clauses with the adaptations set out by the Federal Data Protection and Information Commissioner.

United Kingdom

If you are in the United Kingdom, references to the GDPR should be read as references to the UK GDPR and the Data Protection Act 2018, the supervisory authority is the Information Commissioner’s Office, and transfers to the United States are made under our certification to the UK Extension to the EU-U.S. DPF and under the SCCs as supplemented by the International Data Transfer Addendum.

2B. California

This section applies if you are a California resident. It supplements Part 1 and is provided under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”).

California privacy law applies to personal information collected in a business-to-business context, so it applies to you even though you use the platform through your employer.

Our role. For personal information processed through the platform, Alliansis acts as a service provider to the organization that gave you access. We process that information only to perform the services set out in our written agreement with that organization, and for no other purpose. If you want to exercise your rights over that information, the organization that gave you access is the business responsible, and you should direct your request to it. We will assist it in responding.

We do not sell or share your personal information as those terms are defined by the CCPA, and we have not done so in the preceding twelve months. We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA.

Categories of personal information we collect. Identifiers (name, email address, IP address, account identifiers); professional or employment-related information (job title, employer, role, and where a customer records it, rates and time allocations); commercial information (scopes of work, rate cards, and their values); internet or network activity (usage and audit logs recording your actions); and the contents of survey responses and free-text commentary you submit. We collect these for the business purposes described in How We Use Your Information, and we retain them as described in Data Retention.

Your California rights. You have the right to know what personal information is collected, used, disclosed, or sold or shared; to request correction of inaccurate personal information; to request deletion; to limit the use of sensitive personal information; and not to receive discriminatory treatment for exercising any of these rights.

Limits on deletion. The CCPA permits a business or its service provider to retain personal information despite a deletion request in a number of circumstances, including where it is necessary to complete a transaction, to detect or resist fraudulent or illegal activity, to exercise or ensure another’s right to exercise free speech, to comply with a legal obligation, or otherwise for internal uses reasonably aligned with your expectations given the relationship. Audit and attribution records described in Part 1 will generally fall within one or more of these.

How to make a request. Email [email protected]. We will verify your request and respond within the time the CCPA allows. You may use an authorized agent, and there is no charge.

2C. Other U.S. states

If you are a resident of another U.S. state with a comprehensive privacy law, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana, among others, you may have rights to access, correct, delete, and obtain a copy of your personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling. We do not sell personal data, do not use it for targeted advertising, and do not carry out profiling that produces legal or similarly significant effects.

As with the regions above, for data processed through the platform the organization that gave you access is the controller and we act as its processor, so requests are normally directed there. You may also email [email protected] and we will route your request. If we deny a request, you may appeal by replying to our response; where your state provides one, you may also complain to your state attorney general.