Data processing terms

1. Who these terms are for

These terms apply when Brutally Honest Oy (Business ID 3574434-1, Koroistentie 4 F 1, 00280 Helsinki, Finland), which operates as The Brutally Honest, processes personal data on behalf of an organisation that uses one of our platforms. That means:

• a programme, accelerator, incubator, competition or other organisation that runs its cohort on one of our assessment platforms, such as assessment.brutallyhonestmentor.com;
• an organisation for which we build and run a platform under its own name.

They form part of our agreement with that organisation and set out what Article 28(3) of the GDPR requires. In these terms, "you" means that organisation and "we" means Brutally Honest Oy. Where an agreement signed with you sets out different data processing terms, the signed agreement wins.

2. Roles and your instructions

You are the controller of the personal data processed on your platform, and we are your processor. We process it only on your documented instructions (Article 28(3)(a)). Your instructions are these terms, our agreement with you, and what your team sets up and does on the platform. That includes any transfer of the data to a country outside the EU and the EEA. If EU or Finnish law requires us to process the data in another way, we tell you before we do, unless that law forbids it.

We tell you at once if we think an instruction of yours breaks the GDPR or another data protection law.

3. The processing

Subject and purpose

Running your programme's assessment, selection and mentoring on the platform: accounts, questionnaires, scores, reports, mentor and evaluator assignments, the AI features your team switches on, and the e-mails the platform sends.

Duration

As long as our agreement runs, and then until the data is returned or deleted (section 11).

Nature

Hosting and storage, calculating scores and writing reports, AI processing of answers when your team uses the AI features, sending service e-mails, backups and support.

Types of personal data

Names, e-mail addresses and roles of the people who use the platform; startup details (company name, industry, stage, founding year, website, team size, team members and their roles); questionnaire answers, scores and reports; mentor and evaluator assignments, notes and decisions; files your team uploads; your administrators' AI Analyst conversations; sign-in and activity logs.

People concerned

Founders and team members of the startups in your programme, applicants, your staff, and the mentors, evaluators and judges you invite.

4. Data the platform is not built for

The platform does not ask for special categories of personal data (Article 9), such as health data, or for data on criminal convictions (Article 10). Please ask the people you invite not to type such data into free text fields.

5. Confidentiality

Everyone at Brutally Honest Oy who can access the data is bound to keep it confidential, by contract or by law (Article 28(3)(b)). We give access only to the people who need it to run and support your platform.

6. Security

We take the measures Article 32 requires (Article 28(3)(c)). Today they are:

• encrypted connections between browsers, the platform and the services it uses;
• database access rules for each role, so that each person reaches only what their role allows;
• two-step sign-in for the platform's super administrators;
• an audit log of administrator actions.

We review these measures when the platform changes, and we tell you when a change lowers the protection.

7. Sub-processors

You authorise us to use the services listed as sub-processors for your platform (Article 28(2)). For our assessment platforms, that is the list on the brutallyhonestmentor.com Sub-processors page. For a platform we run under your name, it is the list we give you when we set the platform up.

• We tell you by e-mail at least 30 days before we add or replace a sub-processor, and we update the dated list the same day.
• You can object within those 30 days. If we cannot meet the objection, you can end the affected service, and we refund the fees you paid in advance for the time after it ends.
• Each sub-processor is bound by data protection duties that are the same as ours under these terms, and we stay fully liable to you for its work (Article 28(4)).

8. Transfers outside the EU

Some sub-processors are based in the USA. For each transfer outside the EU and the EEA we rely on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework while the recipient remains certified under it, or on the Commission's Standard Contractual Clauses. Write to team@thebrutallyhonest.co for a copy of the safeguard that applies.

9. Help with people's requests

If someone asks us directly to see, correct, delete or move their data on your platform, we pass the request on to you without answering it ourselves, unless you tell us to. We help you answer such requests with the platform's tools and, where those are not enough, by hand (Article 28(3)(e)).

10. Breaches and other help

If a personal data breach affects your data, we tell you without undue delay after we become aware of it (Article 33(2)). We tell you what we know at that point and send the rest as we learn it (Article 33(3) and (4)).

We also help you with your own duties under Articles 32 to 36, such as security, breach notices and data protection impact assessments, taking into account what we process and the information we have (Article 28(3)(f)).

11. When the service ends

When the service ends, you choose whether we return the data to you in an export or delete it, and we do so within 30 days. We then delete the copies we hold, except what EU or Finnish law makes us keep, such as our accounting records (Article 28(3)(g)). Any copy in our hosting provider's backups is deleted when that backup expires.

12. Information and audits

We give you the information you need to show that these terms are met. You, or an auditor you appoint who is bound to confidentiality, can audit our processing once a year on 30 days' written notice, at your cost, and sooner after a breach that affects your data (Article 28(3)(h)).

13. Our own use

We never use your platform's data for our own purposes. It does not enter the benchmark of assessment results on our own platforms, and we do not train AI models on it. We keep a record of the processing we carry out for you (Article 30(2)).

14. Changes and contact

If we change these terms in a way that matters to you, we tell you by e-mail at least 30 days before the change applies, and the date at the top of this page shows the current version. Questions: team@thebrutallyhonest.co, or Brutally Honest Oy, Koroistentie 4 F 1, 00280 Helsinki, Finland.

What we do with the personal data of our own visitors and customers is in our Privacy Policy, and the services we use are on the Sub-processors page.