Data Protection

The principle

Institutional data belongs to the institution. Student learning data and profile data belong to the student.

The dividing line is aggregation. Anything that only has meaning across a group of students is the institution's: cohort views, departmental analytics, placement analytics, institution level scores and curriculum comparisons. Anything about one student is hers: her own scores, her career paths, her gap analysis, her learning history, her documents, her resumes and her interview records.

We hold both. We own neither.

What follows from it

• For the data protection officer: student personal data is the student's, and she can obtain a copy of it and take it with her. That is the posture data protection law expects, rather than one added afterwards.
• For the institution: its analytics remain its own. Nothing is held hostage at the end of an agreement, and the exit terms in section B10 say exactly what happens.
• For the security reviewer: each institution runs in its own isolated environment, on its own subdomain, with its own database. Every request resolves to one institution before any data is touched.

There is no self signup, and it matters here

No individual can create a Career Launchpad account. There is no registration form, no individual trial and no route in that does not run through an institution. Users are provisioned by the institution inside its own environment.

This answers the question every institutional reviewer asks in some form: what stops our students' data mixing with the consumer product. The answer is that there is no door. The consumer SkillDrift platform at skilldrift.ai is a separate product with a separate database and a separate user base, and no student record moves between them by any automatic route.

The one path that exists runs in the other direction and is controlled by the student herself. She may export her profile and, at her own initiative, upload it into the consumer product to seed a new profile there. It is a handover and not a synchronisation, it carries her data only and nothing institutional, and the institution is not party to it.

Where artificial intelligence sits

Artificial intelligence is used to produce narrative, career matching, gap analysis, learning plans, audio summaries, job fit explanations, interview simulation and coaching, and drafted documents.

It is deliberately kept out of the outputs an institution makes decisions on:

• The Career Readiness Score is computed deterministically in the backend from measured components. It is reproducible, and it is not a language model's rating of a student.
• The stated reason for a change in that score is derived from the change in those components.
• Cohort level views are built from underlying responses with no model in the path.
• Institution level interpretation is generated from aggregated information, with no student data reaching the model, and the figures on those screens are computed in the backend rather than generated.

Two further controls apply wherever a model is used. Direct identifiers are removed before content is sent to a model provider, so the provider receives the substance without the person's identity attached. And model providers are contractually prohibited from using anything sent to them to train their own models.

Artificial intelligence on this platform is assistive and explainable. It does not make an autonomous decision on a high stakes outcome for any student. No decision producing legal effects, or similarly significant effects, is taken by automated means alone.

Roles of the parties

The institution is the controller. SkillDrift is the processor. Our subprocessors are subprocessors.

Where SkillDrift processes personal data for its own purposes, for example the contact details of the institution's staff for contract administration, SkillDrift is a controller for that limited processing and our Privacy Policy applies to it.

Each party complies with the data protection law applicable to it.

Subject matter, duration, nature and purpose

SkillDrift processes personal data only to provide the platform to the institution and its users, to support and secure it, and as otherwise instructed in writing by the institution.

Processing lasts for the term of the software usage agreement and for the deletion period in section B10.

The categories of data subjects and personal data are in Annex I.

Instructions

SkillDrift processes personal data only on the institution's documented instructions, which are the software usage agreement, this document, and the configuration the institution sets in its own environment.

SkillDrift tells the institution if, in its opinion, an instruction breaches applicable data protection law, and may pause the instruction until it is resolved.

Where law requires SkillDrift to process for another reason, SkillDrift informs the institution before processing unless that law prohibits it.

Confidentiality and personnel

Access by SkillDrift personnel is limited to those who need it to perform the agreement. Those people are bound by confidentiality obligations that survive the end of their engagement, receive data protection training, and act under access controls with administrative actions logged.

Security

SkillDrift implements and maintains the technical and organisational measures in Annex II.

The institution is responsible for the security decisions inside its own environment: who it provisions, what permissions it grants, which integrations it enables, and how it manages its own identity provider.

Subprocessors

The institution gives general authorisation for SkillDrift to appoint subprocessors, subject to the following.

• SkillDrift maintains a current list of subprocessors, with the role, the processing carried out and the country of each, and provides it to the institution on request. Annex III describes the categories and how to obtain the named list.
• SkillDrift gives the institution at least 30 days notice before adding or replacing a subprocessor.
• The institution may object on reasonable data protection grounds within that period. The parties will work in good faith to resolve the objection, and where it cannot be resolved the institution may terminate the affected part of the service without penalty for the unused remainder of its term.
• SkillDrift imposes on each subprocessor obligations no less protective than these terms, and remains fully liable to the institution for the performance of each subprocessor.

Assistance with data subject rights

Where a student or other data subject makes a request directly to SkillDrift, SkillDrift does not respond substantively. It refers the request to the institution promptly and supports the institution in answering it.

The platform provides the institution with the ability to access, correct, export and delete individual records in its environment, and provides the student with the ability to export her own profile. Where the institution needs assistance beyond those functions, SkillDrift provides it, taking into account the nature of the processing.

Personal data breach

SkillDrift notifies the institution without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting the institution's personal data.

The notification describes the nature of the breach, the categories and approximate number of records affected, the likely consequences, the measures taken or proposed, and a contact point. Where full detail is not available at once, it is provided in phases as it becomes available.

SkillDrift assists the institution with its own notification obligations to regulators and to affected individuals. SkillDrift does not notify an institution's regulators or students on its behalf unless the institution instructs it to.

Impact assessments and prior consultation

SkillDrift provides reasonable assistance with data protection impact assessments and any prior consultation with a supervisory authority, taking into account the nature of the processing and the information available to it.

Return and deletion

On the end of the software usage agreement, and at the institution's choice:

• SkillDrift makes the institution's data available for export in a structured, commonly used and machine readable format for 30 days after the end date. During that window the environment is readable but frozen, so that no further users are provisioned into a deployment that has ended.
• SkillDrift deletes the institution's personal data from live systems within 30 days of the close of that export window. Deletion from backups occurs within the ordinary backup retention cycle of 30 days.

SkillDrift may retain personal data where applicable law requires it, and in that case continues to protect it under these terms and processes it only for the purpose that requires its retention.

SkillDrift may retain aggregated information that cannot identify any individual or institution.

On request, SkillDrift certifies deletion in writing.

Audit and information

SkillDrift makes available to the institution the information reasonably necessary to demonstrate compliance with these terms, including its higher education vendor security assessment and any third party audit reports it holds.

Where that information is not sufficient, the institution may audit, once in any twelve month period, on at least 30 days written notice, during business hours, subject to confidentiality, and without access to any other customer's data or environment. A regulator with jurisdiction may audit as its law requires.

Where the institution requires an audit beyond the annual audit, the parties agree reasonable costs in advance.

International transfers

Where personal data is transferred to a country whose law restricts transfers, the transfer is made under an approved mechanism.

The parties adopt the European Commission's standard contractual clauses, module two, controller to processor, which are incorporated by reference and completed by the annexes to this document. Where the United Kingdom is involved, the United Kingdom international data transfer addendum applies to those clauses. Where the transfer originates in Switzerland, the clauses are read with the amendments the Swiss authority requires.

Where the institution requires a specific hosting region, it is recorded in the order form and section B13 applies.

Residency and deployment

Environments are hosted in Singapore unless another region is agreed in the institution's order form. Other regions are supported where an institution's own requirement calls for one.

Three deployment shapes are supported:

• Hosted by SkillDrift, with the institution on its own subdomain and its own isolated database.
• Deployed on the institution's own infrastructure, with the generative components operated by SkillDrift.
• Deployed on the institution's own infrastructure, with the generative components operated by the institution using its own model provider.

The commercial and technical terms of an on premises deployment are agreed in the order form. Where the institution operates the generative components itself, SkillDrift is not the processor for that processing.

Precedence and liability

These terms prevail over any conflicting term in the software usage agreement on the subject of data protection. Liability under these terms is subject to the limitations in the software usage agreement and in our Terms of Use, except where applicable law does not allow it.

Family Educational Rights and Privacy Act, United States

Where an institution in the United States is subject to the Family Educational Rights and Privacy Act, SkillDrift acts as a school official with a legitimate educational interest, performing a service the institution would otherwise perform with its own employees.

On that basis:

• SkillDrift uses education records only to provide the platform to the institution, and for no other purpose.
• SkillDrift is under the direct control of the institution with respect to the use and maintenance of education records.
• SkillDrift does not redisclose education records except as the institution directs or as the Act permits.
• Education records remain the institution's, and the deletion and return terms in section B10 apply to them.

The institution remains responsible for its own annual notification, for its directory information designations, and for responding to a parent or eligible student exercising a right of access or amendment. SkillDrift supports it in doing so.

European Union and United Kingdom

The institution is the controller and SkillDrift is the processor, as set out in Part B. Transfers are handled under section B12, and institutions should note that the default hosting region is Singapore, so the standard contractual clauses apply to a European deployment unless another region is agreed.

Students retain every right the General Data Protection Regulation and the United Kingdom General Data Protection Regulation give them, and those requests are answered by the institution with our support.

No decision based solely on automated processing that produces legal effects, or similarly significantly affects a student, is taken on the platform. See section A4.

Other jurisdictions

The platform is deployed globally, and the following are addressed in the institution's own agreement where they apply: the Personal Data Protection Act in Singapore, the Digital Personal Data Protection Act in India, Australian privacy law, Canadian federal and provincial privacy law, and applicable state privacy and student privacy laws in the United States.

Where an institution's national law imposes a specific requirement, such as local hosting or a specific breach notification period, it is recorded in the order form and prevails for that institution.

Vendor security assessment

The higher education vendor security assessment, commonly known as HECVAT, is provided to an institution on request during procurement and in any event before signature, together with our security documentation.

Description of the processing

Categories of data subjects

• Students provisioned by the institution.
• Administrators and staff provisioned by the institution.
• Institutional contacts named in the agreement.

Categories of personal data

• Identity and account data: name, institutional email address, institutional identifier, department, programme, cohort, year, role and permissions.
• Profile data entered by the student or extracted from a document she uploads.
• Documents uploaded by the student, such as resumes, transcripts and certificates.
• Academic data provided by the institution or entered by the student, such as a grade band on the institution's own grading scale.
• Assessment responses, including written responses, and the scores derived from them.
• Voice data where voice features are enabled and used. The audio is discarded once processed. What is retained is the transcript and the derived analysis.
• Interview practice sessions, transcripts and coaching feedback.
• Career and learning data: paths, gap analysis, plans, completions, knowledge check results, saved jobs, job matches, tailored documents.
• Usage, progress and engagement data, including quality signals about how an attempt was completed.
• Placement data recorded by the institution, such as pipeline stage and outcome.
• Communications and support records.
• Technical, log, security and audit data.

Special categories of personal data

None are requested by the platform. The institution is responsible for not instructing the processing of special category data, and students are asked not to include it. Where a student volunteers such information in free text or in a document, it is processed as ordinary platform content under these terms.

Frequency: continuous for the term of the agreement.

Nature and purpose: hosting, storage, computation, analysis, generation of platform outputs, support and security, all for the purpose of providing the platform.

Duration: the term of the agreement, plus the deletion period in section B10.

Technical and organisational measures

• Tenancy isolation. Each institution has its own environment, its own subdomain and its own isolated database. Every request resolves to a single institution before data is accessed.
• Access control. Role based access control enforced at the interface layer of the application rather than only in the user interface, with granular roles configurable by the institution.
• Administrative access. Protected by a one time passcode sent to the administrator's registered email address. Where an institution operates its own identity provider, administrative accounts for that institution can be bound to it, so the institution's own authentication policy, including any multi factor requirement it enforces, governs administrative access to its environment.
• Authentication. Support for the institution's own identity provider through standard enterprise single sign on protocols, so credential policy stays with the institution.
• Encryption. Encryption in transit using current protocols, and encryption at rest for stored data.
• Model provider controls. Direct identifiers are removed before content is sent to a model provider, and providers are contractually prohibited from training on that content.
• Audit trail. Platform level event logging, an automatic record of administrative actions that change data, and a per institution activity feed visible to the institution.
• Least privilege. SkillDrift personnel access is limited to those who need it, is granted for a purpose, and is logged.
• Segregation of environments. Development and testing are separated from production, and production personal data is not used for development or testing.
• Backup and recovery. Backups on a 30 day retention cycle, with restoration tested.
• Vendor management. Subprocessors are reviewed before appointment and are bound by equivalent obligations.
• Change control. Changes are reviewed before release, and security relevant changes are tracked.
• Incident response. A defined process for detecting, escalating and responding to a security incident, including the notification obligation in section B8.
• Vulnerability management. Dependencies and infrastructure are monitored and patched.

Subprocessors

SkillDrift uses subprocessors in the following categories:

• Cloud infrastructure and hosting.
• Model providers for the generative features of the platform.
• Communications delivery, such as transactional email.
• Support, monitoring and error reporting tooling.

The platform is model agnostic by design. An institution may require a different model provider where its own policy demands it, and where an institution runs the generative components on its own infrastructure, its own provider is used and SkillDrift is not the processor for that processing.

The current list, naming each subprocessor, the processing it carries out and the country in which it processes data, is provided to any institution on request at legal@skilldrift.ai, and to every institution under agreement on the notification terms in section B6.

Contact

Data protection, security and procurement: legal@skilldrift.ai

Website: www.skilldrift.org

SkillDrift Inc, 4 Calvert Street, Newport, Rhode Island 02840, United States.

SkillDrift Inc is incorporated in Delaware, United States, with offices in Newport, Rhode Island, Singapore, and Kolkata, India.

Previous versions of this document are available on request from legal@skilldrift.ai.