Data processing terms
These terms form part of the terms of service. They cover the personal data a customer puts into Openn Assets, mostly about its own employees and contractors.
Roles
The customer is the controller (under the GDPR) or data fiduciary (under India’s DPDP Act 2023) for the personal data in its workspace. The Openn Group is the processor and acts only for the customer.
What is processed
Names, work emails, employee IDs, departments, managers, locations, employment dates, the equipment and licences each person holds, receipts, returns and attached files, and the audit trail of changes. The purpose is to provide Openn Assets to the customer, for as long as the customer uses it.
Instructions
We process this data only to run the service as the customer uses and configures it, and as these terms describe. If the law ever requires us to do something else, we tell the customer first unless the law forbids it.
Confidentiality and security
Only people who need access to run or support the service have it, and they are bound to keep it confidential. We apply the measures described on the security page and keep them at least as strong over time.
Sub-processors
The customer authorises the sub-processors on the sub-processors page. We bind each to data protection terms at least as protective as these. We give workspace owners 30 days’ notice of a new one; a customer that objects on reasonable grounds may end the affected service and receive a pro-rata refund of prepaid fees for it.
Helping the customer
The service lets admins find, correct, export and delete records themselves. Where that is not enough, we help the customer answer requests from the people in its data, and with security reviews and impact assessments, as far as is reasonable.
Breaches
If we become aware of a breach affecting personal data in a workspace, we tell the customer without undue delay, with what we know, what we are doing about it, and updates as we learn more.
International transfers
Data is hosted in the United States and handled by the providers on the sub-processors page. Where a transfer needs safeguards, we rely on the providers’ terms, including the European Commission’s standard contractual clauses where they apply.
End of service
The customer can export its data at any time. When a workspace is closed we keep it for 30 days for export, then delete it, and backups containing it expire on a rolling basis after that, unless the law requires us to keep something.
Information and audits
On request we provide the information reasonably needed to show we meet these terms. On-site audits can be agreed in an Enterprise agreement.
Contact
Questions about these terms, or a signed copy for your records: privacy@theopenngroup.com.