Data Processing Addendum

Version 2026-09-24

This Data Processing Addendum ("DPA") is part of the Terms of Service between Alumys LLC ("Provider") and the organization that uses Alumys Tools ("Customer"). It consists of this cover page and the Common Paper DPA Standard Terms, Version 1.1, which are incorporated by reference. Where the two conflict, this cover page controls. Customers on a signed Cloud Service Agreement receive the same DPA as a signed document.

Parties and roles

• Provider (data importer, processor): Alumys LLC, 626 N Alafaya Trail, Suite 206, Orlando, FL 32828, United States. Contact: support@alumys.com.
• Customer (data exporter, controller): the organization that accepted the Terms of Service or signed a Cloud Service Agreement and uses Alumys Tools, currently to run examinations with Alumys Assessment.
• Service provider relationship: under the California Consumer Privacy Act, Provider acts as Customer's service provider and processes personal data only on Customer's documented instructions.

Cloud Service

Alumys Tools, Provider's cloud platform at tools.alumys.com, and the products offered within it as described in the Documentation. At the effective date the platform offers Alumys Assessment.

Data subjects

Examinees invited by Customer to take an examination; Customer's examiners and administrators who hold accounts on the service; and Customer's employees where they are examined.

Categories of personal data

• Names and contact details of examinees and account holders.
• Transactional and user-activity data: invitations, sign-ins, actions in the console.
• Examination content authored by Customer.
• Examinee answers, code submissions, scores and grading notes.
• Integrity signals limited to browser events (window and tab focus, copy and paste, fullscreen changes) and timing. No camera, microphone, screen capture or biometric data is collected.

No special categories of personal data are processed.

Purpose, nature and duration of processing

Receiving, holding, using, updating, protecting, returning and erasing personal data in order to deliver, grade and report examinations on Customer's behalf. Transfers are continuous for the term of the agreement. Processing lasts for the term of the agreement and until deletion under Customer's retention setting or Customer's deletion of its organization, whichever is earlier.

Security measures

Provider maintains the measures described on the security page: pseudonymization and encryption in transit and at rest; confidentiality, integrity and availability controls; the ability to restore access after an incident; regular testing and assessment; identity and authentication controls; event logging; system configuration management; IT security governance; data minimization, retention limits, accountability, and portability and erasure. Provider notifies Customer of a confirmed security incident affecting Customer personal data without undue delay and within 72 hours. Security contact: support@alumys.com, 626 N Alafaya Trail, Suite 206, Orlando, FL 32828, United States.

Subprocessors

Customer authorizes the subprocessors listed at /legal/subprocessors. Provider gives 30 days' notice before adding or replacing a subprocessor, and Customer may object as the Standard Terms provide. All subprocessors process data in the United States.

Data subject requests

Examinees direct requests to see, correct or erase their data to the organization that invited them. Provider forwards any request it receives directly within five business days and helps Customer answer it with the export, correction and deletion features of the service.

Governing law and liability

This DPA is governed by the law that governs the Terms of Service or Cloud Service Agreement it forms part of, and the liability limits of that agreement apply to it. For transfers from the European Economic Area, the Standard Terms' Standard Contractual Clauses apply with the Netherlands as the governing member state; Alumys serves customers in the United States and does not transfer personal data outside it.

Changes

A new version of this DPA takes effect on the date shown at the top of this page. Owners of every organization are emailed at least 30 days before a change to an accepted document takes effect, and the console asks for re-acceptance at the next sign-in.