Data Processing Addendum
Brilliant Assessments
Last Updated 20/09/2026
Under this Agreement, the Customer engages the Supplier to provide the Services, and in providing the Services, the Supplier will or may be required to Process Personal Data on behalf of the Customer. To the extent of that Processing of Personal Data, the Customer is a “Controller” and the Supplier is a “Processor” for the purposes of the GDPR and, where applicable, the UK GDPR. Article 28 of the GDPR and UK GDPR requires that certain provisions governing that Processing are included in the contract between the Customer and the Supplier.
The parties must set out the subject matter and duration of the Processing, the nature and purpose of the Processing, the type of Personal Data, and categories of data subjects – see appendix 1 to this Data Processing Addendum.
The terms used in this Data Processing Addendum have the meanings given to them in the main definition section of these terms and conditions or in clause 13 of this Data Processing Addendum, or in the GDPR or UK GDPR, as applicable, if not defined in these terms and conditions or in this Data Processing Addendum.
1. Processing of Personal Data
The Supplier will:
a. Instructions from Customer: in providing Services under this Agreement, Process Personal Data only on the Customer’s documented instructions (as provided in clause 2 and in appendix 1 to this Data Processing Addendum or otherwise in writing) unless required to do so by the Data Protection Laws in which case the Supplier will inform the Customer of that legal requirement before Processing unless the Supplier is prohibited from informing the Customer by that law;
b. Confidentiality: ensure that the Supplier’s personnel who are authorized to Process the Personal Data have obligations of confidentiality to the Supplier (including as required in clause 3 below) in respect of the Personal Data or are under an appropriate statutory obligation of confidentiality;
c. Security: comply with the security obligations in clause 4 below;
d. Subprocessors: comply with the provisions relating to Subprocessors in clause 5 below;
e. Data subjects’ rights: provide assistance to the Customer with responding to data subjects’ rights in accordance with clause 6 below;
f. Assist Customer: comply with its obligations to assist the Customer in relation to the security of Personal Data and data protection impact assessments and prior consultation in accordance with clause 7 below;
g. Deleting and returning data: after the provision of Services related to Processing of Personal Data has ended, at the choice of the Customer, either delete or return to the Customer all of that Personal Data and delete existing copies unless the Data Protection Laws require storage of Personal Data in accordance with clause 8 below; and
h. Compliance and audits: make available to the Customer all information necessary to demonstrate compliance with Article 28 of the GDPR or UK GDPR, as applicable, and allow for and contribute to audits including inspections conducted by the Customer or another auditor mandated from time to time, in accordance with clause 9 below.
i. The Supplier will immediately inform the Customer if, in its opinion, an instruction received from the Customer infringes the Data Protection Laws.
2. Instructions from Customer
a. The Customer instructs the Supplier (and authorizes the Supplier to instruct each Subprocessor accordingly) to:
i. Process Personal Data; and
ii. in particular, transfer Personal Data to any country or territory,
as necessary for the provision of the Services and consistent with and in compliance with this Agreement.
b. The Customer warrants and represents that it is and will at all relevant times remain duly and effectively authorized to give the instruction set out in clause 2.a on behalf of the Customer.
3. Confidentiality
a. The Supplier will take necessary steps to ensure the reliability of its employees, agents or contractors who may have access to Personal Data, ensuring in each case that access is limited to those individuals who need to know or need to access the relevant Personal Data, as necessary for the purposes of this Agreement, and to comply with applicable laws in the context of that individual's duties to the Supplier, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.
4. Security
a. Subject to clause 4.b below, the Supplier will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including amongst other things as appropriate:
i. the pseudonymization and encryption of Personal Data;
ii. the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
iii. the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident;
iv. a process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of the Processing.
b. In assessing the appropriate level of security for clause 4.a above, the Supplier will take account in particular of the risks of a Personal Data Breach that are presented by the Processing to be undertaken under this Agreement.
c. The Supplier will in relation to Personal Data:
i. implement and maintain appropriate information security to protect Personal Data against:
1. Personal Data Breach (including accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed)
2. all other unauthorized or unlawful forms of Processing; and
3. any breach of the Supplier’s information security obligations in this Data Processing Addendum. The Supplier will (and will ensure that its Sub-processors) provide full cooperation and assistance to the Customer in ensuring that the individuals´ rights under the Data Protection Laws are timely and appropriately addressed for the fulfilment of the Customer’s obligation to respond without undue delay to requests by such individuals as required by Data Privacy Laws, including the rights of subject access, rectification, erasure, and portability, and the right to restrict or object to certain Processing;
ii. take reasonable steps to inform its staff, and any other person acting under its supervision, of the responsibilities of any Data Privacy Laws due to the incidental access to Personal Data, and ensure the reliability of its staff and any other person acting under its supervision who may come into contact with, or otherwise have access to and Process, such Personal Data.
5. Subprocessors
a. The Customer authorises the Supplier to appoint Subprocessors (and permits each Subprocessor appointed in accordance with this clause 5 to appoint Subprocessors) in accordance with this clause 5 and any restrictions in these terms and conditions.
b. The Supplier’s Subprocessors may include Amazon Web Services and Microsoft Azure, including artificial intelligence services provided through AWS Bedrock and Azure OpenAI. The Supplier will maintain a current list of its Subprocessors and make that list available to the Customer on request.
c. The Supplier will give the Customer prior written notice of the appointment of any new Subprocessor, including full details of the Processing to be undertaken by the Subprocessor. If, within two weeks of receipt of that notice, the Customer notifies the Supplier in writing of any objections (on reasonable grounds) to the proposed appointment, the Supplier will not appoint (nor disclose any Personal Data to) the proposed Subprocessor unless and until it obtains the prior written consent of the Customer.
d. With respect to each Subprocessor, the Supplier will:
i. enter into an agreement with the Subprocessor, which includes the same data protection obligations as set out in this Data Processing Addendum (and Appendix 1) and, in particular, includes sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the GDPR or UK GDPR, as applicable. If the Subprocessor fails to fulfill its data protection obligations, the Supplier will remain fully liable to the Customer for the performance of that Subprocessor’s obligations;
ii. if the Processing by the Subprocessor will involve a Restricted Transfer, ensure that the Standard Contractual Clauses are at all relevant times incorporated into the agreement between the Supplier and the Subprocessor; and
iii. provide to the Customer for review copies of the Supplier’s agreements with Subprocessors (confidential commercial information that is not relevant to the requirements of this Data Processing Addendum may be blacked out) as the Customer may request from time to time.
e. Appendix 1 to this attachment sets out certain information regarding the Supplier’s Processing of Personal Data, as required by article 28(3) of the GDPR or UK GDPR, as applicable. The Customer may make reasonable amendments to Appendix 1 by written notice to the Supplier from time to time as the Customer reasonably considers necessary to meet those requirements.
6. Data Subjects’ Rights
a. Taking into account the nature of the Processing, the Supplier will, by implementing appropriate technical and organisational measures to the extent described in clause 4, assist the Customer to respond to requests to exercise Data Subject rights under the Data Protection Laws.
b. The Supplier will:
i. promptly notify the Customer if the Supplier or any Subprocessor receives a request from a Data Subject under any Data Protection Law in respect of Personal Data; and
ii. ensure that the Supplier or relevant Subprocessor does not respond to that request except on the documented instructions of the Customer or as required by Applicable Laws to which they are subject, in which case the Supplier will to the extent permitted by Applicable Laws inform the Customer of that legal requirement before the Supplier or relevant Subprocessor responds to the request.
7. Assist Customer
a. Assist Customer with Security of Processing:
i. The Supplier will assist the Customer in respect of the Customer’s obligations to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, by complying with the Supplier’s obligations under clause 4 of this Data Processing Addendum.
b. Assist Customer with notifications of Personal Data Breach
i. The Supplier will notify the Customer without undue delay if the Supplier or any Subprocessor becomes aware of a Personal Data Breach, providing the Customer with sufficient information to allow the Customer to meet any obligations to report the Personal Data Breach to the relevant Supervisory Authority under the Data Protection Laws (noting that the Customer is required, where feasible, to notify applicable Personal Data breaches to the relevant Supervisory Authority within 72 hours after having become aware of the breach).
ii. The Supplier will co-operate with the Customer and take such reasonable commercial steps as are directed by the Customer to assist in the investigation, mitigation and remediation of each such Personal Data Breach.
c. Assist Customer with communication of Personal Data breach to Data Subject
i. Where a Personal Data Breach is likely to result in a high risk to the rights and freedoms of natural persons:
1. Such that the Customer is required to communicate the Personal Data Breach to the Data Subject (including where, despite the conditions referenced in clause 7.c(i)(2) below being met, the Supervisory Authority has required the Customer to communicate the Personal Data Breach to the Data Subject), the Supplier will assist the Customer in doing so by providing all relevant information as may be reasonably required by the Customer;
2. but despite that high risk, the Customer is not required to communicate the Personal Data Breach to the Data Subject due to certain conditions being met (such as that the Personal Data is encrypted and so unintelligible to any person not authorised to access it), the Supplier will assist the Customer by providing all relevant information as may be reasonably required by the Customer.
d. Assist Customer with Data Protection Impact Assessments
i. The Supplier will provide reasonable assistance to the Customer with any data protection impact assessments which the Customer reasonably considers to be required of the Customer by Article 35 of the GDPR or UK GDPR, or equivalent provisions of related Data Protection Laws. The Supplier’s obligations under this clause are solely in relation to Processing of Personal Data by the Supplier and taking into account the nature of the Processing and information available to the Supplier.
e. Assist Customer with Prior Consultation with Supervisory Authority
i. The Supplier will provide reasonable assistance to the Customer with prior consultations with Supervising Authorities or other competent data privacy authorities, which the Customer reasonably considers to be required of the Customer by Article 36 of the GDPR or UK GDPR, or equivalent provisions of related Data Protection Laws. The Supplier’s obligations under this clause are solely in relation to Processing of Personal Data by the Supplier and taking into account the nature of the Processing and information available to the Supplier.
8. Deletion or return of Personal Data
a. Subject to clauses 8.b and 8.c, the Supplier will, within three weeks of the date of expiration or termination of Services involving the Processing of Personal Data (the "End of Processing Date"), delete and procure the deletion of all copies of the Personal Data.
b. Subject to clause 8.c, the Customer may in its absolute discretion by written notice to the Supplier within two weeks of the End of Processing Date require the Supplier to:
i. return a complete copy of all Personal Data to the Customer by secure file transfer in such format as is reasonably notified by the Customer to the Supplier; and
ii. delete and procure the deletion of all other copies of Personal Data Processed by the Supplier. The Supplier will comply with any such written request within two weeks of the End of Processing Date.
c. The Supplier may retain Personal Data to the extent required by Applicable Laws and only to the extent and for such period as required by Applicable Laws and always provided that the Supplier will:
i. ensure the confidentiality of all such Personal Data;
ii. ensure that such Personal Data is only processed as necessary for the purpose(s) specified in the Applicable Laws requiring its storage and for no other purpose.
d. The Supplier will provide written certification to the Customer that it has fully complied with this clause 8 within three weeks following the End of Processing Date.
9. Audit rights
a. Subject to clauses 9.b to 9.c, the Supplier will make available to the Customer on request all information necessary to demonstrate compliance with this Data Processing Addendum, and will allow for and contribute to audits, including inspections, by the Customer or an auditor mandated by the Customer in relation to the Processing of Personal Data by the Supplier.
b. Information and audit rights of the Customer only arise under clause 9.a to the extent that this Agreement does not otherwise give them information and audit rights meeting the relevant requirements of Data Protection Laws (including, where applicable, article 28(3)(h) of the GDPR).
c. The Supplier may, on reasonable grounds, object to the proposed auditor in which case the Customer will propose an alternate auditor.
i. The Customer will give the Supplier reasonable notice of any audit or inspection to be conducted under clause 9.a and will make (and ensure that its auditor makes) reasonable endeavours to avoid causing any damage, injury or disruption to the Supplier's premises, equipment, personnel and business while its personnel are on those premises in the course of such an audit or inspection. The Supplier need not give access to its premises for the purposes of such an audit or inspection for the purposes of more than one audit or inspection in any calendar year, except for any additional audits or inspections which:
1. the Customer reasonably considers necessary because of genuine concerns as to the Supplier's compliance with this Data Processing Addendum; or
2. the Customer is required or requested to carry out by Data Protection Law, a Supervisory Authority or any similar regulatory authority responsible for the enforcement of Data Protection Laws in any country or territory,
where the Customer has identified its concerns or the relevant requirement or request in its notice to the Supplier of the audit or inspection.
10. Restricted Transfers
a. Subject to clause 10.c, where the Services involve a ‘Restricted Transfer’ as between the Customer and the Supplier, the Customer (as "data exporter") and the Supplier (as "data importer") each agrees to the Standard Contractual Clauses in respect of that Restricted Transfer.
b. The Standard Contractual Clauses will come into effect under clause 10.a on the later of:
i. the data exporter becoming a party to them;
ii. the data importer becoming a party to them; and
iii. commencement of the relevant Restricted Transfer.
c. There is no requirement for the Supplier and Customer to agree to the Standard Contractual Clauses (or for the Standard Contractual Clauses to be included in this Agreement) where the transfer of Personal Data is to a country within the EEA or to an Approved Jurisdiction.
d. Where a Restricted Transfer is subject to the UK GDPR and requires an appropriate contractual safeguard, the parties will enter into or incorporate the then-current International Data Transfer Agreement or UK Addendum to the Standard Contractual Clauses, as applicable.
11. Order of precedence
a. Nothing in this Data Processing Addendum reduces the Supplier's obligations under this Agreement in relation to the protection of Personal Data or permits the Supplier to Process (or permit the Processing of) Personal Data in a manner which is prohibited by this Agreement. In the event of any conflict or inconsistency between this Data Processing Addendum and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail.
b. Subject to clause 11.a, in the event of inconsistencies between the provisions of this Data Processing Addendum and the other parts of this Agreement, the provisions of this Data Processing Addendum will prevail.
12. Changes in Data Protection Laws
a. The Customer may by at least 30 calendar days' written notice to the Supplier:
i. vary the Standard Contractual Clauses (if applicable), as they apply to Restricted Transfers which are subject to Data Protection Laws other than or outside of the European Union or Canada, as required as a result of any change in, or decision of a competent authority under, that data protection law, to allow those Restricted Transfers to be made (or continue to be made) without breach of that data protection law; and
ii. propose any other variations to this Data Processing Addendum which the Customer reasonably considers to be necessary to address the requirements of any data protection law or any guidelines published by the relevant Supervisory Authority.
b. If the Customer gives notice under clause 12.a(i):
i. the Supplier will promptly co-operate (and require affected Subprocessors to promptly co-operate) to ensure that equivalent variations are made to the agreements made under clause 5.d; and
ii. the Customer will not unreasonably withhold or delay agreement to any consequential variations to this Data Processing Addendum proposed by the Supplier to protect the Supplier against additional risks associated with the variations made under this clause 12.b.
c. If the Customer gives notice under clause 12.a(ii), the parties will promptly discuss the proposed variations and negotiate in good faith with a view to agreeing and implementing those or alternative variations designed to address the requirements identified in the Customer's notice as soon as is reasonably practicable.
13. Definitions
In this Data Processing Addendum:
“Adequacy Decision” means a country (or territory or specified sector within it) or an international organization which the European Commission has decided, under Article 45(3) of the GDPR or UK GDPR, as applicable, ensures an adequate level of data protection;
“Approved Jurisdiction” means the countries in the EEA and jurisdictions for which an Adequacy Decision has been made;
“Contracted Processor” means the Supplier or a Subprocessor;
“Data Protection Laws” means the GDPR, the UK GDPR, the Data Protection Act 2018, in each case as amended or replaced from time to time, and any other (international, national, regional) law, regulation or rules applicable to the processing of Personal Data as performed under this agreement.
"Data Subject" means an identified or identifiable natural person, or any updated definition of this term from time to time in the GDPR or UK GDPR, as applicable;
"EEA" means the European Economic Area;
“Information Security Obligations” means commercially reasonable and appropriate physical, technical, and organizational security measures (determined with regard to risks associated with the Processing of Personal Data as part of the Services), including the measures set out in this Data Processing Addendum and in particular in the Standard Contractual Clauses (where applicable).
"Restricted Transfer" means transferring Personal Data outside of the European Union or Canada, whether this is:
a. a transfer of Personal Data from the Customer to the Supplier or to a Subprocessor; or
b. an onward transfer of Personal Data from one Contracted Processor to another Contracted Processor, or between two establishments of a Contracted Processor,
in each case, where such transfer means would be prohibited by Data Protection Laws (or by the terms of data transfer agreements put in place to address the data transfer restrictions of Data Protection Laws), in the absence of the Standard Contractual Clauses;
"Services" means, for the purposes of this Data Processing Addendum, the products, services and/or deliverables (as applicable) and any related services supplied to or carried out by or on behalf of the Supplier for the Customer under this Agreement;
"Subprocessor" means any person (including any third party, but excluding an employee of the Supplier) appointed by or on behalf of the Supplier to Process Personal Data on behalf of the Customer in connection with this Agreement;
“Standard Contractual Clauses” means the standard contractual clauses issued by the European Commission (EU controller to non-EU or EEA processor), which:
a. if applicable as between the Supplier and the Customer, are in Appendix 2 to this Data Processing Addendum (and if not applicable, there is no Appendix 2);
b. if applicable as between the Supplier and any other processor or subprocessor in relation to the Services provided by the Supplier under this Agreement, will be included in the agreement between the Supplier and the processor / subprocessor.
"Supervisory Authority" has the meaning given to that term in the GDPR or UK GDPR, as applicable.
“UK GDPR” means the GDPR as it forms part of the law of the United Kingdom.
Appendix 1 to Data Processing Addendum
Details of Processing of Personal Data
This Appendix 1 includes certain details of the Processing of Personal Data as required by Article 28(3) GDPR or UK GDPR, as applicable.
Subject matter and duration of the Processing of Personal Data
As defined by the Customer in the assessment questions and response data uploaded by the Customer into the system. No Personal Data is required for the operation of the system.
The nature and purpose of the Processing of Personal Data
As defined by the Customer for the production of individual or summarized cohort feedback reports.
The types of Personal Data to be Processed
As defined by the Customer in the assessment questions and response data uploaded by the Customer into the system.
The categories of Data Subject to whom Personal Data relates
As defined by the Customer in the assessment questions and response data uploaded by the Customer into the system.
The obligations and rights of the Customer
The obligations and rights of the Customer are set out in this Agreement (including this Data Processing Addendum).
Hosting and storage location of the Data
Customer Data is hosted and stored in Canada. Authorized Supplier personnel located in the United Kingdom and New Zealand may remotely access Customer Data held in Canada where necessary to provide support. Such access does not involve storing Customer Data outside Canada.
Artificial Intelligence Processing
Where the Customer elects to use artificial intelligence features within the Service, Customer-selected Data may be transmitted to Azure OpenAI or AWS Bedrock for Processing. The Customer controls the Data submitted and may anonymize it before submission. Data submitted to these services is not retained by them following Processing.