Responsible sharing. Protected potential.
BrainSeeds may work with carefully selected technology and service partners to help deliver a modern talent identification, psychometric assessment and personalised learning platform.
Our Core Principle
Third parties may help us deliver our services. They should never be given unnecessary access to the personal information entrusted to BrainSeeds.
A connected service ecosystem
BrainSeeds may work with specialised partners across technology, communications, security, payments, support and other legitimate service functions.
Responsible sharing. Protected potential.
BrainSeeds may work with carefully selected technology and service partners to help deliver a modern talent identification, psychometric assessment and personalised learning platform.
Our Core Principle
Third parties may help us deliver our services. They should never be given unnecessary access to the personal information entrusted to BrainSeeds.
A connected service ecosystem
BrainSeeds may work with specialised partners across technology, communications, security, payments, support and other legitimate service functions.
A third party can support BrainSeeds without becoming a BrainSeeds user.
Third-party data processing occurs when an external organisation processes personal information in connection with services provided to or for BrainSeeds.
Section 2
What is third-party data processing?
An external organisation may process information as part of delivering a service connected with BrainSeeds. The organisation does not necessarily have to be a BrainSeeds customer or user.
Possible Third-Party Roles
The legal role depends on the relationship and applicable framework.
Depending on the relationship and applicable law, a third party may act in different capacities.
Section 3
Why BrainSeeds uses third-party service providers
BrainSeeds may engage specialised providers where doing so helps operate the platform securely, reliably and effectively.
The policy identifies a range of potential purposes rather than implying that every provider performs every function.
Technology Infrastructure
Hosting applications, databases and digital services.
Data Storage
Securely storing information required to provide BrainSeeds services.
Assessment Technology
Supporting assessment administration, scoring or related technical functionality.
Artificial Intelligence & Analytics
Supporting analysis, personalisation, reporting or recommendations where appropriately configured and permitted.
Communication
Sending account notifications, assessment invitations, reports, programme information and service communications.
Payments
Processing fees and transactions through specialised payment providers.
Security
Supporting monitoring, threat detection, authentication and protection against unauthorised activity.
Customer Support
Helping BrainSeeds respond to user enquiries and service requests.
Analytics
Understanding website and platform performance and improving user experience.
Backup & Disaster Recovery
Maintaining appropriate resilience and recovery capabilities.
Professional Services
Supporting legal, accounting, audit, compliance or other legitimate professional requirements.
A third party can support BrainSeeds without becoming a BrainSeeds user.
Third-party data processing occurs when an external organisation processes personal information in connection with services provided to or for BrainSeeds.
Section 2
What is third-party data processing?
An external organisation may process information as part of delivering a service connected with BrainSeeds. The organisation does not necessarily have to be a BrainSeeds customer or user.
Possible Third-Party Roles
The legal role depends on the relationship and applicable framework.
Depending on the relationship and applicable law, a third party may act in different capacities.
Section 3
Why BrainSeeds uses third-party service providers
BrainSeeds may engage specialised providers where doing so helps operate the platform securely, reliably and effectively.
The policy identifies a range of potential purposes rather than implying that every provider performs every function.
Technology Infrastructure
Hosting applications, databases and digital services.
Data Storage
Securely storing information required to provide BrainSeeds services.
Assessment Technology
Supporting assessment administration, scoring or related technical functionality.
Artificial Intelligence & Analytics
Supporting analysis, personalisation, reporting or recommendations where appropriately configured and permitted.
Communication
Sending account notifications, assessment invitations, reports, programme information and service communications.
Payments
Processing fees and transactions through specialised payment providers.
Security
Supporting monitoring, threat detection, authentication and protection against unauthorised activity.
Customer Support
Helping BrainSeeds respond to user enquiries and service requests.
Analytics
Understanding website and platform performance and improving user experience.
Backup & Disaster Recovery
Maintaining appropriate resilience and recovery capabilities.
Professional Services
Supporting legal, accounting, audit, compliance or other legitimate professional requirements.
The service determines the data.
BrainSeeds may work with different categories of external providers. The information shared should generally reflect what is reasonably required for the authorised function being performed.
Section 4
Categories of third parties
BrainSeeds may work with different categories of external providers. The policy describes categories rather than guaranteeing that every category is used at all times.
Cloud & Hosting Providers
Infrastructure, hosting and storage
Database Providers
Secure data storage and management
Assessment Technology Providers
Assessment administration and scoring support
AI & Analytics Providers
Analysis, personalisation and reporting
Communication Providers
Email, SMS and other communications
Payment Providers
Payment processing
Security Providers
Cybersecurity and monitoring
Backup Providers
Data resilience and disaster recovery
Analytics Providers
Website and service analytics
Customer Support Providers
User support and service management
IT & Development Providers
Software development and maintenance
Professional Advisers
Legal, accounting, audit and compliance support
Verification Providers
Identity or account verification where necessary
Government / Regulatory Authorities
Compliance with legal obligations where required
Section 5 · Data Minimisation
Minimum necessary access
A third-party provider should generally receive only the information reasonably required to perform its authorised function.
Purpose determines access.Section 6 · Types of Information
What may be processed depends on the service
Depending on the service, third-party providers may process limited categories of information.
The service determines the data.
BrainSeeds may work with different categories of external providers. The information shared should generally reflect what is reasonably required for the authorised function being performed.
Section 4
Categories of third parties
BrainSeeds may work with different categories of external providers. The policy describes categories rather than guaranteeing that every category is used at all times.
Cloud & Hosting Providers
Infrastructure, hosting and storage
Database Providers
Secure data storage and management
Assessment Technology Providers
Assessment administration and scoring support
AI & Analytics Providers
Analysis, personalisation and reporting
Communication Providers
Email, SMS and other communications
Payment Providers
Payment processing
Security Providers
Cybersecurity and monitoring
Backup Providers
Data resilience and disaster recovery
Analytics Providers
Website and service analytics
Customer Support Providers
User support and service management
IT & Development Providers
Software development and maintenance
Professional Advisers
Legal, accounting, audit and compliance support
Verification Providers
Identity or account verification where necessary
Government / Regulatory Authorities
Compliance with legal obligations where required
Section 5 · Data Minimisation
Minimum necessary access
A third-party provider should generally receive only the information reasonably required to perform its authorised function.
Purpose determines access.Section 6 · Types of Information
What may be processed depends on the service
Depending on the service, third-party providers may process limited categories of information.
Some information deserves a different level of care.
BrainSeeds recognises that assessment information can be particularly sensitive from a personal-development perspective, and that children and students require additional consideration.
Section 7 · Special Protection for Assessment Information
Assessment information is not ordinary marketing data.
Assessment information may include insights relating to cognitive abilities, Multiple Intelligence areas, personality, learning preferences, emotional intelligence, behavioural characteristics, career interests, aptitudes, competencies and development areas.
Abilities & Aptitudes
Cognitive abilities, aptitudes and competencies may form part of assessment information.
Personal Characteristics
Personality, emotional intelligence and behavioural characteristics may be represented.
Learning & Development
Learning preferences, career interests and development areas may be included.
Third-Party Access
Where processing is required, access should be tightly defined.
BrainSeeds seeks to ensure that access to assessment information is purpose-specific, authorised, limited, secure and confidential, with contractual control where appropriate.
Section 8 · Children & Student Information
Additional consideration for children and students
Where third-party services are used in connection with student programmes, BrainSeeds seeks to apply appropriate safeguards.
Section 9
Third-Party AI Providers
BrainSeeds may use external artificial intelligence, machine-learning or analytics technologies as part of its technology ecosystem.
Provider evaluation
Factors BrainSeeds seeks to evaluate
Section 10 · Human Responsibility
AI can assist.
Accountability remains human.
The use of a third-party AI or technology provider does not transfer accountability away from BrainSeeds.
“An algorithm cannot be accountable. People must be.”
BrainSeeds seeks to maintain appropriate human oversight over significant assessment, developmental and personalised learning processes. AI-generated or algorithmically supported information should be interpreted within the appropriate context and should not automatically be treated as a definitive statement about an individual's potential.
Some information deserves a different level of care.
BrainSeeds recognises that assessment information can be particularly sensitive from a personal-development perspective, and that children and students require additional consideration.
Section 7 · Special Protection for Assessment Information
Assessment information is not ordinary marketing data.
Assessment information may include insights relating to cognitive abilities, Multiple Intelligence areas, personality, learning preferences, emotional intelligence, behavioural characteristics, career interests, aptitudes, competencies and development areas.
Abilities & Aptitudes
Cognitive abilities, aptitudes and competencies may form part of assessment information.
Personal Characteristics
Personality, emotional intelligence and behavioural characteristics may be represented.
Learning & Development
Learning preferences, career interests and development areas may be included.
Third-Party Access
Where processing is required, access should be tightly defined.
BrainSeeds seeks to ensure that access to assessment information is purpose-specific, authorised, limited, secure and confidential, with contractual control where appropriate.
Section 8 · Children & Student Information
Additional consideration for children and students
Where third-party services are used in connection with student programmes, BrainSeeds seeks to apply appropriate safeguards.
Section 9
Third-Party AI Providers
BrainSeeds may use external artificial intelligence, machine-learning or analytics technologies as part of its technology ecosystem.
Provider evaluation
Factors BrainSeeds seeks to evaluate
Section 10 · Human Responsibility
AI can assist.
Accountability remains human.
The use of a third-party AI or technology provider does not transfer accountability away from BrainSeeds.
“An algorithm cannot be accountable. People must be.”
BrainSeeds seeks to maintain appropriate human oversight over significant assessment, developmental and personalised learning processes. AI-generated or algorithmically supported information should be interpreted within the appropriate context and should not automatically be treated as a definitive statement about an individual's potential.
Trust is reinforced by contracts, confidentiality and controlled access.
BrainSeeds seeks to establish appropriate contractual controls with relevant third-party providers and limit access to authorised personnel with a legitimate business or service-related need.
Section 11 · Contractual Safeguards
The provider relationship should define how information is handled.
Where appropriate, BrainSeeds seeks to establish contractual controls with third-party providers. Depending on the nature of the relationship, contractual requirements may address the following areas.
Section 12 · Confidentiality Requirements
Access only where necessary for authorised activities.
Individuals working for or with third-party providers may have access to BrainSeeds information only where necessary for authorised activities.
Section 13
Third-Party Access Controls
BrainSeeds seeks to ensure that third-party access is appropriately controlled.
Trust is reinforced by contracts, confidentiality and controlled access.
BrainSeeds seeks to establish appropriate contractual controls with relevant third-party providers and limit access to authorised personnel with a legitimate business or service-related need.
Section 11 · Contractual Safeguards
The provider relationship should define how information is handled.
Where appropriate, BrainSeeds seeks to establish contractual controls with third-party providers. Depending on the nature of the relationship, contractual requirements may address the following areas.
Section 12 · Confidentiality Requirements
Access only where necessary for authorised activities.
Individuals working for or with third-party providers may have access to BrainSeeds information only where necessary for authorised activities.
Section 13
Third-Party Access Controls
BrainSeeds seeks to ensure that third-party access is appropriately controlled.
The provider should match the sensitivity of the data.
BrainSeeds may evaluate third-party providers that handle BrainSeeds information based on their ability to provide appropriate safeguards, while considering the nature and sensitivity of the information processed.
Section 14 · Security Requirements
Appropriate safeguards across the provider relationship
Depending on the service, third-party providers may be evaluated against security capabilities relevant to protecting BrainSeeds information.
Section 15
Sub-processors
Some third-party providers may themselves use additional service providers. These organisations may be referred to as sub-processors where applicable.
What BrainSeeds may manage
Sub-processor oversight can extend across the relationship
Section 16 · Provider Use of Data
Processing for BrainSeeds does not automatically mean permission for unrelated use.
BrainSeeds does not intend that a service provider may freely use BrainSeeds personal information for unrelated purposes merely because the provider processes that information on our behalf.
Section 17 · Payment Processing
Specialised providers may handle transaction processing.
BrainSeeds may use specialised payment providers to process transactions.
Information that may be processed
Transaction-related information
Users should also review the applicable payment provider's privacy information where appropriate.
The provider should match the sensitivity of the data.
BrainSeeds may evaluate third-party providers that handle BrainSeeds information based on their ability to provide appropriate safeguards, while considering the nature and sensitivity of the information processed.
Section 14 · Security Requirements
Appropriate safeguards across the provider relationship
Depending on the service, third-party providers may be evaluated against security capabilities relevant to protecting BrainSeeds information.
Section 15
Sub-processors
Some third-party providers may themselves use additional service providers. These organisations may be referred to as sub-processors where applicable.
What BrainSeeds may manage
Sub-processor oversight can extend across the relationship
Section 16 · Provider Use of Data
Processing for BrainSeeds does not automatically mean permission for unrelated use.
BrainSeeds does not intend that a service provider may freely use BrainSeeds personal information for unrelated purposes merely because the provider processes that information on our behalf.
Section 17 · Payment Processing
Specialised providers may handle transaction processing.
BrainSeeds may use specialised payment providers to process transactions.
Information that may be processed
Transaction-related information
Users should also review the applicable payment provider's privacy information where appropriate.
Trust is reinforced by contracts, confidentiality and controlled access.
BrainSeeds seeks to establish appropriate contractual controls with relevant third-party providers and limit access to authorised personnel with a legitimate business or service-related need.
Section 11 · Contractual Safeguards
The provider relationship should define how information is handled.
Where appropriate, BrainSeeds seeks to establish contractual controls with third-party providers. Depending on the nature of the relationship, contractual requirements may address the following areas.
Section 12 · Confidentiality Requirements
Access only where necessary for authorised activities.
Individuals working for or with third-party providers may have access to BrainSeeds information only where necessary for authorised activities.
Section 13
Third-Party Access Controls
BrainSeeds seeks to ensure that third-party access is appropriately controlled.
Trust is reinforced by contracts, confidentiality and controlled access.
BrainSeeds seeks to establish appropriate contractual controls with relevant third-party providers and limit access to authorised personnel with a legitimate business or service-related need.
Section 11 · Contractual Safeguards
The provider relationship should define how information is handled.
Where appropriate, BrainSeeds seeks to establish contractual controls with third-party providers. Depending on the nature of the relationship, contractual requirements may address the following areas.
Section 12 · Confidentiality Requirements
Access only where necessary for authorised activities.
Individuals working for or with third-party providers may have access to BrainSeeds information only where necessary for authorised activities.
Section 13
Third-Party Access Controls
BrainSeeds seeks to ensure that third-party access is appropriately controlled.
Communication, insight and professional expertise — connected with purpose.
BrainSeeds may use specialised providers to support communications, website and platform analytics, and legitimate professional requirements.
Section 18 · Communication Providers
External communication providers may deliver essential service messages.
BrainSeeds may use external providers to send communications connected with assessments, accounts, programmes, learning and transactions.
Section 19 · Analytics & Website Technology
Understand performance. Improve the experience.
BrainSeeds may use third-party analytics and website technologies to understand aspects of website and platform performance.
Appropriate configuration
Analytics should remain focused on relevant service insight.
BrainSeeds seeks to configure analytics tools appropriately and avoid collecting unnecessary personal information.
Section 20 · Professional Advisers
Limited disclosures may support legitimate professional requirements.
BrainSeeds may disclose limited information to professional advisers where reasonably necessary, subject to applicable confidentiality and legal requirements.
Communication, insight and professional expertise — connected with purpose.
BrainSeeds may use specialised providers to support communications, website and platform analytics, and legitimate professional requirements.
Section 18 · Communication Providers
External communication providers may deliver essential service messages.
BrainSeeds may use external providers to send communications connected with assessments, accounts, programmes, learning and transactions.
Section 19 · Analytics & Website Technology
Understand performance. Improve the experience.
BrainSeeds may use third-party analytics and website technologies to understand aspects of website and platform performance.
Appropriate configuration
Analytics should remain focused on relevant service insight.
BrainSeeds seeks to configure analytics tools appropriately and avoid collecting unnecessary personal information.
Section 20 · Professional Advisers
Limited disclosures may support legitimate professional requirements.
BrainSeeds may disclose limited information to professional advisers where reasonably necessary, subject to applicable confidentiality and legal requirements.
A provider's privacy practices can be separate from ours.
Some third-party providers maintain their own privacy policies. BrainSeeds' policy explains BrainSeeds' handling of personal information, while a provider's own policy explains that provider's practices.
Section 24 · Third-Party Privacy Policies
Understand which organisation's practices apply.
Payment, communication, analytics or technology providers may independently publish information describing their processing activities.
BrainSeeds Privacy Policy
Explains BrainSeeds' handling of personal information.
Provider Privacy Policy
Explains that provider's own practices.
Independent Organisations
Some third parties may act independently rather than solely on behalf of BrainSeeds.
Section 25
Personal assessment information should not become a commodity.
BrainSeeds' objective is not to create commercial markets around highly personal assessment and development information.
Legitimate, authorised purposes
Processing by service providers should remain connected to the authorised purpose.
Where information is processed by service providers, BrainSeeds seeks to ensure that it is used for legitimate, authorised purposes rather than unrelated commercial exploitation.
Section 26 · Data Retention by Third Parties
Retention expectations should continue through the end of the relationship.
BrainSeeds seeks to establish appropriate retention and deletion expectations with relevant service providers. When a service relationship ends, BrainSeeds may seek to ensure that personal information is handled through appropriate return, deletion, destruction or anonymisation measures.
Section 27 · Privacy Requests
Privacy requests may require coordination across the service ecosystem.
If you submit a privacy request to BrainSeeds, we may need to work with relevant service providers to locate, correct, export or delete information.
Depending on the nature of the processing
Different participants may have a role.
A provider's privacy practices can be separate from ours.
Some third-party providers maintain their own privacy policies. BrainSeeds' policy explains BrainSeeds' handling of personal information, while a provider's own policy explains that provider's practices.
Section 24 · Third-Party Privacy Policies
Understand which organisation's practices apply.
Payment, communication, analytics or technology providers may independently publish information describing their processing activities.
BrainSeeds Privacy Policy
Explains BrainSeeds' handling of personal information.
Provider Privacy Policy
Explains that provider's own practices.
Independent Organisations
Some third parties may act independently rather than solely on behalf of BrainSeeds.
Section 25
Personal assessment information should not become a commodity.
BrainSeeds' objective is not to create commercial markets around highly personal assessment and development information.
Legitimate, authorised purposes
Processing by service providers should remain connected to the authorised purpose.
Where information is processed by service providers, BrainSeeds seeks to ensure that it is used for legitimate, authorised purposes rather than unrelated commercial exploitation.
Section 26 · Data Retention by Third Parties
Retention expectations should continue through the end of the relationship.
BrainSeeds seeks to establish appropriate retention and deletion expectations with relevant service providers. When a service relationship ends, BrainSeeds may seek to ensure that personal information is handled through appropriate return, deletion, destruction or anonymisation measures.
Section 27 · Privacy Requests
Privacy requests may require coordination across the service ecosystem.
If you submit a privacy request to BrainSeeds, we may need to work with relevant service providers to locate, correct, export or delete information.
Depending on the nature of the processing
Different participants may have a role.
When something changes, risk management changes with it.
BrainSeeds seeks to assess third-party incidents, manage provider risk through the engagement lifecycle, and apply greater care where more sensitive information is involved.
Section 28
Security incidents involving third parties
If BrainSeeds becomes aware of a security incident involving a third-party provider that affects BrainSeeds information, we will assess the incident and take appropriate action.
Depending on the circumstances
Possible response activities
Section 29 · Third-Party Risk Management
Provider risk is considered before, during and at the end of an engagement.
BrainSeeds seeks to consider privacy and security risks when selecting and managing important third-party providers. The level of assessment may depend on the provider and level of risk.
Before Engagement
During Engagement
At the End of Engagement
Section 30 · Higher Standards for Sensitive Information
The more sensitive the information, the greater the care that should be applied.
BrainSeeds may therefore apply additional scrutiny to providers processing information that requires heightened protection.
When something changes, risk management changes with it.
BrainSeeds seeks to assess third-party incidents, manage provider risk through the engagement lifecycle, and apply greater care where more sensitive information is involved.
Section 28
Security incidents involving third parties
If BrainSeeds becomes aware of a security incident involving a third-party provider that affects BrainSeeds information, we will assess the incident and take appropriate action.
Depending on the circumstances
Possible response activities
Section 29 · Third-Party Risk Management
Provider risk is considered before, during and at the end of an engagement.
BrainSeeds seeks to consider privacy and security risks when selecting and managing important third-party providers. The level of assessment may depend on the provider and level of risk.
Before Engagement
During Engagement
At the End of Engagement
Section 30 · Higher Standards for Sensitive Information
The more sensitive the information, the greater the care that should be applied.
BrainSeeds may therefore apply additional scrutiny to providers processing information that requires heightened protection.