Our Commitment to You and the Protection of Your Data
TalentLMS has an ethical, legal and professional duty to ensure the information it holds conforms to the principles of confidentiality, integrity, privacy and availability. In other words, the information that we are responsible for is safeguarded where necessary against inappropriate disclosure, is accurate, timely and attributable, and is available to those who should be able to access it. TalentLMS complies with standing national law and international regulation regarding privacy and security issues. We are currently running a GDPR compliance program internally so as to be fully compliant with GDPR when the new legislation comes into force (May 25, 2018).
We have set up a small GDPR Q&A to help you with your roadmap towards compliance, providing a high level overview of the regulation, discussing its main impact and helping you avoid some common GDPR pitfalls and fallacies.
Besides strengthening and standardizing user data privacy across the EU nations, GDPR imposes new or additional obligations on all organizations that handle EU citizens’ personal data, regardless of where the organizations themselves are located. On this page, we’ll explain our methods and plans to achieve GDPR-compliance, both for ourselves and for our customers.
Preparing for the GDPR
The GDPR’s updated requirements are significant and our team is working to bring TalentLMS in line before May 25, 2018. Measures to achieve this include:
We’ll also continue to monitor the guidance around GDPR compliance from privacy-related regulatory bodies and codes of conduct, and will adjust our plans accordingly. We’ll provide you with regular updates along the way by means of our newsletters or enhancements to this site, so that you’re always current.
Our Security Infrastructure
Protecting our customers’ information and their users’ privacy is extremely important to us. As a cloud-based company entrusted with some of our customers’ most valuable data, we’ve set high standards for security. Our cloud infrastructure utilizes Rackspace servers and AWS S3 storage, two industry leading cloud providers that are heavily certified in privacy and security. On top of that we have invested in building a robust privacy and security team, adhering to NIST recommendations and are in the process of enhancing our set of tools for detecting software vulnerabilities prior to production release, assessing our software and deployments, running a bug bounty program, monitoring our infrastructure, protecting customer data, ensuring disaster recovery, business continuity and high availability. In accordance with GDPR requirements around security incident notifications, TalentLMS will continue to meet its obligations and offer contractual assurances.
International Data Transfers: Privacy Shield and Contractual Terms
To comply with E.U. data protection laws around international data transfer mechanisms, we already take part in the transatlantic Privacy Shield program that ensures that data from EU customers are properly handled when located on US servers. You may find our entry for TalentLMS here.
TalentLMS will never employ subprocessors that retain facilities or may perform processing in countries that are not contained in the list of countries for which the European Commission has explicitly affirmed on the adequacy of the protection of personal data.
TalentLMS customers’ enhanced rights as data subjects
The rights of our TalentLMS customers as data subjects are important to us. We are committed to supporting the new, enhanced under GDPR, data subject rights for all TalentLMS customers, regardless of their location or nationality – we will also explain how TalentLMS helps our customers support the enhanced rights of their domains’ end users in the penultimate section of this page.
Right to be forgotten: You may terminate your TalentLMS account at any time, in which case we will permanently delete your account and all data associated with it according to the TalentLMS data retention policy. In particular, the termination of your administrator account will render the domain as inactive; all account data is kept for 12 months after an account cancellation to ensure that a service re-connection will be as smooth as possible. Inactive domains for a period of 12 months or more are deleted by the system. You can also contact us at privacy at talentlms dot com if you want your data to be deleted upon your account cancelation; we will permanently delete your account and all data associated with it within at most thirty days.
Right to object: If you object to TalentLMS email notifications, you may deactivate them for yourself - or any other end user of your domain - by following these steps. You may opt out of inclusion of your data in our marketing by removing yourself from the mailing lists using the footer in the newsletters and marketing emails that you receive.
Right of data portability: You may export your data at any time through the administration panel of the application; the process is quite straightforward and also explained here. Furthermore, we will be happy to export your account data to a third party at any time upon your request, which you may send at privacy at talentlms dot com.
Data Portability Solutions and Data Management Tools
We fully understand that TalentLMS customers need help from our side in order for them to comply with the GDPR. And we’re happy to say that over the next few months, we’ll be building those tools and features to enhance TalentLMS so as to be fully compliant with the GDPR regulation. Information about the features and functionalities of these enhancements will be shared with you as it becomes available.
Compliance-related controls will enhance the existing tools for data exports with the new features required by GDPR, also fulfilling the TalentLMS obligations regarding data subjects’ rights.
In particular, TalentLMS already supports the following administrator tools that enable the GDPR-enhanced data subject rights for the end users of the TalentLMS domains that our customers create and manage:
Right to be forgotten: TalentLMS supports sophisticated end user management, which includes rendering a user inactive or permanently deleting him from the system.
These two complementary TalentLMS features allow our customers to fully comply with GDPR regarding their domains’ end users’ right to be forgotten-erased from TalentLMS.
Right to object: The case where the end user objects to processing for e-learning is covered in the right to be forgotten part. In case the user objects to TalentLMS email notifications, he may contact his domain administrator, who can exclude the respective user(s) from email notifications by following the steps described here.
Right of data portability: As explained earlier, this is supported by means of the export function of the application. User progress can also be exported by using the custom reports feature of TalentLMS.
Consent: TalentLMS enables its customers to explicitly ask for and record users’ consent for using the TalentLMS service. In particular, each domain administrator may set through the “Users” tab of the Home / Account & Settings administration page a custom “Terms of Service” page that is to be shown to each end user when he/she first logs in to the system. It is necessary to accept this page in order to continue to the LMS, therefore this is a handy way of obtaining consent from the end users through TalentLMS. Note that once an end user accepts to provide consent, this is also logged by the TalentLMS and appears in the extended timeline of the application, thus making it easy to use it for reporting or compliance purposes if needed. If the end users choose to withdraw consent for e-learning, this is essentially equivalent to the removal of the user of the service so the domain administrator can follow the “right to be forgotten-erased” process explained earlier in this page in order to satisfy the data subject’s request and remove the end user from TalentLMS.
Fulfilling our privacy and data security commitments is important to us. So we’re glad to help you prepare for all the changes the GDPR brings. This page will be revised to reflect GDPR-related information as it becomes available. If you have any questions about how TalentLMS can help you with compliance, or you have any privacy-related concerns, please reach out by contacting us at: privacy at talentlms dot com.