Legal
GDPR and data processing
Information for the legal and compliance teams at customer organisations: our role, our security measures, our subprocessors and how to get a data processing agreement signed.
1. Our role
When an organisation uses 3LS to train its people, it decides the purposes and means of the processing: who gets an account, which training is mandatory, what data it uploads and how long it wants to keep it. It is therefore the controller.
3LS processes that data on its behalf, only on its documented instructions, as a processor within the meaning of Article 28 GDPR.
2. Data processing agreement
We provide a data processing agreement (DPA) that forms part of the service contract and contains the elements required by Article 28(3): subject matter and duration, nature and purpose, types of data and categories of data subject, confidentiality, security, subprocessing, assistance, deletion and audit.
To receive it for signature, write to privacy@3lsystems.cv naming the contracting entity. If your organisation has its own template, we will review it.
3. Subprocessors
We use the following subprocessors to deliver the service:
| Subprocessor | Service | Processing location |
|---|---|---|
| Amazon Web Services | Compute and database (ECS, RDS), storage (S3), video delivery and transcoding (CloudFront, MediaConvert), monitoring (CloudWatch) | AWS REGION |
| Sentry | Application error logging and diagnostics | REGION |
| TRANSACTIONAL EMAIL | Invitations, notifications and access recovery | REGION |
| PUSH NOTIFICATIONS | Mobile app notifications | REGION |
We give 30 days' notice before adding or replacing a subprocessor, and the organisation may object on reasonable grounds.
4. International transfers
Where data leaves the European Economic Area, the transfer rests on STANDARD CONTRACTUAL CLAUSES, supported by a transfer impact assessment and the technical measures described below — notably encryption in transit and at rest and logged access control.
Cabo Verde is a party to Council of Europe Convention 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data, and has national data protection legislation and its own supervisory authority.
5. Technical and organisational measures (Art. 32)
| Area | Measures |
|---|---|
| Encryption | TLS on all connections; encryption at rest in the database and object storage |
| Access control | RBAC with four roles, least privilege, stronger authentication on administrative accounts, support for SAML and OAuth 2.0 SSO |
| Isolation | Data segregated per organisation, enforced at the data layer and verified in the API, not only in the interface |
| Traceability | Audit logs of sensitive actions with actor, timestamp and previous value; monitoring with alerting |
| Secure development | Code review, separate development, staging and production environments, penetration testing before each major release |
| Continuity | Regular backups with tested restores; recovery objectives RPO/RTO |
| People | Confidentiality agreements and data protection training for everyone with access to customer data |
6. Data subject requests
Requests for access, rectification, erasure, restriction, objection or portability should go to the controlling organisation. If a data subject contacts us directly, we forward the request without delay and tell them we have done so.
We support the organisation with the platform's own tools — user data export, profile rectification, account deletion — and with manual help where needed.
7. Data breaches
If we detect a personal data breach, we notify the controlling organisation without undue delay and, where possible, within 24 hours of becoming aware, with what we know: the nature of the breach, the approximate number of data subjects and records, likely consequences and measures taken.
It falls to the organisation, as controller, to notify the supervisory authority within 72 hours and, where applicable, the affected individuals.
8. Retention, return and deletion
During the contract, retention periods are those configured by the organisation, within the limits described in the Privacy Policy.
After termination, the organisation has N days to export its data. After that we delete or anonymise production copies within N days and backup copies on the normal rotation cycle, which does not exceed N days. We provide a written confirmation of deletion on request.
9. Records, audits and impact assessments
- We keep records of the processing activities carried out on behalf of each customer, under Article 30(2).
- We make available the information needed to demonstrate compliance with Article 28 and allow audits, on reasonable notice and subject to confidentiality, once a year or following an incident.
- We support the organisation in carrying out data protection impact assessments by supplying the technical information we hold.
- CERTIFICATIONS: ISO 27001, SOC 2 — STATE WHETHER HELD OR PLANNED
10. Data protection contacts
For the DPA, compliance questions or data subject requests: privacy@3lsystems.cv. Data Protection Officer: NAME AND CONTACT, IF APPOINTED.