Trust & Legal

Data Processing Addendum

POSITION Consultants, LLC

Version:: 1.1
Effective Date:: October 1, 2026
Last Updated:: October 4, 2026

This Data Processing Addendum describes the data-protection commitments that apply when POSITION processes Customer Personal Data on behalf of an organizational Customer. A signed Customer agreement or separately executed addendum may supplement or replace these terms.

1. Scope

Where POSITION processes Customer Personal Data solely on documented instructions of Customer to provide contracted Services, POSITION acts as processor/service provider to the extent applicable. For processing where POSITION independently determines purposes and means—such as service security, billing, fraud prevention, legal compliance, product administration, and permitted de-identified analytics—POSITION may act as an independent controller/business as applicable.

2. Processing details

 Subject matter: delivery and administration of leadership-development platform and services.  Duration: term of Services plus permitted retention/deletion period.  Nature/purpose: hosting, authentication, assessment administration/scoring, coaching/program operations, scheduling, authorized analytics, support, security, and contracted features.  Data subjects: Customer personnel, participants, raters, administrators, coaches, and authorized users.  Data types: identity/contact, professional role, assessment/360, development, program, scheduling, technical/security, and other Customer-submitted data.

3. Processor obligations

 Process Customer Personal Data on documented lawful instructions except where law requires otherwise.  Ensure personnel with access are subject to confidentiality obligations.  Implement reasonable security measures appropriate to risk.  Use subprocessors under appropriate contractual obligations and maintain a current list.  Provide reasonable assistance with applicable data-subject requests, security incidents, assessments, and deletion/return obligations, taking account of the nature of processing.  Notify Customer of a confirmed breach of Customer Personal Data without undue delay as required by the signed DPA and applicable law.  Delete or return Customer Personal Data at termination as agreed, subject to lawful retention and de- identification exceptions.

4. Customer obligations

Customer represents that it has a lawful basis and all necessary rights, notices, consents, and authority for Customer Personal Data and instructions; will not instruct POSITION to process data unlawfully; and will not upload unnecessary sensitive information into fields not designed for it.

5. International transfers

Positioned4Success™ is currently offered for U.S.-based use. Before processing that requires GDPR, UK GDPR, or other international-transfer safeguards, the parties will execute any required Standard Contractual Clauses, UK Addendum, or other appropriate mechanism and confirm applicable hosting and subprocessor arrangements.

Questions about this document? Contact privacy@thepositionforsuccess.com or support@thepositionforsuccess.com.