1. Who this is for
This agreement applies when a college, hospital, academy or other organisation (the Organisation) arranges Cleared access for its students or staff and shares their personal data with us to do it, for example a list of names and email addresses to invite.
It forms part of the order or agreement between the Organisation and Attravo Commerce LLC, which runs Cleared (we). If the two conflict on data protection, this agreement takes priority.
2. Roles
- For the data the Organisation gives us to set up and manage its access, the Organisation decides why it is processed, and we process it on the Organisation's instructions.
- Once a student or staff member creates their own Cleared account, their account and study data are handled as described in our Privacy Policy.
- We never use Organisation data for our own marketing, and we never sell it.
- Invitations and emails about access go through our email provider. People only get product updates if they agree to them, every optional email has an unsubscribe link, and email send logs are kept for 12 months.
3. What we process
We only share an individual's detailed answers or results with the Organisation if that person agrees.
| Data | Purpose |
|---|---|
| Names, email addresses or mobile numbers of the people invited | Sending invitations and granting access |
| Batch, cohort or department labels | Grouping access and reporting |
| Access status and usage summaries | Showing the Organisation who has joined and, where agreed, overall progress |
4. Our commitments
- Process Organisation data only on its documented instructions, and only to provide Cleared.
- Make sure everyone who handles it is bound to keep it confidential.
- Protect it with appropriate security, including encryption in transit and at rest, and access limited to the people who need it.
- Help the Organisation respond to requests from the people whose data it is, such as requests for access or deletion.
- Tell the Organisation without undue delay, and within 72 hours of becoming aware, if a personal data breach affects its data.
- Delete or return the data when the arrangement ends, unless the law requires us to keep it.
5. Sub-processors
To run Cleared we use the providers listed in our Privacy Policy, such as Supabase for our database and Hostinger for sending email. Each is bound by data protection terms at least as protective as these. We will tell the Organisation before adding or replacing a sub-processor that handles its data, and it may object.
6. Where data is stored
Our database is hosted in Singapore. Some of our providers process data in the United States or Europe. Where data leaves the country it was collected in, we rely on our providers' contractual safeguards.
7. Audits
On reasonable written request, and no more than once a year unless there has been a breach, we will give the Organisation the information it needs to check that we meet this agreement.
8. Term and ending
This agreement lasts as long as we process Organisation data. When the arrangement ends, we delete that data within 30 days, or return it first if the Organisation asks.
9. Contact
To put an agreement in place, or with any question about it, write to hello@clearedprep.com.
Questions about this page? Write to hello@clearedprep.com. We reply within 72 hours.