DATA PROTECTION POLICY

Data Controller Contact Information:
Fulcrum SaaS Inc.
250 Steele Street, Suite 375
Denver, CO 80206

The date this policy was last updated: January 31, 2023

Introduction

Fulcrum SaaS Inc. collects and uses certain personal data and information about individuals to provide its services.

These individuals can include customers, parents, legal guardians, instructors, students, independent contractors, suppliers, business contacts, employees, and other people whom the organization has a relationship with or may need to contact.

This policy describes how these personal data must be collected, processed, and stored to meet data protection standards and comply with the law.

Why this policy exists

This data protection policy explains how Fulcrum SaaS Inc.:

• • complies with data protection laws and follows good practice
  • protects the rights of employees, partners, customers, and independent contractors
  • explains how it stores and processes individuals’ data
  • helps protect personal data from the risks of a data breach

Data protection laws

Fulcrum SaaS Inc. is committed to processing data following its responsibilities under the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and other data protection and privacy laws. These data protection and privacy laws describe how organizations including Fulcrum SaaS Inc. must collect, process, and store personal data. These rules apply regardless of whether data are stored electronically, on paper, or in other formats. To comply with the law, personal data must be collected and used fairly, stored safely, and not disclosed illegally.

Article 5 of the GDPR requires that personal data will be:

a. processed legally, fairly, and transparently about individuals;

b. collected for specified, explicit, legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research or statistical purposes will be considered compatible with the initial purposes;

c. adequate, relevant, and limited to what is necessary concerning the purposes for which they are processed;

d. accurate and, where necessary, kept up-to-date; every reasonable step must be taken to make sure that personal data that are inaccurate about the purposes for which they are processed are immediately erased or corrected;

e. kept in a form which allows identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving in the public interest, scientific or historical research, or statistical purposes subject to the implementation of the appropriate technical and organizational measures required by the GDPR to safeguard the rights and freedoms of individuals; and

f. processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing; accidental loss, destruction, or damage; using appropriate technical or organizational measures.

People, risks, responsibilities, and policy scope

This policy applies to:

• • Fulcrum SaaS Inc.;
  • all employees of Fulcrum SaaS Inc.; and
  • all suppliers, independent contractors, and other people working on behalf of Fulcrum SaaS Inc.

It applies to all personal data that Fulcrum SaaS Inc. holds about identifiable individuals, even if that information technically falls outside some privacy and data protection laws. This can include the following personal data:

• • names of individuals and their business if applicable;
  • postal addresses;
  • email addresses;
  • telephone numbers;
  • username and password;
  • account information from customers;
  • payment information; and 2
  • and other personal data about individuals as listed in our privacy notice.

Data protection risks

This policy helps to protect Fulcrum SaaS Inc. from data security risks, including:

• • breaches of confidentiality, for example, personal data being given out or exposed without proper authorization;
  • failing to give choice, for example, all individuals should be free to choose how our company uses their personal data; and
  • reputational damage, for example, our company could suffer if unauthorized individuals successfully gained access to sensitive data.

Responsibilities

Everyone who works for or with Fulcrum SaaS Inc. has some responsibility for making sure that data are collected, stored, and processed properly. Each individual who handles personal data must make sure the data are handled and processed in line with this policy and its principles of data protection.

These people have key areas of responsibility:

The owner of Fulcrum SaaS Inc. is ultimately responsible for making sure that it meets its obligations under data protection laws.

The privacy officer is responsible for:

• • keeping Fulcrum SaaS Inc. updated about data protection laws, responsibilities, risks, and issues;
  • reviewing all data protection procedures and related policies regularly;
  • providing data protection training and advice to people covered by this policy;
  • responding to data protection questions from staff and anyone else covered by this policy;
  • responding to requests from individuals to see the data that Fulcrum SaaS Inc. holds about them (also called ‘data subject access requests’ or DSARs); and
  • reviewing and approving any agreements or contracts with third parties that may process our company’s personal and sensitive data.

The IT manager is responsible for:

• • making sure that all computer and electronic systems, services, and equipment used for storing and processing data meet acceptable security standards;
  • performing regular security checks and scans to make sure that hardware and software is functioning properly; and
  • evaluating any third-party services that our company is considering using to collect, process, or store data.

The marketing manager is responsible for:

• • approving any data protection statements attached to communications such as emails and letters;
  • addressing data protection queries from journalists or media outlets; and
  • where necessary, working with other staff to make sure that marketing initiatives adhere to the principles of data protection.

General employee guidelines

• • The only people able to access data covered by this policy should be those who need it for their work.
  • Data should not be shared with others without appropriate authorization. When access to and the sharing of confidential information is required, employees can request it from their supervisors.
  • Fulcrum SaaS Inc. will provide training to all employees to help them understand their responsibilities when handling data and confidential information.
  • Employees should keep all data secure by taking reasonable precautions and following the guidelines below.
  • Strong passwords must be used and should never be shared.
  • Personal data should not be disclosed to unauthorized people within our company nor people outside our company.
  • Data should be regularly reviewed and updated if they are found to be out of date. If no longer required, they should be deleted and disposed of using appropriate security procedures.
  • Employees should request help from their supervisors or a data protection officer if they are unsure about any aspect of data protection procedures.

Data storage

These rules describe how and where personal data should be safely stored. Questions about safely storing personal data can be directed to the IT manager or data controller.