1. Subject and parties
This Data Processing Agreement (“Agreement”) forms part of the contract between the client company (“Customer”) and WISA Products & Services International – FZCO (“WISA”) for Trident LMS and governs the processing of Users’ personal data carried out by WISA on the Customer’s behalf. This page summarises the standard terms; the signed version may be attached to the proposal and prevails over this summary.
2. Roles of the parties
- Customer — controller: decides which staff to invite, which courses to assign and for what purposes training data is used. It is responsible for having a legal basis for the processing and for informing Users.
- WISA — processor: processes the data only to provide Trident LMS, on the Customer’s documented instructions (the contract, the academy settings and administrators’ actions on the HR Director dashboard).
- WISA is an independent controller only for the data it needs for its own management (for example invoicing, platform security, fraud prevention and public verification of certificates issued), as far as the law allows.
3. Data and data subjects
| Data subjects | Staff and other persons invited by the Customer; the Customer’s administrators |
|---|---|
| Categories of data | Identification and contact (name, work email, phone if provided), department and job title, login credentials, assigned courses, due dates, progress, assessment answers and scores, training time, points (XP) and leagues, certificates, activity and technical logs; ID document where verification is enabled for the academy |
| Purpose | Providing the academy, courses, tracking, reports and certificates |
| Duration | For the contract term and the export/deletion period set out below |
The Customer should not enter special categories of data (for example health data) into Trident LMS unless strictly necessary and agreed in writing.
4. WISA’s obligations
- process the data only on the Customer’s documented instructions, unless required by law, and inform the Customer if it believes an instruction breaks the law;
- ensure that people authorised to process the data are bound by confidentiality;
- apply appropriate technical and organisational measures, in particular: encrypted connections (HTTPS), personal password-protected accounts, access roles (HR Director/User), logical separation of each customer’s data, backups, security updates and activity logging;
- help the Customer answer data subject requests (access, correction, deletion, portability), including through the export functions;
- notify the Customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting its data, with the information available;
- give the Customer the information reasonably needed to demonstrate compliance with this Agreement.
5. Sub-processors
The Customer authorises WISA to use sub-processors, who are bound by equivalent data protection obligations. Current list (to be confirmed in the proposal):
| Provider | Service |
|---|---|
| Hostinger International Ltd. | Platform hosting, database and email |
| Brevo (Sendinblue SAS) | Sending the platform’s automatic emails (invitations, reminders, reports) |
| Anthropic, PBC | AI assistant supporting messages and ID document checks, where these functions are enabled |
WISA informs the Customer of changes to this list with reasonable notice; the Customer may object on reasonable grounds.
6. International transfers
Data may be processed in the United Arab Emirates and in the sub-processors’ countries. WISA ensures transfers comply with applicable law — including UAE Federal Decree-Law No. 45 of 2021 (PDPL), Angola’s Law No. 22/11 and, where applicable, the GDPR — using appropriate contractual clauses where needed.
7. End of the contract
When the contract ends, the Customer may request, within 30 days, an export of the available training records. After that period WISA deletes or anonymises Users’ personal data, including backups in the normal rotation cycle, unless the law requires retention. The verification page of certificates already issued may remain active with the minimum data needed, unless the Customer asks otherwise.
8. Audits
The Customer may request information and, with reasonable prior notice and at its own cost, carry out an audit itself or through an independent auditor bound by confidentiality, no more than once a year unless there is a data breach or a regulator requires it.
9. Liability and precedence
The parties’ liability follows the limits of the Trident LMS Terms of Service, except where the law does not allow it. If this Agreement and the Terms of Service conflict regarding personal data, this Agreement prevails.
10. Contact
Customer requests regarding personal data: info@tridentlms.com.