Alumne LMS terms of service in SaaS format

1. Scope

The following general terms and conditions (hereinafter the “contract” or the “conditions”) of ALUMNE ELEARNING S.L. (hereinafter “ALUMNE” or “the Owner”) apply to your order in the version in force at the time the order is placed.

These terms and conditions apply exclusively to contracts entered into through the Internet portal and shall comply with the provisions of current legislation and, in particular, Ley 7/1998, de 13 de abril, sobre condiciones generales de la contratación (Spanish General Terms and Conditions of Contract Act), Ley 34/2002, de 11 de julio, de servicios de la sociedad de la información y de comercio electrónico (Spanish Information Society Services and Electronic Commerce Act) and other supplementary legislation.

Where a contract/agreement has been entered into with ALUMNE for the same services as those ordered, the contents of said contract/agreement shall prevail over the provisions of these general terms and conditions of contract.

2. Identification of the Owner

The entity with which you are contracting is ALUMNE ELEARNING, S.L., with registered office at calle Rosa de Lima 1, Edificio ALBA SS Oficina 3, 28290, Las Rozas de Madrid, Madrid, SPAIN, and Tax ID (CIF) B87181186, registered in the Madrid Mercantile Register, Volume: 33029, Folio: 100, Section: 8, Sheet: M-5945. ALUMNE offers its LMS (learning management system) service (hereinafter the “Service”) through its website https://alumnelms.com/ (hereinafter the “Website”), as well as through the iOS and Android apps that it owns (hereinafter the “Apps”), to employer organisations (hereinafter «CLIENT»).

The address for the purposes of complaints shall be the one indicated as the company's registered office.

These general terms and conditions of contract (hereinafter the “Conditions”) govern the contracting of the services offered by ALUMNE, all through its Website, as well as the rights and obligations of the parties arising from the service provision transactions agreed between them.

ALUMNE has developed and is the lawful owner of its LMS software, which is offered as a service accessible via the Internet or “Software as a Service” (SaaS) to employer entities (hereinafter «CLIENT»).

That, by accepting these terms and conditions, ALUMNE grants you a licence to access and use ALUMNE LMS and to the provision of other complementary services, in accordance with the terms and conditions.

3. Definitions

In addition to any other term defined in these conditions, the following terms shall have the following meanings:

“Databases”: integrated set of data owned by the CLIENT included within the SAAS for the duration of the Contract. Where personal data included as part of the Database are processed, the included Data Processing Agreement shall apply.

“Authorised User(s)”: users who have a contractual relationship with the CLIENT and use the SAAS to manage their professional training and development. “Documentation”: documentation relating to the Services prepared by ALUMNE and provided to the Client, which may include instruction manuals, technical documentation, etc. in electronic format.

“Active Users”: the number of users who are NOT blocked and can therefore log in to the platform. Each service plan includes a specific number of active users. Should it be necessary to increase that number, the client must change plan. Non-active or blocked users shall not count, up to a maximum ratio of 4 blocked users for each active user contracted. Beyond that point, they shall count until the ratio is rebalanced.

“AI Credits”: the amount available for using the Artificial Intelligence (AI) based features offered by the platform. If the user uses them up, it must purchase more credits. AI Credits shall have a maximum useful life of 24 months from the time of their purchase.

4. Purpose of the Conditions

These general conditions govern the licence of use that ALUMNE grants to the CLIENT in relation to the SAAS, which is non-sublicensable, non-exclusive, worldwide and of a duration limited to the term of the conditions, and which shall in any event be conditional upon full payment of the price.

These conditions also govern the provision of complementary services consisting of technical support on the terms indicated (hereinafter, the use of ALUMNE LMS and the set of complementary services shall be jointly referred to as the “Services”).

ALUMNE reserves the right to amend any term of these conditions, and such amendments shall be notified to the Client through the SAAS for acceptance. This is without prejudice to any update of the conditions made on the ALUMNE website.

FINANCIAL TERMS, PLANS AND CONTRACT RENEWAL

Subscription Fee. The price of the Services is set as the payment of a subscription fee (the “Fee”), which may be annual or monthly depending on the plan selected by the CLIENT; said Fee is published both on the website and within the SAAS itself. ALUMNE may update the Fees whenever it deems appropriate; such updates may not be applied to periods already contracted by the CLIENT, but may be applied to renewals. The CLIENT may request cancellation of the service without any penalty if it does not agree with the new Fees.

Annual Plan Service Conditions

The CLIENT may select the annual plan with the different services included in each rate.

Selection of the Annual Fee. Upon the initial selection or change of plan, the calendar year of the service shall begin to run, under the terms and conditions published at the time of selection, including the price, which shall remain unchanged throughout the term.

Should the CLIENT wish, during the term of the contract, to make any modification to the contracted plan, the terms and conditions published by Alumne on the website at the time the modification is made shall apply.

RENEWAL OF THE CONTRACT. On the expiry date of the annual plan, that is, once one calendar year has elapsed since the plan was selected, the contract shall be deemed automatically renewed for successive annual periods, with the terms and conditions in force on the Alumne website at the time of renewal applying, unless the CLIENT expressly notifies its intention not to renew the CONTRACTED PLAN at least thirty (30) days before the end date of the initial period or of any of its extensions.

You may exercise your right not to renew from the Alumne panel itself, in the “My Alumne LMS account” section, by accessing the payment provider, Stripe, and indicating in your account that you wish to cancel so as not to receive any further charges. Alternatively, you may send an email to info@alumn-e.com stating your wish to cancel. You must receive confirmation from ALUMNE that the cancellation has been processed correctly.

Downgrades to a lower version may result in the loss of content, features and functionalities of the CLIENT's account. ALUMNE accepts no liability for any such loss.

Cancellation of the Service. The CLIENT may terminate the contract within the term of the agreed conditions, but such cancellation shall not entitle it to any refund of the amounts already paid to ALUMNE. The CLIENT may exercise its right not to renew from the Alumne panel itself, in the “My Alumne LMS account” section.

Monthly Plan Service Conditions

The CLIENT may select the monthly plan with the different services included in each rate.

Selection of the Monthly Fee. Upon the initial selection of, or change to, the monthly plan, the monthly charge for the selected plan shall be made immediately.

Update of the Monthly Fee. ALUMNE may freely modify the Fee and/or the conditions of the monthly plans, giving 60 calendar days' prior notice of the modifications before they actually take effect, and granting the client the right to cancel the service if it does not accept the new conditions, provided that it so notifies with a minimum notice of 30 days from said notification.

If the aforementioned cancellation is not notified, ALUMNE shall apply the new conditions, including the new rates, 60 days after the notification; if the last day of this period does not coincide with the first calendar day of the month, for the purposes of calculating whole months, this period shall be deemed extended until the first calendar day of the following month.

Downgrades to a lower version may result in the loss of content, features and functionalities of the CLIENT's account. ALUMNE accepts no liability for any such loss.

Cancellation of the Service. THE CLIENT shall be entitled to terminate the contract, but such cancellation shall not entitle it to any refund of the amounts already paid to ALUMNE. Termination of the contract must be notified at least thirty (30) days before the end date of the initial period or of any of its extensions.

The CLIENT may exercise its right not to renew from the Alumne panel itself, in the “My Alumne LMS account” section.

5. CONDITIONS OF USE OF THE SERVICE

Rights of Use. ALUMNE grants the Client and the Authorised Users the personal, non-exclusive, non-transferable and non-sublicensable right to use the SAAS and the other Services, worldwide, for the duration of these conditions and their renewals, exclusively for the purposes of their professional activity, in consideration of the price

Restrictions on Use. The Client may not: (a) reverse engineer, decompile, disassemble or attempt to obtain or derive the source code, underlying ideas, algorithms, file formats or non-public APIs of the Services, or translate, modify or create derivative works of the SAAS, the Services or any part thereof, except to the extent permitted by applicable law; (b) copy/reproduce, lend, sell, rent, sublicense, broadcast, distribute, edit, transfer to third parties or provide access to the SAAS, or adapt the Services or any part thereof in any way; (c) use the Services for the benefit of any third party; (d) use the Service for any commercial purpose or in a product or service that the Client provides to third parties; (e) circumvent, modify, remove, delete, alter or otherwise tamper with any security, encryption or other technology or program forming part of the Services; (f) access or use the SAAS or the Services for the purpose of carrying out a competitive analysis or creating a similar or competing product or service; (g) use the SAAS for any purpose that is unlawful or not authorised by ALUMNE, including unsolicited advertising and spam; (h) create, collect, transmit, store, use or process any data through the SAAS that violates any applicable law or infringes the intellectual property rights or other rights of any third party; (i) introduce or disseminate content or software (viruses and malware) that may cause damage to the computer systems of ALUMNE, its technology service providers or third-party users; or (j) encourage, allow or assist any third party to do any of the foregoing

Updates and New Versions. Updates and successive versions of the SAAS provided to the Client during the term of the Conditions shall be subject to the same terms.

6. TECHNICAL SUPPORT SERVICES AND AVAILABILITY

Technical Support Services. ALUMNE shall provide the Client with support by email during ALUMNE's working hours to help the Client resolve queries and locate and correct problems in relation to the SAAS, via the email address operaciones@alumn-e.com. During the provision of the service, the Client authorises ALUMNE, through its staff and at the Client's prior request, to access the accounts of the Authorised Users in order to carry out the appropriate actions to resolve the queries or incidents arising with the SAAS. Technical queries by telephone or videoconference may entail a cost for the CLIENT. ALUMNE shall inform the CLIENT in advance when such queries may entail a cost, and the CLIENT must accept the conditions before receiving the service. The hourly cost of telephone support is 60€ + VAT.

Availability. ALUMNE shall use commercially reasonable efforts to ensure that the SAAS has 99% availability and shall make commercially reasonable efforts to notify the Client at least 48 hours in advance of scheduled maintenance within normal business hours.

7. USE OF THE ACCOUNT

Account Access. The Client and the Authorised Users must keep secure the access credentials to the Authorised User accounts in the SAAS (“Account”). ALUMNE shall under no circumstances be liable for any loss of information or damage caused by failure to comply with this security obligation.

Account Access. The Client and the Authorised Users must keep secure the access credentials to the Authorised User accounts in the SAAS (“Account”). ALUMNE shall under no circumstances be liable for any loss of information or damage caused by failure to comply with this security obligation.

Account Management. The Client undertakes to block or deactivate an Authorised User's account immediately if: (i) the employment relationship between the Client and the Authorised User is suspended or terminated; or (ii) it considers that a User has misused their access credentials to the SAAS. If ALUMNE becomes aware that an Authorised User falls within either of the aforementioned cases, ALUMNE may suspend access to the infringing Account temporarily or indefinitely, in which case ALUMNE must notify the CLIENT of the infringement detected and the measure taken in respect of said Account.

8. INTELLECTUAL AND INDUSTRIAL PROPERTY

Intellectual and Industrial Property in relation to the Services. ALUMNE shall retain its position as owner of all intellectual and industrial property rights relating to all components of the Services, including the SAAS, and any other development, improvement, update or derivative work of this Agreement. The intellectual and industrial property rights shall cover all data, source and object code, scripts, designs, concepts, applications, texts, images, any related documentation, copies, modifications and documents or documentation derived from the foregoing (in whole or in part), and all related copyrights, patents, trade marks, trade secrets and other proprietary rights are and shall remain the exclusive property of ALUMNE and/or its licensors.

Client's Intellectual and Industrial Property. All rights, title and interest in relation to the Client's Database, trade marks, trade names and logos, as well as those that may exist in its own computer system, shall remain the property of the Client.

The Client expressly authorises ALUMNE to use its trade mark and trade name for the purpose of including them on the web portals owned by ALUMNE for purely advertising purposes.

9. CONFIDENTIALITY

Definition of Confidential Information. “Confidential Information” means any material or information disclosed orally or in writing that is labelled or designated as confidential or that, by its nature, may reasonably be understood to be confidential, which has been delivered or provided by either Party to the other in connection with these conditions, including information relating to the computer systems and the systems architecture of the planned or existing systems of the Parties, including the hardware, the software, the SAAS itself, the Documentation, the Database, processing methods and operating methods.

Exceptions. Confidential Information shall not include information which (i) was in the public domain at the time it was disclosed to the receiving Party; (ii) entered the public domain through use, publication or the like after its disclosure to the receiving Party, without any fault or act of the receiving Party; (iii) was lawfully in the possession of the receiving Party, free of any obligation of confidentiality, at the time it was disclosed to the receiving Party; (iv) is lawfully communicated to the receiving Party by a third party entitled to disclose such Confidential Information, after the time it was disclosed to the receiving Party.

Duty of Confidentiality. The Parties undertake not to use, disclose, copy, publish, use, exploit, disseminate or distribute the other Party's Confidential Information, nor to allow the Confidential Information received to be exploited or distributed by third parties, without the prior written consent of the disclosing Party, except to the extent necessary to fulfil their obligations or exercise their rights under the contract. The Parties undertake to treat the Confidential Information with the same degree of care as they use to protect their own Confidential Information, and in no event with less than a reasonable degree of care. The obligation of confidentiality shall remain in force indefinitely and shall likewise extend to the employees and representatives of the Parties, as well as to the external advisers that either Party has engaged in connection with this contract.

Disclosure of Confidential Information. The Parties may only disclose Confidential Information in the following cases: (i) in response to an order of a court or other governmental body, or as required by law (in which case the disclosing Party shall be given prior written notice of such potential disclosure and such disclosure shall be limited as far as possible); (ii) where the Party receiving such Confidential Information must disclose it to its employees, representatives or external advisers (if any) whom it has engaged, in order to fulfil its obligations under this contract, and only granting them access to it to the extent necessary; (iii) where a Party has received express written authorisation from the other Party to disclose its Confidential Information (or part thereof).

Breach of the Duty of Confidentiality. Breach of the confidentiality obligations set out in this contract, or wilful or negligent acts carried out by either Party, its employees or directors, shall entitle the non-breaching Party to claim through legal channels the liabilities, whether direct, indirect or vis-à-vis third parties, including judicial and extrajudicial expenses and the defence costs caused by the breaching Party, as well as compensation for the damage and loss that such breach may have caused to the non-breaching Party.

10. DATA PROTECTION

Contracting Parties' Data. The Parties inform each other that the personal data of the signatories, as well as of the persons working for the respective Parties, and the contact details provided for the purposes of notices, shall be processed by the other Party for the sole purpose of managing and performing the contractual relationship. The data shall be retained for as long as the relationship remains in force and, once it has ended, shall be retained only for as long as necessary to comply with the tax, legal and administrative obligations to which the Parties are subject.

The legal basis for this processing is the need to perform this contract. The data shall not be communicated or disclosed to third parties, except to those that are essential for the performance of the contract itself (necessary service providers) and for compliance with legal obligations (Public Administrations, auditors, financial institutions, insurance companies where applicable, among others).

Duty of Confidentiality. The Parties undertake not to use, disclose, copy, publish, use, exploit, disseminate or distribute the other Party's Confidential Information, nor to allow the Confidential Information received to be exploited or distributed by third parties, without the prior written consent of the disclosing Party, except to the extent necessary to fulfil their obligations or exercise their rights under the contract. The Parties undertake to treat the Confidential Information with the same degree of care as they use to protect their own Confidential Information, and in no event with less than a reasonable degree of care. The obligation of confidentiality shall remain in force indefinitely and shall likewise extend to the employees and representatives of the Parties, as well as to the external advisers that either Party has engaged in connection with this contract.

Necessary service providers may be based outside the EU, in which case an international transfer of data may take place. In that event, the Parties undertake to ensure that their international providers have appropriate safeguards in accordance with the applicable regulations.

The Parties may request to exercise their rights of access, rectification, erasure, objection, restriction and portability at the address designated in this contract or at the email address info@alumn-e.com, clearly indicating the right they wish to exercise. Likewise, the Parties are mutually informed that they have the right to lodge a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency) (www.aepd.es). Nevertheless, the Parties shall use their best endeavours and seek to resolve any matter relating to personal data amicably.

Database Included by the CLIENT. The processing of the personal data contained in the Database to be carried out by ALUMNE as a result of the provision of the Services shall be governed by the Data Processing Agreement set out in these conditions.

11. WARRANTIES

Warranty of Title. ALUMNE warrants to the CLIENT that it is the owner or lawful holder of all the intellectual property rights necessary to provide the Services and THE SAAS.

The CLIENT accepts that it is solely responsible for the results obtained from the use of the Services and their functionalities. No claims shall be accepted in respect of alleged specifications which, in the CLIENT's opinion, the SAAS or the Services should meet.

12. LIABILITY

Limitation of Liability. The Client agrees to indemnify and hold ALUMNE harmless from any direct, indirect, incidental or consequential claim, action or demand by third parties, as well as from any expense, liability, damage, settlement or fee arising from the misuse of the SAAS or the Services by the Client, or from the breach of any of the terms of this contract. Nor shall ALUMNE assume any liability for any claims, losses or damages arising from the use by the Client or any User of any third-party products, services, software or websites accessed through links from the SAAS or the ALUMNE website. ALUMNE shall not be liable for claims relating to the industrial and/or intellectual property of the materials and content uploaded by the CLIENT to the platform, the CLIENT being solely responsible.

Indirect Damages. ALUMNE shall not be liable (unless otherwise provided by law) to the Client for any damages, compensation or indemnity based on indirect damages (including, but limited to, actual loss, loss of use, loss or inaccuracy of data, loss of profits, failure of security mechanisms, business interruption, costs of delay) or any special, incidental or consequential damages of any kind, even if advised of the possibility of such damages in advance.

Maximum Liability: ALUMNE's maximum liability for any claim arising from this contract, whether for breach of contract, breach of warranty, negligence or otherwise, and the CLIENT's sole remedy, is limited to direct damages in an amount not exceeding the proportional part of the sum of the amounts and Annual or Monthly Fees paid or payable by the CLIENT to ALUMNE under this contract in the twenty-four (24) months preceding the claim.

Nothing in this contract shall limit or exclude the liability of a Party that cannot be excluded or limited under applicable law.

Force Majeure. Neither party shall be liable to the other for failure to perform the obligations undertaken under the conditions to the extent that such failure or delay results from a cause or circumstance beyond the reasonable control of the affected Party and which could not have been avoided or overcome by acting reasonably and prudently (such as, but not limited to, fire, flood, strikes, labour disputes or other industrial disturbances, war – whether declared or not –, embargoes, blockades, legal restrictions, riots, insurrections, government regulations).

Regulatory Compliance. The CLIENT shall be solely responsible for full compliance with all laws applicable to its business in its jurisdiction. The mere contracting of the Services does not in any way amount to or guarantee compliance with the regulations applicable to working-time management. ALUMNE LMS is a tool subject to use by the CLIENT, which is responsible for complying with its obligations.

13. TERMINATION

ALUMNE reserves the right to terminate the Contract automatically by operation of law, without prior notice or compensation, if the Client or an Authorised User in any way compromises the integrity of the SAAS, ALUMNE's intellectual and industrial property rights over the Services or the reputation of ALUMNE's brands or products, or carries out any of the actions provided for in Clause

Effects of Termination. Upon expiry of the contract or its termination for any reason: (i) none of the amounts paid to ALUMNE under this contract shall be refunded to the CLIENT, and ALUMNE shall invoice all fees owed for the remaining time of the current year; (ii) at the CLIENT's request, ALUMNE undertakes to provide the CLIENT with a copy of the Database in a standard technical format. Such request must be made within one (1) of the termination of the contract; (iii) all its provisions shall cease to have effect, except for those provisions of this contract which, by their nature, must remain in force even though the contract has been terminated, including the provisions on confidentiality, intellectual property and data protection.

14. MISCELLANEOUS

Headings. The headings of the clauses are included for illustrative purposes only and shall have no legal effect.

Notices. The Parties designate the designated email addresses; in the case of ALUMNE, the enabled email address is info@alumn-e.com

Assignment. The CLIENT may not assign or transfer this contract without the prior written consent of ALUMNE. However, the contract may be assigned or transferred by ALUMNE without the need for the CLIENT's consent, prior written notice of the assignment to the CLIENT being sufficient for such assignment to take effect. Once the assignment has been formalised, any reference to the assigning Party contained in this contract shall be understood as a reference to the assignee entity or entities.

Waiver. No delay in exercising a right shall be deemed a waiver thereof, nor shall the waiver of a right or remedy in a particular case constitute a waiver of such right or remedy in general.

Severability. If any of the provisions of this contract is held to be unenforceable or invalid, the remaining provisions of this contract shall not be affected and shall remain in full force and effect.

Independent Parties. This contract is commercial in nature, and there shall in no event be any employment relationship between the Parties, which shall be independent for all purposes.

15. GOVERNING LAW AND JURISDICTION

Governing Law. The terms of this contract shall be governed by and construed in all respects in accordance with Spanish law.

Jurisdiction. The Parties jointly declare that, insofar as reasonable, any dispute arising in connection with or out of this contract shall be resolved through mutual negotiation and consultation. Should no satisfactory solution be reached, such dispute shall be submitted to the courts of the city of Madrid.

APPENDIX A – DATA PROCESSING AGREEMENT

This Data Processing Agreement forms part of the general conditions, hereinafter the «Contract», entered into by Alumne Elearning S.L and the Client, which sets out the terms and conditions applicable to the services provided by Alumne Elearning S.L (the «Services»). This DPA and the other clauses of the Contract are complementary to each other. However, in the event of conflict, the Data Processing Agreement shall prevail.

RECITALS

That the Parties have entered into a licence agreement for the use of the SaaS software Alumne LMS and for services (hereinafter the “Contract”), under which the Data Processor shall provide certain services (hereinafter the “Services”) that will involve access to personal data for which the Data Controller is responsible.

That Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the “GDPR”), requires the regulation of the data protection obligations assumed by the Parties under the Contract.

That, in accordance with the foregoing, the Parties agree to enter into and sign this Data Processing Agreement, which shall be governed by the provisions of Article 28 of the GDPR and by the following:

CLAUSES

1. Purpose.

In order to perform the obligations arising from the Contract and to provide the Services effectively, the Data Processor may have access to personal data for which the Data Controller is responsible.

2. Identification of the Information Concerned

For the performance of the obligations arising from the fulfilment of the purpose of this Data Processing Agreement, the Data Controller makes available to the Data Processor the information described below:

Personal data:

• Name and surname(s)
• Email address
• National ID number (D.N.I.)
• Profile picture
• IP address

The Controller warrants that it has complied with the duty to provide all information to the data subjects at the time the data subject to processing were collected, in compliance with the provisions of Articles 12, 13 and 14 of the GDPR, as applicable.

The Data Controller warrants that it has an appropriate legal basis for the processing of the personal data that complies with the principles of effectiveness, necessity and proportionality, taking into account the existence of other protective measures that may be less invasive, avoiding discriminatory effects and establishing appropriate safeguards.

The Data Processor shall in no event be liable for any failure to comply, or defective compliance, with the duty of information or with the application of an appropriate legal basis.

3. Obligations of the Data Processor.

The Data Processor represents and warrants to the Data Controller as follows:

That it shall use the personal data subject to processing, or those it collects for inclusion, solely for the purpose of this engagement. It may under no circumstances use the data for its own purposes;

That it shall process and use the personal data to which it has access solely in accordance with the instructions of the Data Controller, and in accordance with the purposes set out in the Contract.

Instructions regarding the processing of the data and the actions entrusted to the Processor must be communicated to the Processor in writing.

If the Data Processor considers that compliance with a given instruction from the Controller could entail a breach of data protection regulations, it shall immediately inform the Controller. In this communication, the Processor shall ask the Controller to amend, withdraw or confirm the instruction given and may suspend compliance with it pending a decision by the Controller.

That, where applicable, it shall keep, in writing, a record of all categories of processing activities carried out on behalf of the controller, containing all the information provided for in Article 30 GDPR.

That it shall maintain confidentiality and secrecy regarding the personal data to which it has access in connection with the provision of the Services.

That it shall not communicate the data to third parties unless it has the express authorisation of the data controller, and in legally permissible cases.

The Processor may communicate the data to other processors of the same controller, in accordance with the latter's instructions. In this case, the controller shall identify, in advance and in writing, the entity to which the data must be communicated, the data to be communicated and the security measures to be applied in order to proceed with the communication.

That it shall provide the Data Controller with the information necessary to demonstrate compliance with the obligations set out in the Contract.

That it shall provide such assistance as may be required by the Controller for the performance of audits or inspections carried out by the Data Controller or by another auditor authorised by the Controller. Audits may be carried out periodically, on a planned basis or “ad hoc”, subject to prior notification to the Processor with reasonable notice, during the Processor's normal working hours.

That it shall ensure that the persons authorised to process personal data have expressly undertaken in writing to comply with the established security measures and to respect the confidentiality of the data. Compliance with this obligation must be documented by the Processor and made available to the Data Controller.

That it has appointed a data processor whose contact details are as follows: info@alumn-e.com

That it shall cooperate in the fulfilment of the Controller's obligations and shall provide it with support, where appropriate and at the Controller's request, in carrying out (i) impact assessments relating to the personal data to which it has access; (ii) prior consultations with the supervisory authority.

That it shall ensure that the persons authorised to process personal data have expressly undertaken in writing to comply with the established security measures and to respect the confidentiality of the data. Compliance with this obligation must be documented by the Processor and made available to the Data Controller.

4. Destination of the Data.

Upon completion of the provision of the Services, the Data Processor shall return the personal data to which it has had access and any existing copies, as instructed by the Data Controller in accordance with section 13.2 of the Agreement.

The Data Processor may retain a copy with the data duly blocked for as long as liabilities may arise from the performance of the provision of the Services.

5. Notification of Personal Data Breaches.

The Processor shall notify the Controller, without undue delay and in any event within a maximum of 24 hours, of any suspected or confirmed incident relating to data protection within its area of responsibility. Among other things, it must inform the Controller of any processing that may be considered unlawful or unauthorised, any loss or destruction of or damage to the data and any incident considered a data security breach. The notification must be accompanied by all information relevant for documenting and communicating the incident to the relevant authorities or affected data subjects.

The Data Processor shall, in addition, assist the Controller in relation to the notification obligations under the GDPR (in particular, Articles 33 and 34 of the GDPR) and any other applicable rule, present or future, that amends or supplements those obligations.

6. Exercise of Rights by Data Subjects.

The Data Processor shall provide the information and/or documentation requested by the Controller in order to respond to requests to exercise rights that the Controller may receive from the data subjects whose data are processed. The Data Processor must provide such information within reasonable time limits and, in any event, sufficiently in advance for the Controller to be able to meet the legally applicable time limits for responding to the exercise of these rights.

Where data subjects exercise their rights of access, rectification, erasure and objection, restriction of processing, data portability and not to be subject to automated individual decisions before the Data Processor, the latter shall communicate this by email to info@alumn-e.com. The communication must be made immediately so that it can be dealt with within the established legal time limits, and in no event later than two working days after receipt of the request, and shall be submitted to the Controller together with all information that may be relevant for resolving it.

7. Security.

With regard to technical and organisational security measures, the Data Processor must implement mechanisms to:

• Ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services.
• Restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident.
• Regularly test, assess and evaluate the effectiveness of the technical and organisational measures implemented to ensure the security of the processing.
• Pseudonymise and encrypt personal data, where appropriate.

In particular, the Parties have agreed on a list of measures that the Data Processor must implement, set out in Appendix A to this Data Processing Agreement.

If the Controller, after the formalisation of the Contract, requires the Processor to adopt or maintain security measures other than those agreed in this Annex I, or if such measures become mandatory under any future rule, and this significantly affects the costs of providing the Services, the Processor and the Data Controller shall agree on the appropriate contractual measures to address the effect that such modifications may have on the price of the Services.

8. Subcontracting

The Data Controller grants a general authorisation for the Data Processor to subcontract part of the Services to third-party entities or subcontractors (the “Sub-processor”). The Data Processor shall inform the Data Controller of the processing operations it intends to subcontract, clearly and unambiguously identifying the subcontractor and its contact details. The subcontracting may proceed if the controller does not object within 15 days.

The Data Processor shall exercise due diligence to select only those sub-processors that provide sufficient guarantees to implement appropriate technical and organisational measures, so that the subcontracted processing meets the requirements of the GDPR and the protection of the rights of the data subjects is ensured.

The Sub-processor, which shall also have the status of data processor, shall likewise be bound to comply with the obligations imposed on the Data Processor and the instructions issued by the Controller, as set out in this Data Processing Agreement. It is incumbent upon the Data Processor to regulate the new relationship in a contract signed by the Processor and the Sub-processor, so that the Sub-processor is subject to the same conditions (instructions, obligations, security measures…) and the same formal requirements as the initial Processor, as regards the proper processing of personal data and the guarantee of the rights of the data subjects. In the event of non-compliance by the Sub-processor, the Data Processor shall remain fully liable to the Data Controller as regards compliance with the obligations contained in this Data Processing Agreement.

The list of sub-processors authorised by the Data Controller is attached to this Data Processing Agreement as Appendix B.

9. International Data Transfers

The Data Processor shall not carry out international transfers of the personal data to which it has access, for which the Data Controller is responsible, unless it has the prior authorisation of the Data Controller or such transfers are duly regularised in accordance with Articles 45, 46 or 47 of the GDPR. This is without prejudice to the authorised sub-processors referred to in Appendix B that carry out certain processing on behalf of the data processor in territories outside the European Economic Area, which have entered into with the data processor the corresponding standard contractual clauses approved by the European Commission (“SCCs”), an agreement signed between both entities whereby the non-EU company guarantees that it applies European data protection standards

10. Liability

The Processor shall be deemed a controller if it uses the data covered by this Data Processing Agreement for other purposes, communicates them or uses them in breach of the provisions of this Data Processing Agreement, and shall be liable for the infringements it has personally committed.

The Controller must immediately inform the Processor of any sanctioning proceedings brought against the Data Controller by the AEPD (Spanish Data Protection Agency) or any other competent authority for such breaches or defective compliance, so that the Processor may take charge of the legal defence, acting at all times in coordination with the Controller and preserving its public image and reputation.

Each Party shall hold the other harmless against claims, compensation, actions and expenses arising from claims that the Party is obliged to pay by virtue of a final judgment or arbitration award issued by a competent court, or by virtue of an agreement reached between a Party and third-party claimants, resulting from non-compliance or defective compliance with the applicable regulations.

APPENDIX B – ARTIFICIAL INTELLIGENCE

ALUMNE offers various services related to the use of artificial intelligence. To use these services, the CLIENT must purchase credits in the packages indicated in its “My Alumne LMS account” section.

The costs associated with the Artificial Intelligence services are:

• GPT-4 model: 0.06€/1K words.
• Whisper: 0.03€/minute.
• Images: 0.15€/image.

Prices do NOT include VAT. These prices may be updated by ALUMNE whenever it deems appropriate, simply by amending these conditions and sending an email communication to the CLIENT.

These costs shall be deducted, according to usage, from the CLIENT's available credit. If the client has no credit, these AI-based features shall not be available. ALUMNE informs the CLIENT that it uses the Open AI infrastructure to perform the Artificial Intelligence-based features. The CLIENT shall use them at its own risk. ALUMNE does not recommend disclosing confidential or personal data through these systems.

The CLIENT acknowledges that Alumne integrates and uses functionalities provided by third-party platforms, including, but not limited to, the OpenAI API or similar for artificial intelligence features ("Third-Party Services").

The CLIENT accepts and acknowledges that ALUMNE has no control over the Third-Party Services and therefore cannot guarantee their availability, accuracy, functionality or suitability for the User's specific needs. ALUMNE shall not be liable for any loss, damage or harm resulting directly or indirectly from the use of the Third-Party Services. This includes the client, or any of its users, providing personal data to these features. The CLIENT is ultimately responsible for such data and for warning its users not to provide them, Alumne being a mere tool.

The CLIENT agrees to release ALUMNE from any liability in this regard. It acknowledges that the Third-Party Services may be modified, updated, interrupted or discontinued at any time without prior notice and without any liability on the part of ALUMNE. Any interaction or contractual relationship between the User and the Third-Party Service providers takes place exclusively between the client and the third party. ALUMNE is not a party to, and bears no responsibility for, such interactions or relationships.

The CLIENT assumes all risks associated with the use of the Third-Party Services. This includes, but is not limited to, reliance on the accuracy, availability and usefulness of the services provided by the OpenAI API or similar. The CLIENT agrees to use the Third-Party Services at its own risk and discretion.

APPENDIX C – SECURITY MEASURES

Our infrastructure is mainly cloud-based; we use several providers for greater fault tolerance, and it is constantly being improved.

Our application has a distributed architecture, which allows us to keep the front end, the API and other services necessary for the operation of the application separate.

We use different information and communications encryption systems. Communications are encrypted by means of SSL certificates. Files of less than 50MB uploaded to the platform are encrypted with different algorithms, always at the cutting edge of technology and of cybersecurity best practice.

Backups are made daily in accordance with our backup policy. From our database server we keep a copy of the backups at different intervals, stored on our slave server.

The platform undergoes several security tests/audits each year. The aim is to find critical vulnerabilities and fix them. The platform is constantly evolving to ensure that we always use the latest technologies, resulting in greater security for our clients.

We handle personal data with the highest guarantees of privacy and security, using encryption systems for the most sensitive data, as well as dissociation mechanisms. Our platform implements various security mechanisms to prevent DoS attacks and other types of attack that may affect the quality of service. We have Firewall systems as well as various IP filtering and blocking mechanisms integrated directly into the platform.

The platform makes it possible to define a comprehensive password management and automatic renewal policy. As an administrator, you can decide whether you want your users to renew their password the first time they access the platform, as well as the expiry of passwords.

APPENDIX D – EMAIL

Alumne LMS offers all its clients the option of using one of our default email accounts to send emails from the virtual campus. These accounts are limited to 500 emails sent per day. The counting period starts at 00:00 each day and ends at 23:59.

If this figure is exceeded, emails stop being sent and are held in the platform's mail queues to be sent the following day, until the quota is filled. If the CLIENT wishes to send emails without limitations, it may configure its own email sending provider, using Microsoft or Google technology or SMTP technology.

ALUMNE warns clients that it shall under no circumstances be liable for the use they make of email sending from the Alumne LMS platform. If emails that may be considered fraudulent or SPAM are detected, the client's accounts may be suspended or access to the email sending features may be restricted until the situation has been clarified.

The CLIENT is reminded that it must comply with personal data protection legislation, as well as with all other legislation applicable to the sending of emails. In the event of non-compliance, the CLIENT shall be solely responsible, Alumne LMS being simply a tool used by the CLIENT to send the emails.

APPENDIX E – LEGAL DOCUMENTS

These terms of use, contracts and privacy policy are those of Alumne in respect of its clients. They are NOT documents designed to cover the client in respect of its own users.

Alumne informs the CLIENT that it must draw up terms of use/legal notice, a privacy policy and a cookie policy appropriate to the use it intends to make of the platform. These terms must be posted at a publicly accessible URL, which it may share through Alumne LMS by entering those URLs in the virtual campus settings section provided for that purpose.

Alumne shall under no circumstances be liable if the client does not publish such information or publishes it correctly, inaccurately or contrary to the law, the client being solely responsible.

Special mention must be made of the platform feature that allows students to share certificates/diplomas on their social networks or websites. ALUMNE is not responsible for the use the client makes of this feature; it is the client's responsibility to inform end users of the implications of sharing this information, as well as to configure the platform appropriately in accordance with its privacy policy.

APPENDIX F – LIMITS AND STANDARD USAGE

The purpose of this appendix is to set out the standard limits and forms of use of the Alumne LMS platform. Should the client need other limits to be applied to any of the features described herein, it must request a “Custom” deployment and negotiate tailored conditions with ALUMNE.

In general, the conditions of use and limits of each package are set out in the plans section of this website. In addition to what is described there, the free plan offers the creation of up to 3 courses and the management of up to 15 active users, 1 administrator and 1 teacher, plus 500MB of storage. Furthermore, the paid packages offer a maximum of 10% of the contracted users for administrators and teachers. For example: if a package of a maximum of 50 active users is contracted, there may be no more than 5 teachers or administrators. The 10% shall be the maximum for both types of user combined, relative to those contracted.

In order to guarantee a high quality of service and appropriate use of the platform, the following limits are established:

• Email processing and storage: If the client chooses to use the default email account offered by ALUMNE, it shall have a maximum of 500 emails that it may send per day. For both default email accounts and custom email accounts, emails are sent through a processing queue that runs every 3 minutes. This means that emails are NOT sent immediately and, depending on the queue load, may take more or less time to be sent. ALUMNE LMS offers the possibility of viewing sent emails, as well as checking whether they have been opened. This functionality depends on the technical characteristics of the email account to which the messages are sent (it may contain a blocker). Likewise, please note that emails sent in the last 7 days shall be stored, and those with earlier dates shall be deleted automatically. In any event, no more than 50,000 sent emails shall ever be stored. This also applies to sent and archived emails.
• Gamification: Alumne LMS individually records each of the points obtained by each user in the gamification process. To avoid data build-up, the CLIENT is informed that all users shall have a record, by way of default record, with the accumulated points obtained. Points obtained 6 months ago or more, or the oldest points obtained by users with 500 or more experience records, shall be added to that accumulated total. In this way, the individual experience record shall be lost in favour of the cumulative record when the circumstances indicated occur.
• Test attempts: By default, Alumne LMS shall save 3 attempts of each test taken by the user. Thus, if the administrator configures a test with unlimited attempts for the user, the user may make as many attempts as they wish, but will only be able to see the detailed result of the last 3 attempts. Detailed result means seeing the answer to each of the questions answered, seeing the result obtained and obtaining a full report of the attempt. From the third attempt onwards, all this information shall be automatically deleted, retaining only the information for the last three attempts. The total number of attempts made by the student shall, however, be saved as a counter.
• Closed courses: Alumne LMS shall archive information relating to users' access and progress once the course has been closed. This information may be recovered, but it should be borne in mind that this is not an automatic process, the automatic recovery process being limited to 10 courses per day. Until the course data have been recovered, students shall not be able to access it and teachers and administrators shall not be able to obtain reports or recalculate marks and/or progress.
• Blocked users: Alumne LMS shall archive information relating to access and progress in the various courses in which a blocked user was enrolled. This information may be recovered, but not immediately. A maximum of 100 users shall be processed each day. In any event, both the user and the administrator shall be informed that the information for that user is not available at that time until the recovery process has been completed. Users shall not be allowed to access the courses for which the access and progress information is in the process of being recovered. Administrators shall not be allowed to carry out processes to recalculate marks and/or progress.
• Ratio of blocked users to active users: a ratio of 4 blocked users for each active user in the system is established. By way of example: if a CLIENT has contracted a 50-user package, it may have up to 200 additional blocked users. Once this ratio is exceeded, ALUMNE may ask the CLIENT to delete the blocked users exceeding the ratio or may request an increase in the active users contracted. If, 30 days after the notice, which shall be given by email, the CLIENT has not made the adjustment, ALUMNE shall delete the oldest blocked users until the ratio is reached.

APPENDIX G – BACKUPS

Alumne makes daily backups of its systems. Backups are stored in a facility that is physically and logically separate from the production environments.

Full backups are made. Two backups corresponding to the daily frequency are kept (the copies from the last two backup processes). In addition, an additional copy is kept on a weekly basis. 7 full copies of the databases are kept.

Backups are stored for the purpose of enabling disaster recovery. Selective data restorations, or restorations requiring forensic work by the Alumne team, shall not be carried out.

Backups may only be restored by the Alumne team. The Alumne team shall inform the client that a restoration is going to be carried out, where applicable, as well as of any data loss that may occur, which may not exceed 7 days (if the last weekly copy is restored) or 48 hours (if one of the daily copies is restored).

APPENDIX H – FREE VERSION

Registration and Activation

The free version of Alumne LMS can be registered automatically through the website alumnelms.com. It is a version with particular and limited features, offering access only to the most basic functionalities of the system.

Features Included

• Access to course management.
• Access to user management.
• Access to the basic functions associated with them.
• Storage capacity limited to 500MB.
• Capacity for up to 15 students.
• Capacity for up to 3 courses.
• Capacity for 1 teacher.
• Capacity for 1 administrator.

Limitations

• The free version does NOT allow visual customisation of the virtual campus, or any kind of customisation (email, etc.).
• It does not include priority technical support; support shall be limited to self-help resources and community forums.
• It does not include integrations with third-party applications.

Inactivity and Deletion of the Instance

Alumne shall keep the instance active until it detects a period of inactivity of one month (30 calendar days) or longer. In this case, it shall notify the main administrator so that they access the platform. If the platform is not accessed, Alumne shall delete the instance together with all the content and data associated with it. The CLIENT accepts this clause by the mere fact of accessing the free version and releases Alumne from all liability related to the deletion of the virtual campus due to inactivity.

Upgrade to a Paid Version

The CLIENT may request an upgrade of the platform to one of the paid versions at any time. To do so, it must pay the Fee corresponding to the desired paid version through the automated payment gateway offered by ALUMNE on its website alumnelms.com or in the virtual campus itself.

Conditions of Use and Liability

• The CLIENT undertakes to use the free version in accordance with the applicable laws and Alumne's usage policies.
• Alumne reserves the right to modify the conditions of the free version at any time, notifying registered users via the email address provided at registration.

Privacy and Data Protection

The CLIENT accepts that the data provided through the use of the free version shall be handled in accordance with Alumne's Privacy Policy, available at alumnelms.com.

Limitation of Liability

Alumne shall not be liable for any indirect, incidental, special, consequential or punitive damages arising from the use of the free version.

Termination of the Service

Alumne reserves the right to discontinue the offer of the free version at any time, subject to giving users at least 30 days' prior notice.

Misuse

Alumne makes the free version of Alumne LMS available to the community with the aim of helping companies and professionals take their first steps in the world of online training. For this reason, it does not support improper use of the platform in any of its forms.

By way of example but not limitation, fraudulent or illegal use of the platform means any use that is contrary to the law, ethics or morality. Training related to weapons, drugs or animal abuse, training that violates human rights or training that promotes hatred or terrorism, among others, shall not be permitted.

No more than one platform may be registered per person/professional or per company (CIF/tax identifier). If it is detected that more platforms than permitted are being registered (by email domain, by name of the main administrator, etc.), they shall be deleted automatically and at Alumne's discretion. The user acknowledges being aware of this limitation and shall avoid duplicating user accounts or having more than one user account in the free service.

APPENDIX I – Alumne Store

What is it?

Alumne Store is a feature available in Alumne LMS that allows courses to be installed with a single click for use in your own Alumne LMS platform. The courses are made available by ALUMNE and must be used in accordance with these conditions of use.

What can I do with Alumne Store courses?

• Give your students access so that they can take them within the Alumne LMS platform you are using.
• Edit the content making up each course. Delete content. Add new content and create your own versions.
• Use these courses in accordance with the intellectual property rules in force.

What can I NOT do with Alumne Store courses?

• You may NOT use Alumne Store courses outside an Alumne LMS platform.
• You may NOT make partial or complete copies of the content for use outside the Alumne LMS platform. You are granted a licence of use to deliver them to your students within the Alumne LMS platform you are using.
• You may NOT download the content making up the courses. You may not access the individual editing of such content or use it on other platforms.
• You may NOT publish them on your own channels, websites and/or social networks.
• You may NOT sell the courses to third parties or obtain any kind of direct financial benefit from the sale of the courses, as they are content offered by ALUMNE and its collaborators so that you can offer them to your employees/students/users free of charge.

How does Alumne Store work?

To install a course from the Alumne Store, simply go to the "AStore" section located in the course management area, as an administrator. Once there, you simply need to select the course you want to install. To install a course, you will need a version of Alumne LMS appropriate to the one indicated by the course. Courses may be Free, available to all Alumne LMS users, including those on its free version; or Premium, available only to users of the paid versions of Alumne LMS.

New Content

ALUMNE shall not be obliged to publish new courses or to keep the content of those currently published up to date. Some courses available in Alumne Store are owned by third-party collaborators of ALUMNE. ALUMNE is not responsible for such content or its maintenance.

Liability

ALUMNE is not responsible for the correct functioning of all the content and links stored in the Alumne Store courses. They are offered at no additional cost, so ALUMNE does not guarantee the accuracy, correctness or functioning of the courses included in Alumne Store. ALUMNE shall not be liable for any inaccuracy or lack of correctness of the content included in the courses. ALUMNE shall not be liable for any misuse you may make of the courses, or for any infringement of intellectual or industrial property that you may commit in using the Alumne Store courses. If misuse of the Alumne Store content is detected, the courses shall be removed from your Alumne LMS campus and your access to the Alumne Store shall be restricted.