Terms and Conditions

1. About us and scope of application

1.1. The PRYSMA software platform (“PRYSMA”/ “the Platform”) is owned and operated by D&D Consultants Grup S.R.L., a company incorporated and operating under the laws of Romania, with its registered office at Str. Aleea Ilioara nr. 1, bl. PM29, sc. B, ground floor, ap. 37, District 3, Bucharest, correspondence address at Str. Icoanei, Nr. 29A, 020456 District 2, Bucharest, registered with the Trade Register under no. J2002010108402, unique registration code RO14937087.

1.2. This document governs the access to and use of the Platform for the administration of psychological tests and assessments, including the web interface, applications, databases, algorithms, reports and related services. The Platform is intended for use by professional clients, including psychologists, human resources specialists, psychiatrists, mental health specialists, clinics and medical centres, individual practices and other providers of medical or psychological services, employers, educational institutions or other entities or persons authorised to use psychological or professional assessment instruments, as applicable.

1.3. PRYSMA operates as a technical infrastructure through which Clients (defined in Section 2 below), after creating an account and paying for the services provided by the Platform, send electronic invitations to complete tests to Participants (defined in Section 2), collect their responses through the Platform and automatically generate Reports (defined in Section 2) or profiles based on the responses received. PRYSMA does not determine the purpose of the assessment, does not select the Participants, does not professionally interpret the Reports and does not decide how the Client subsequently uses the Reports or the generated profiles.

1.4. If you are a consumer natural person, within the meaning of national and European consumer legislation, and you contract directly with PRYSMA outside a professional activity, Annex 2 (Information for consumers) applies in addition. Annex 2 does not apply to Participants invited by a Client to complete tests through the Platform, if they do not purchase services directly from PRYSMA.

1.5. If you are a Client, this document applies in full, including the clauses on limitation of liability and the prohibition of refunds, to the extent permitted by law.

2. Definitions

2.1. “Platform” or “PRYSMA” means the online platform developed and managed by the entity referred to in Art. 1.1, for the purpose of facilitating the assessments carried out by Clients. The Platform includes the software infrastructure, the web interface, the databases, the algorithms, the reports and the digital services provided through it. The Platform does not provide psychological, medical, clinical, psychiatric, human resources or legal counselling services, and the Reports issued require analysis, interpretation and use by the Clients or by the Professional Users designated by them.

2.2. “Owner” means D&D Consultants Grup S.R.L., a company incorporated and operating in accordance with the laws of Romania, having the identification details indicated in Art. 1.1.

2.3. “Client” means the professional, entity or person who concludes the contract with PRYSMA, creates an Account, pays for the services and uses the Platform to invite Participants to complete tests, to administer tests and to generate Reports. The Client may be, as applicable, a psychologist, human resources specialist, psychiatrist, mental health specialist, clinic or medical centre, individual practice and other providers of medical or psychological services, an employer, an educational institution or another professional user of the Platform.

2.4. “Professional User” means the natural person authorised by the Client to use the Client’s Account or functionalities of the Platform in the name or on behalf of the Client.

2.5. “Participant” means the natural person invited by the Client, through an electronic invitation sent via the Platform, to access the Platform and complete tests, questionnaires or assessments.

2.6. “Participant Data” means any data provided by Participants or generated in connection with their use of the Platform, including identification and contact data, test responses, scores, profiles, Reports, technical metadata related to the administration of the assessment and, as applicable, personal data belonging to special categories, including health data or data related to the psychological assessment.

2.7. “Reports” means the documents, profiles or results automatically generated by the Platform, at the request of the Client or of the Professional User, based on the data provided by Participants, including their responses to the completed tests. The Reports are support instruments and do not constitute, by themselves, a diagnosis, professional recommendation, HR decision, counselling, treatment or final professional assessment.

2.8. “Subscription” means the Client’s temporary right, activated upon payment of the corresponding fee, to access the Platform and the functionalities included in the subscription plan chosen by the Client.

2.9. “Aggregated Data” means data processed in such a way that it does not allow the identification of a person, directly or indirectly, under the conditions of the law.

2.10. “Anonymised Data” means data irreversibly processed in such a way that the data subject can no longer be identified, directly or indirectly, by reasonable means, under the applicable legislation.

3. Acceptance of the Terms

3.1. By creating the Account and/or using the Platform, you expressly declare that you have the legal capacity and that you accept this document.

3.2. If you use the Platform on behalf of an entity, you declare that you have the necessary authority to accept this document on behalf of that entity.

3.3. For consumers, mandatory legal rights prevail over any contrary provisions contained in these Terms and Conditions.

3.4. If you do not accept the Terms and Conditions, you may not use the Platform.

4. Description of the service and intended purpose

4.1. PRYSMA provides the Client with technical tools for creating and managing the Account, sending electronic invitations to Participants, administering tests and assessments, collecting Participants’ responses, using the Reports automatically generated by the Platform as well as the Participants’ profiles, and viewing and exporting the data and Reports in the formats made available by the Platform.

4.2. The Client is the one who determines the purpose of the assessment, selects the Participants, chooses the tests or assessments used, decides whether and how to use the Reports and is responsible for any interpretation, feedback, counselling, recommendation, human resources decision, clinical decision, communication to third parties or other subsequent use of the Reports or profiles generated through the Platform.

4.3. PRYSMA does not provide medical, psychological, clinical, diagnostic, psychotherapy, psychiatry, human resources, coaching, counselling or personalised recommendation services or any other services of a medical/palliative/similar nature. PRYSMA does not determine how the personal data voluntarily uploaded by Participants onto the Platform is used, does not make decisions regarding Participants and does not become involved in the professional relationship between the Client and the Participant or in the relationship between the Client and any third-party beneficiary of the assessment.

4.4. The Platform does not make solely automated decisions with legal or similar effects on Participants. The Reports are generated automatically as support instruments and must be interpreted and used by the Client with adequate human intervention, depending on the professional context of the assessment.

4.5. The Platform offers no warranties of any kind, express or implied, including, but not limited to, warranties of fitness for a particular purpose, population, industry, decision, professional methodology or jurisdiction.

4.6. The Platform is used on an as-available basis and, as such, within the limits of the automatically generated functionalities, without any warranty as to the ability to generate specific content shaped according to the expectations of the Client or of the Professional User.

5. Eligibility to access the Platform

5.1. Participants are the persons invited by the Client through a link generated from the Platform. The Client is solely responsible for ensuring that the Participant can be lawfully assessed and, in the case of minors, that parental consent or another valid legal basis exists for the assessment and for the processing of the Participant’s data.

5.2. The Client warrants that it does not invite minors unless a valid legal basis exists and, where consent constitutes the legal basis, the consent of the holder of parental responsibility has been obtained in accordance with the applicable legislation. PRYSMA may request from the Client any confirmations or supporting documents regarding the existence of the parental consent or of the applicable legal basis.

6. Accounts and security

6.1. Each Account is individual and non-transferable, except for the access granted by Clients to the Professional Users authorised by them, within the limits of the functionalities made available by the Platform.

6.2. The Client is responsible for the confidentiality of the login credentials, as well as for all activities carried out through its Account by the Professional Users authorised by it.

6.3. Unauthorised sharing of the Account, simultaneous use by several persons outside the limits of the applicable plan, transfer of access or unauthorised vulnerability testing are prohibited. The Platform reserves the right to use or introduce appropriate functionalities to control this security limit and may restrict or suspend access to the Account where there are reasonable suspicions that it is being used in breach of this provision.

7. Subscriptions, payments and fees

7.1. The subscription plans, prices and included services are described in the Platform interface.

7.2. The Owner reserves the right to change the prices or the structure of the plans with reasonable prior notice and/or the structure of the subscription plans, with prior notification of the Client at least 30 days before the changes take effect. The changes do not affect orders already confirmed or subscriptions already paid for the current contractual period, unless the parties agree otherwise.

7.3. For Clients, the amounts paid are non-refundable, except in situations of material breach which PRYSMA does not offer to remedy, although it had a legal or contractual obligation to do so.

7.4. For consumers contracting directly with PRYSMA, the right of withdrawal and the refund policy apply in accordance with Annex 2 (Information for consumers). The performance of the service and the issuance of a Report in the Platform may result in the loss of the right of withdrawal only under the conditions of the applicable law and of Annex 2.

8. Permitted use and usage restrictions

8.1. The Client shall not use the Platform unlawfully, in a discriminatory manner, to infringe the rights of third parties or to attempt unauthorised access, scraping, crawling, reverse engineering or the introduction of malicious code. Furthermore, the Client shall not introduce malware, viruses or any other harmful code into the Platform and shall not test the Platform’s vulnerabilities.

8.2. The Client shall not use the Platform to make solely automated decisions producing legal effects on Participants or similarly significantly affecting them, except to the extent that all applicable legal conditions are met, including adequate information, the existence of a valid legal basis and the safeguards necessary for the protection of the Participants’ rights.

8.3. The Platform does not offer customised interoperability services. By issuing the Reports and providing the ability to export them in the formats made available, the Platform fulfils any applicable legal obligation to ensure portability or interoperability, to the extent that such an obligation is incumbent upon it.

9. AI rules and prohibited uses

9.1. Any algorithmic functionality of the Platform is intended exclusively for the purpose stated in Section 4.

9.2. Use of the Platform for social scoring practices, namely for the classification or evaluation of persons based on their behaviour or characteristics, in the cases prohibited by law, as well as for emotion recognition in the situations where it is prohibited by the applicable legislation, is forbidden.

9.3. PRYSMA may deactivate certain functions or all functions if it identifies non-compliance or has a reasonable suspicion regarding the imminent occurrence of non-compliance.

9.4. The Client and the Professional Users may not use AI engines, external artificial intelligence systems or similar tools to extract, reproduce, analyse, train on, reconstruct or obtain Reports or information from the Platform, unless PRYSMA has given its prior written consent.

10. Intellectual property

10.1. All tests, items, norms, algorithms, scoring methods, reports, texts, graphics and components of the Platform are protected by copyright belonging to PRYSMA through its own copyright or through exclusive or non-exclusive licences.

10.2. Copying, reproducing, distributing, capturing the screen, including through print screen functionalities, republishing, systematically extracting and training artificial intelligence models on the content of the Platform, without PRYSMA’s prior written consent, are prohibited.

10.3. The Reports are licensed to the Client on a non-exclusive, non-transferable basis, exclusively for personal use and for the permitted professional use in the relationship with the Participant on whose behalf the Client carries out the assessment, without the right to sublicense, republish or independently exploit the content of the Platform.

10.4. The Client retains all rights over the data it enters into the Platform. PRYSMA does not acquire any intellectual property right over the data entered by the Client or over the Participant Data, except for the right of use for the purpose of providing the services, issuing the Reports and using the Aggregated or Anonymised Data under the conditions of Art. 16.

11. Data protection roles and distinct purposes

11.1. PRYSMA acts as an independent controller for the data it collects for its own purposes, such as account data, billing, logging, security, support, Platform usage analysis, product improvements and its own commercial communications, under the conditions of the applicable privacy notice.

11.2. With regard to the Participant Data processed for the administration of tests, the collection of responses and the generation of Reports at the Client’s request, the Client acts as controller and PRYSMA acts as processor, processing the Participant Data based on the Client’s documented instructions, in accordance with Annex 1 (Data Processing Agreement).

11.3. The Client is exclusively responsible for determining the purpose of the assessment, choosing the tests, selecting the Participants, sending the invitations, informing the Participants, identifying the applicable legal basis, obtaining explicit consent where necessary, interpreting the Reports and any decision, recommendation, counselling, feedback, communication to third parties or other subsequent use of the Reports or profiles generated through the Platform.

11.4. PRYSMA does not control and is not liable for the subsequent processing carried out by the Client or by the third parties to whom the Client communicates the Reports, including employers, educational institutions, clinics, beneficiaries of the assessment or other persons.

11.5. Further details on the processing of Participant Data in the controller–processor relationship can be found in Annex 1 (Data Processing Agreement), an integral part of the Terms and Conditions.

12. Legal basis for special categories of data

12.1. The Client warrants that it has identified a valid legal basis for the processing of the Participant Data, including, where applicable, an applicable exception under Art. 9 GDPR for the processing of special categories of data, such as health data or psychological data.

12.2. The Client guarantees to the Participants that their legal rights regarding the personal data collected will be respected, including the right of access to the data, the right to be informed about the purpose of the processing, the period for which the data is stored, the recipients of the data, the manner in which the data is processed and, in particular, whether profiles are created based on the processed data, as well as the consequences of such processing.

12.3. The Client is responsible for obtaining, documenting and managing the Participants’ consent for the processing. PRYSMA may make available a technical information or confirmation flow in the Platform, but this flow does not release the Client from the responsibility of establishing the legal basis, informing the Participant, and obtaining and documenting the consent or another applicable legal basis.

12.4. At the Platform’s request, the Client shall provide the supporting documents demonstrating the legal basis of the assessment and, as applicable, the existence of the consent and/or of the parental consent.

12.5. PRYSMA may immediately suspend any processing of personal data raising reasonable suspicions of a breach of the law and may request any information or documents from Clients in order to clarify the situation.

13. Automatically generated Reports and human oversight

13.1. The Reports are generated automatically from responses and represent support instruments. They do not constitute a diagnosis, medical, psychological, clinical, psychiatric, human resources or legal recommendations and do not substitute independent professional assessment.

13.2. The interpretation of the Reports by a competent or accredited professional, as applicable, is the responsibility of the Client. The Client is responsible for informing the Participants and for ensuring that the Reports are not used as the sole decision-making criterion in situations producing legal or significant effects on the Participants, unless all applicable legal conditions are met (without this transferring to the Platform the responsibility of verifying the applicability and fulfilment of those legal conditions).

13.3. The Client is responsible for any subsequent use of the Report, including feedback, counselling, coaching, human resources decisions, clinical or professional recommendations, communications to employers, educational institutions, clinics, third-party beneficiaries or other persons.

14. Availability, maintenance and service changes

14.1. The Platform makes reasonable efforts to ensure the highest possible degree of availability, but does not guarantee the uninterrupted operation of the Platform.

14.2. The Platform may temporarily suspend access for maintenance, updates, security reasons or for any other reasonable ground identified by it.

14.3. Any significant change to the functionalities will be notified in advance, granting a reasonable period until implementation, whenever possible.

15. Data export, retention and deletion

15.1. The Client may export Reports and its own data in the formats made available by the Platform.

15.2. The Client is responsible, as controller, for establishing the retention periods applicable to the Participant Data and for deleting it from the Account when its retention is no longer necessary for the purposes established by the Client. PRYSMA makes export and deletion functionalities available to the Client, within the technical limits of the Platform.

15.3. During the term of the contract, the Participant Data remains available in the Client’s Account in accordance with the Platform’s functionalities and the Client’s instructions. PRYSMA is not obliged to unilaterally delete the Participant Data from the Clients’ active Accounts, unless this is required by law, by this document or by the Client’s instructions communicated in accordance with the Platform’s functionalities.

15.4. Upon termination of the contract for any reason, PRYSMA will allow the Client, for a maximum period of 24 months, to export the Participant Data and the Reports available in the Account. After the expiry of this period, PRYSMA may delete or anonymise the Participant Data (at its choice), except for the data that PRYSMA is legally obliged to retain, backup copies, the data of Participants who have provided special consent for scientific or statistical research, as well as all other data that must be temporarily retained for technical reasons, and the Anonymised Data.

16. Aggregated data and anonymised data

16.1. PRYSMA may use Aggregated Data and Anonymised Data for statistical analysis, service improvement, research, benchmarking and product development, provided that such data does not allow the identification of persons under the conditions of the law. PRYSMA will not use identifiable Participant Data for research, product development or other own purposes incompatible with the Client’s instructions, unless a valid legal basis and adequate information exist.

17. Security and incidents

17.1. PRYSMA maintains adequate technical and organisational measures to ensure security against cybersecurity incidents, including, without limitation, periodic security testing and vulnerability management. However, the Platform does not guarantee the absence of all attacks or cybersecurity incidents.

17.2. PRYSMA notifies the Client, without undue delay and within no more than 72 hours of becoming aware, of any security incident affecting the Participant Data, providing the reasonable information available at that time, including the nature of the breach, the categories and approximate number of data subjects affected and the measures taken or proposed to remedy the incident.

18. Limitation of liability

18.1. PRYSMA is not liable for losses of any kind, including losses or damages, including indirect losses, loss of profit, loss of data, reputational damage, labour disputes, HR decisions, clinical decisions, educational decisions, professional decisions or other indirect or consequential damages, to the maximum extent permitted by law.

18.2. PRYSMA is not liable for the interpretation of the Reports, for the decisions or recommendations made by the Client or by third parties, for the counselling, coaching, feedback or communications carried out based on the Reports, or for the use of the Reports outside the Platform.

18.3. PRYSMA is not liable for the accuracy, completeness or adequacy of the information, data, responses or instructions provided by the Client or by the Participants, nor for the consequences generated by incorrect, incomplete, outdated, non-compliant data or data entered in breach of the law.

18.4. PRYSMA is not liable for the failure to inform the Participants, for the failure to obtain the consent or any other legal basis necessary for the assessment, for the breach of the Client’s professional obligations or for the use of the Platform outside the purpose permitted by these Terms and Conditions.

18.5. PRYSMA is not liable for the actions, omissions, decisions, recommendations, communications or subsequent processing carried out by the Client, its affiliates, its employees, collaborators, consultants, end beneficiaries or any other third parties who receive, access or use the Reports or the information generated through the Platform.

18.6. PRYSMA is not liable for the temporary unavailability of the Platform, interruptions, delays, technical errors, incompatibilities, loss of access or functionality limitations caused by third-party providers, internet services, devices, IT systems, browsers, technical configurations, maintenance, cybersecurity incidents or other events beyond PRYSMA’s reasonable control.

18.7. The limitation under Art. 18.1 and 18.6 does not apply in the case of intentional breaches of the legal obligations regarding data processing.

18.8. In the case of consumers, PRYSMA’s liability is limited to the maximum extent permitted by the legislation applicable to them.

19. Indemnification

19.1. The Client will indemnify PRYSMA for any third-party claims resulting from the unlawful use of the Platform or use contrary to its purpose, from the breach of the Terms and Conditions applicable to the Platform, from the infringement of third-party rights or of the applicable legislation, including data protection rules, to the extent permitted by law.

19.2. The Client will indemnify PRYSMA for any claims made by Participants or third parties in connection with the purpose of the assessment, the lack of a valid legal basis, the lack of adequate information, the lack of consent or of parental consent, where these are necessary, the interpretation of the Reports, the Client’s decisions or recommendations or the communication of the Reports to third parties, to the extent that the claims are not directly caused by PRYSMA’s breach of its obligations under these Terms and Conditions.

20. Suspension and termination

20.1. PRYSMA may suspend or close Accounts for non-payment, fraud, abusive use, breach of the applicable Terms and Conditions, endangerment of security or for any other significant breach by the Client of its obligations.

20.2. PRYSMA may suspend the administration of certain tests, access to certain Reports or functionalities or the entire Account where there are reasonable suspicions that the use of the Platform breaches the applicable legislation, the Participants’ rights, the data protection obligations or the usage restrictions provided in this document, as well as where there is a reasonable suspicion that the collected data is used for the commission of a criminal offence or may be contrary to public order or good morals.

20.3. Upon termination of the contract, Art. 15 on the export, retention and deletion of data applies.

21. Changes to the Terms and Conditions

21.1. The Owner may amend the Terms and Conditions for legitimate reasons, such as changes in the provision of the services, legislative changes, security requirements or operational needs.

21.2. Clients will be notified of the changes that have an impact on them, within a reasonable period in advance. The notification will be made through the Platform.

21.3. If they do not accept the change, Clients may terminate the contract for the use of the Platform, without penalties, before the change takes effect. Continued use after the effective date of implementation of the change constitutes acceptance.

22. Force majeure

22.1. PRYSMA is not liable for the non-performance or delayed performance of its obligations caused by events beyond its reasonable control, including, but not limited to: natural disasters, wars, pandemics, cyberattacks, infrastructure interruptions or governmental actions. If the force majeure event continues for a period longer than 60 (sixty) days, either party may terminate the contract without penalties.

23. Governing law and jurisdiction

23.1. This contract is governed by Romanian law.

23.2. Consumers may bring actions before the courts of their state of residence (where applicable) and may not be sued elsewhere except in accordance with the law.

23.3. Disputes with professionals are settled by the competent courts, unless the law provides otherwise.

24. Final provisions

24.1. These Terms and Conditions produce binding legal effects between the Platform and the Client and are binding upon them.

24.2. To the extent that any provision of the Terms and Conditions is or subsequently becomes unlawful, null or unenforceable in accordance with the applicable law, the legality, validity and enforceability of the other provisions of the Terms and Conditions shall not be affected or impaired by this event. The Platform will make all efforts to make to the Terms and Conditions those amendments necessary to produce the same commercial effect intended at the time of their drafting.

24.3. Any legal communications shall be made to the contact details communicated in the Platform.

24.4. The non-exercise or delayed exercise by PRYSMA of any right provided in this document does not constitute a waiver of that right.

24.5. This document, including its Annexes, constitutes the entire agreement between the Platform and the Client with regard to its subject matter and replaces any prior understanding or communication, written or verbal, regarding the same subject matter.

24.6. The Client may not assign or transfer the rights or obligations arising from this document. PRYSMA may assign or transfer this document to an affiliate or as part of a merger, acquisition or sale of assets, the Client expressing its consent in advance to this operation.

Annex 1 — Data Processing Agreement

1. Purpose, scope and roles

1.1. This annex establishes the rules applicable to the processing of Participant Data by PRYSMA as the Client’s processor, in connection with the administration of tests and assessments through the Platform, the sending of invitations, the collection of responses, the generation of Reports and the provision of related functions on the Client’s instructions.

1.2. The Client acts as controller of the Participant Data and establishes the purposes of the assessment, the legal bases, the invited Participants, the tests used, the recipients of the Reports, the retention periods and the subsequent uses of the Reports or profiles generated through the Platform.

1.3. PRYSMA acts as processor for the Participant Data processed on behalf of the Client in the context of the administration of the assessments, within the meaning of Art. 28 GDPR. In this capacity, PRYSMA will process the Participant Data exclusively in accordance with the Client’s documented instructions, will ensure the confidentiality of the processing, will notify the Client before any international transfer of the Participant Data, will implement adequate technical and organisational measures to ensure the fulfilment by the Client of the obligation to respond to Participants’ requests regarding the exercise of their rights and will cooperate with the Client with a view to fulfilling the Client’s obligations under the data protection legislation.

1.4. PRYSMA acts as an independent controller for the data it collects for its own purposes, such as account data, billing, logging, security, support, Platform usage analysis, product improvements and its own commercial communications.

1.5. The Client is responsible for any subsequent processing of the Participant Data or of the Reports outside the Platform, including communication to employers, educational institutions, clinics, third-party beneficiaries, Participants or other persons.

2. Categories of data, sources and data subjects

2.1. In the context of providing the Platform, PRYSMA may process the following categories of Participant Data as processor:

1. identification and contact data of the Participant, to the extent provided by the Client or by the Participant;
2. responses to tests, questionnaires or assessments;
3. scores, indices, profiles and automatically generated Reports;
4. technical metadata related to the Participant’s use of the Platform, including information regarding the device, the session, the IP address and technical logs, to the extent necessary for operation, security and audit;
5. data belonging to special categories, including health data or psychological data, to the extent that it results from the nature of the tests or assessments administered by the Client.

• Operational account data: username and password, profile settings, usage logs, support data.
• Data for billing and compliance: postal address (where necessary), tax data of the payer (in the case of paid accounts, transaction history), data regarding the invitation and the administration of the assessment, including the allocated test, timestamps, the status of the invitation and the completion session;

2.2. Separately, PRYSMA may process, as an independent controller, data of the Client and of the Professional Users, such as name, surname, e-mail address, telephone number, organisation, role, authentication data, billing data, transaction history, support data, usage logs and technical data.

2.3. The source of the Participant Data is the Client, who sends invitations and may provide initial contact data, the Participant, who completes the tests or assessments, as well as automatic collection through the use of the Platform.

2.4. PRYSMA does not routinely request the personal identification number or other national identification numbers. If, in limited situations, such data is necessary under the law or is entered by the Client, the Client is responsible for the existence of the legal basis and for the application of the additional safeguards provided by law.

3. Purposes of the processing and legal bases

3.1. For the Participant Data processed by PRYSMA as processor, the purposes of the processing are the provision of the services to the Client, namely the sending of invitations, the administration of tests, the collection of responses, the generation of Reports, making them available to the Client, ensuring the security of the Platform, technical support and the fulfilment of PRYSMA’s contractual obligations towards the Client.

3.2. The legal basis for the processing of the Participant Data is established by the Client, as controller. The Client is responsible for identifying the adequate legal basis under Art. 6 GDPR and, if special categories of data are processed, for identifying an applicable exception under Art. 9 GDPR.

3.3. For account, billing, support, security, Platform usage analysis, product improvement and own communications data, PRYSMA acts as an independent controller and processes the data based on the grounds indicated in the applicable privacy notice.

4. Explicit consent and special categories of data

4.1. Where the legal basis of the assessment or of the processing of special categories of data is consent, the Client is responsible for obtaining valid consent, including explicit consent, if necessary under Art. 9 GDPR.

4.2. PRYSMA may make available a technical flow through which the Participant is shown information regarding the processing through the Platform or through which the Participant confirms certain options, but this flow does not release the Client from the responsibility of establishing the legal basis, informing the Participant and documenting the consent or another applicable legal basis.

4.3. In the case of minors, the Client is responsible for obtaining the consent of the holder of parental authority where this consent is necessary under the applicable legislation.

4.4. PRYSMA may use Anonymised Data for research, statistical analysis and service improvement. Identifiable Participant Data will not be used for research or product development unless a valid legal basis and adequate information exist.

5. Transparency and information

5.1. PRYSMA may make available to Participants, within the technical flow for accessing the test, information regarding the processing carried out through the Platform.

5.2. The Client remains responsible, as controller, for providing complete information regarding the purpose of the assessment, the legal basis, the recipients of the Reports, the consequences of the assessment, the data storage period, the Participant’s rights and any subsequent use of the Report outside the Platform.

5.3. The Client undertakes not to send invitations to Participants and not to use the Platform for their assessment until it has fulfilled the information obligations incumbent upon it under the applicable legislation.

6. Recipients and categories of recipients

6.1. PRYSMA may communicate the Participant Data to the following categories of recipients, to the extent necessary and proportionate to the purposes:

1. the Client and the Professional Users authorised by the Client, for the provision of the Reports and the administration of the assessments;
2. providers of technology, infrastructure, security, communication and assistance services, contractually registered as processors or sub-processors, as applicable;
3. professional consultants, including legal consultants, auditors or security specialists, for compliance, audit and defence of rights purposes;
4. public authorities or courts of law, where the law legitimately requires or permits it.

6.2. The Client receives the Reports and the Participant Data as controller. Any subsequent communication to employers, educational institutions, clinics, third-party beneficiaries, Participants or other persons is carried out by the Client, on its own responsibility.

7. International data transfers

7.1. If data is transferred outside the European Economic Area, PRYSMA will ensure the existence of a valid transfer mechanism, such as an adequacy decision or standard contractual clauses, and will implement, where applicable, adequate additional technical or contractual measures, based on a transfer risk assessment.

8. Technical and organisational security measures

8.1. PRYSMA maintains a security program that it considers proportionate to the risks, which may include access control, data encryption where necessary, the keeping of activity logs and monitoring, logical segregation of data between clients, secure development policies, vulnerability management and periodic testing.

8.2. In the event of a personal data breach affecting the Participant Data processed on behalf of the Client, PRYSMA will notify the Client without undue delay and will provide the reasonably available information so that the Client can fulfil its notification and documentation obligations under the GDPR.

9. Data subjects’ rights

9.1. The Client is responsible for handling data subjects’ requests regarding the Participant Data, the assessment, the Reports and any subsequent use thereof, as well as for informing them of the rights they have under the applicable legislation.

9.2. If PRYSMA receives a request regarding the Participant Data processed on behalf of the Client, PRYSMA will redirect the request to the Client or will assist the Client, to the extent reasonable, in accordance with Art. 28 GDPR and this agreement.

9.3. PRYSMA will respond directly to data subjects’ requests exclusively with regard to the processing for which it acts as an independent controller, such as account data, billing, support, ensuring the security of the Platform or its own communications.

10. Policy regarding minors

10.1. PRYSMA is not a platform dedicated to or particularly intended for the assessment of persons who are minors or under the minimum age established by law for information society services in the data subject’s state of residence.

10.2. If the processing of minors’ data is necessary, the Client is solely responsible for identifying a valid legal basis and for obtaining the consent of the holder of parental authority where consent is the basis of the processing and such consent is required under the applicable law.

11. Retention and deletion

11.1. The Client establishes the retention period for the Participant Data in its Account and is responsible for deleting it when it is no longer necessary for the purposes established by the Client. PRYSMA offers export and deletion tools, within the limits of the Platform’s functionalities.

11.2. After the termination of the contract for any reason, PRYSMA will allow the Client to export the Participant Data and the Reports existing in the Account, for a maximum period of 24 months. After the expiry of this period, PRYSMA will delete or anonymise the Participant Data (at its choice), except for the data that PRYSMA is legally obliged to retain, backup copies temporarily retained for technical reasons, the data of Participants who have provided special consent for scientific or statistical research, the data whose retention is required by law, and the Anonymised Data.

11.3. Anonymised Data may be retained indefinitely, to the extent that it can no longer be associated with an identified or identifiable person.

12. Automated individual decisions

12.1. PRYSMA does not make decisions based solely on automated processing that produce legal effects on data subjects or similarly significantly affect them. The automatically generated Reports have the character of a support instrument and are subject to human interpretation by the Client or by the professionals designated by it.

12.2. The Client is responsible for ensuring that any decision made based on the Reports complies with the requirements of the applicable legislation, including the rules regarding automated individual decisions, transparency, human intervention and the Participant’s rights.

13. Data protection officer and contacts

13.1. PRYSMA has appointed a data protection officer (DPO), who can be contacted at the e-mail address [email protected]. For any requests or concerns regarding data protection, data subjects may also contact PRYSMA at the address indicated in the Terms and Conditions and on the website.

14. Applicable regulations and prevalence

14.1. PRYSMA complies with Regulation (EU) 2016/679 (GDPR), Law no. 190/2018 and the other provisions applicable in the jurisdictions in which it offers its services. In the event of a conflict between this annex and mandatory legislation, the provisions of the applicable law prevail.

14.2. To the extent that PRYSMA offers services in several member states, mandatory local particularities, such as age thresholds for minors or sectoral information requirements, will be reflected in the information flows and documentation made available to data subjects, to the extent that these obligations are incumbent upon PRYSMA.

15. Updates to this annex

15.1. PRYSMA may update this annex to reflect legislative or operational changes. Any significant change will be communicated in a reasonable manner, and the updated version will be available in the services interface.

15.2. Continued use of the services after the date of entry into force of the changes represents acceptance thereof, without affecting the data subjects’ rights provided by law.

Annex 2 — Special information for consumers

1. Identity of the trader, the service and the price

1.1. A consumer is the natural person defined in the applicable law of the state in which they are domiciled or have a permanent residence and who contracts directly with PRYSMA, acting outside a commercial, economic, professional or liberal activity.

1.2. A natural person authorised to provide professional services, including a PFA (authorised natural person) or other forms of exercising a profession without legal personality, is not a consumer if they contract in connection with their professional activity.

1.3. Participants invited by a Client to complete tests through the Platform are not considered, by their mere participation in the assessment, consumers contracting directly with PRYSMA.

1.4. The identity, contact details, description of the digital service and main functionalities are presented in the Terms and Conditions and, in more detail, before the order in the Platform interface.

1.5. The price for the use of the Platform includes all applicable taxes.

1.6. The duration of the subscription and the renewal conditions are displayed in the corresponding section of the Platform.

2. Right of withdrawal

2.1. The consumer has the right to withdraw from the contract within 14 (fourteen) days of its conclusion without giving any reason.

2.2. To exercise this right, the consumer must send an unequivocal statement of withdrawal using the contact channels available according to the Platform.

2.3. If the consumer has expressly consented to the provision beginning during the withdrawal period and has accepted that they will lose the right of withdrawal under the conditions of the law, the provision may begin immediately, and the right is lost upon the partial or full performance of the contracted service, to the extent permitted by law.

2.4. The consumer may not request the reimbursement of the amount paid to the Platform where the service has been fully performed under the conditions of the law. In the case of partial performance, the consumer may request a partial refund, within the limits of the value of the unperformed service, if the applicable law so requires.

2.5. Refunds are made without undue delay, using the same payment method.

3. Renewal and cancellation

3.1. Automatic renewal is optional and can be deactivated at any time from the Account, if this functionality is available for the contracted plan.

3.2. The Owner will clearly inform about the renewal before the due date, to the extent required by law and according to the available payment functionalities. Cancellation must be available through a reasonable and accessible mechanism.

4. Complaints and alternative dispute resolution

4.1. The consumer may submit complaints using the contact details available on the Platform.

4.2. The consumer has the right to resort to the alternative dispute resolution mechanisms recognised by law.

4.3. The competent national authority in Romania is the National Authority for Consumer Protection; for other member states of the European Union, consumers may address the competent national authorities.