GDPR Overview

The European General Data Protection Regulation (GDPR) became enforceable on May 25, 2018. The GDPR is a regulation on the collection and processing of personal data related to individuals residing within the European Union (EU).

The GDPR’s six key principles, as detailed in Article 5 of the legislation, include:

  1. Lawfulness, Fairness, Transparency
  2. Limitations on Purpose of Collection, Processing, and Storage
  3. Data Minimization
  4. Accuracy of Data
  5. Data Storage Limits
  6. Integrity and Confidentiality

Our Role

At Rise, we value our worldwide customer base, and your right to privacy. As outlined in our security white paper, Rise employs a holistic approach to security. We welcome the GDPR as an opportunity to deepen our commitment to data protection.

For the GDPR, we are considered a data processor for the data we collect as we deliver e-learning services to our customers, the data controller. As a data processor, Rise commits that data put in our care by EU data subjects is:

  • Collected conservatively and with willful consent
  • Able to be deleted and managed by the user
  • Protected with necessary safeguards

As a cloud-based learning platform, the protection of our customers’ information and their users’ privacy is of utmost importance. We will continually invest in the security of Rise by employing an experienced security team and utilizing the most robust tools available for monitoring and mitigating threats. In addition, the Rise security team will comply with GDPR requirements around security incident notifications.

We engage carefully vetted sub-processors for specific purposes necessary to deliver e-learning services. We require that each sub-processor sign and adhere to a Data Processing Agreement (DPA), reflecting our commitment and that of our vendors to take the individual’s right to data privacy seriously.

Areas of Investment

We’ve invested in the following areas to comply with GDPR:

  • Continuous improvements to our security infrastructure
  • Data breach notification procedures
  • Annual penetration testing
  • Data management

Data Transfer

On July 16, 2020, the Court of Justice of the European Union (CJEU) invalidated the EU-US Privacy Shield, and on September 8, 2020 the Federal Data Protection and Information Commissioner (FDPIC) of Switzerland found the Swiss-U.S. Privacy Shield Framework didn't provide adequate protection for personal data transfers from Switzerland to the United States.

Even before these recent developments, Articulate used alternative safeguards identified in the GDPR, including standard contractual clauses (SCCs). We’ve also assessed our data transfer risks, including engaging an external auditor to evaluate our security controls resulting in SOC 2 Type 2 along with ISO 27001 and ISO 27701 certifications. Additionally, we’ve specifically assessed the risks raised by the CJEU and determined that those risks are highly unlikely for Articulate because some laws (e.g., the U.S. Electronic Communications Privacy Act) don't regulate Articulate, and other laws that could theoretically apply to Articulate (e.g., Executive Order 12333 and the U.S. Foreign Intelligence Surveillance Act) are unlikely to impact us since we don't provide the services government authorities typically target for broad surveillance (e.g., telecommunication providers, ISPs). We've never received a request for surveillance, and if we did receive such a request, we’d notify the impacted customers unless prohibited by law.

Data Management

Providing you with control over Rise’s collection, retention, and usage of your data is a key component of the GDPR. The following methods describe the controls available to data subjects:

  • Opt-Out by Default
    • EU visitors to Rise websites are opted out of marketing communications by default.
  • Opt-Out via Self-Serve
  • Browser Cookie Control
  • Data Subject Rights
  • Contact privacy@rise.com to exercise your data subject rights of access, correction, restriction of processing, withdrawal of consent, deletion, and portability.

GDPR Inquiries

Please contact us at privacy@rise.com if you have any questions about how we comply with GDPR.