Before engaging any service provider that will process personal data on the Academy's behalf — a hosting provider, a future payment processor, an email or communications platform, or similar — we:
- Confirm the provider offers security and confidentiality commitments consistent with this policy, including encryption in transit and at rest where applicable.
- Put a written agreement in place describing what the provider may and may not do with the data, and requiring them to notify the Academy promptly of any breach.
- Consider where the provider stores and processes data, and apply the cross-border transfer safeguards in Section 12 where relevant.
- Limit what is shared with any provider to what their service actually needs — the same minimization principle applied internally (Section 10).
We do not knowingly engage a service provider whose own practices would undermine the protections described in this policy, particularly for beneficiary data.