Re: The Seventh Code
Posted by: Dr. Don Beck
Sat Sep 30, 2006 5:34 pm (PST)
Clearly, the contours of Yellow (GT-Systemic/Authentic) have not been etched in tin much less set in concrete. But, with all due respect to other developmental models, this highlights the uniqueness of the Gravesian/SDi perspective in that it does address, with great specificity, how each new memetic code actually appears; what are the Life Conditions that spark and drive it; and how Life Problems "G" will awaken the capacities (T) to deal with new realities, new challenges, and new threats as well.
What Wilber is searching for with regard to "altitude" that provides the totem pole for development is, in our view, the accumulation of the memetic codes or schemes (with the multiple expressions of content or themes) that form societal stacks that maintain all of the awakened codes and set the stage for new ones in the future. This is what we call "The Double Helix"; namely the interaction between Life Experiences and the complex adaptive, contextual intelligences - micro, meso, and macro - that rise in human thinking and priority setting experiences. (This also explains why we put the amazing spiral right in the vortex of the quadrants as the regulating intelligence that governs the relative strength, density, ordering, and relevance of the emerging "levels" and "lines.") This provides the verb, the dynamic element, and the intelligence within the spine or core of the spiral itself. (Actually, Spiral Dynamics is about the master code rather than the specific manifestations of the master code over time and in conceptual space.) Too often many simply reduce the complex model to specific levels and miss entirely the essence of the point of view.
The Gravesian "bio-psycho-social" model argues that mind and brain cannot be separated, that activity in the Upper Right impacts development in the Upper Left and vice versa; otherwise, how can the approach be truly "integral." Years ago, while a fledgling Ph D student at the University of Oklahoma, we were discounting the artificial polarities between thinking and feeling, thoughts and emotions, and even psychology and biology. Muzafer Sherif was one of the founding principals of the field of Social Psychology so our focus, then, was on cognitive structures and domains, that "integrated" person and group dynamics. You recall he was the originator of the famous auto kinetic light experiment as well as the celebrated Robbers' Cave intragroup and intergroup conflict reduction framework.
This, then, becomes the context for what GT-Yellow will be, at least within the Gravesian/SDi and Second Tier concept and language. There are, of course, other points of view as to how/why/when "value systems" appear -- in what arrangement, mesh, sequence, and "developmental" stacking -- but I would caution against expropriating Graves/SDi language and symbols to fill in holes in other models. Better to keep each theoretical package and stream unique and separate otherwise one is confusing apples with oranges and is corrupting the essential purity and seamlessness of elegant models. I decided some time ago to stay with the Gravesian perspective while respecting the invisible spiral and honoring all of the systemic models. I also find it is much easier to work with practical people in reality settings by framing issues within the systemics of an internally logical set of definitions and perceptions of the critical variables.
We are being overwhelmed at the number of people who are reporting their experiences in the Green to Yellow dance. All of these reports are actually making history as Life Conditions are driving the passages through a vast array of feelings, textures, hues, and quests. In short, the Yellow textbook is now being written by individuals who have been struggling with their own experiences and sharing these with us. It always helps, however, to focus on what the conditions are, internal and external, that are being confronted, and how they are different from both Life Conditions "F" -- producing Green -- and Life Conditions "H" -- producing Turquoise ("U").
These ideas might help.
First, it is important to avoid the linear trap; that is, the tendency to think of climbing a ladder where one leaves one step totally before moving to the next. Since these codes are more like complex chords than individual notes, one always has blends and admixtures. Further, as Mike Jay will point out in Boulder in late October, "density" development is as important as vertical up-shifts. The entire spiral is within us as opposed to our being on the spiral. In our work within organizations we always, for example, look for the dominant warm color (red, orange, or yellow) and dominant cool color (purple, blue, green or turquoise) rather than search for a single defining color. This means our "yellow" will have other colors within it, with diverse manifestations of density and ego-involvement and, of course, with many, many different expressions of each (Content). Yellow with strong Blue as a subset will be different from Yellow with a powerful Orange as an alloy. The pressing need in "G" is to find new ways to connect entities beyond, but often including, both top-down, hierarchical models or expansive egalitarian arrangements. This capacity to connect the dots does require a mother board on which the dots can be connected; the nature of the glue that binds them together; and the intelligence to moderate the flow of energy and resources among them.
Second, I believe the general feeling of loneliness is generated by the transition from the warmth and humanness of collective Green into the first display of individuality (existentialism) within the 7th Code. One is literally alone with few comrades or mates. This entails being outside the dominant culture(s) for sure, and often one is separated from both the internal motives that drive meaning and purpose as well as the external arrangement of teams and associations around common cause. I believe stage two in the development of Yellow reacquaints one with the earlier codes where one can bond with them once again but without attachments or obsessiveness that characterized the First Tier expressions. One can literally relish trips through Purple, Red, Blue, Orange and Green zones which provide variety and richness in the human experience. I spoke recently of the "Meme Gym" concept and suggested that we find places and experiences where we can exercise all of the First Tier codes.
Third, and I really sensed this when I attended the first European SDi Confab in the Netherlands last week. Peter Merry and others in his expanding constellation are actually creating the models of individual collectivism -- in an imaginative fashion. You can read about it at the Center for Human Emergence website. (Just enter the website and click on the Dutch flag and read for yourself.) Just as the critical difference between Red and Orange is reflected in the discipline within Blue, and the element that differentiates Blue from Green is in the autonomous self within Orange, Green can only transform into Turquoise through the verticality, practicality, and 'stuff that works' qualities within Yellow. Beware of the large number of "Green" organizations, think tanks, movements, and alliances who are claiming that they have the codes to untangle the global knot. Simply changing names or dressing up websites and PowerPoint presentations won't get it done. I know this idea does not make me popular, but I gave up on that goal some time ago.
Finally, the book Spiral Dynamics contains a number of the descriptors of the 7th Code, primarily from the original writing of Clare W. Graves. I suspect for many of us we will sense a shift from a human-centric to a systems-centric perspective. We will seek to improve the human condition through the design of natural systems and arrangements which, as they unfold, will address many human problems in a much more effective manner than the F-S world view. We will discover a higher level of caring than what is expressed in Green. We will develop more of a pragmatic versus idealistic approach. We will accept that attempts to push the river will only result in frustration and often resistance to what we are trying to accomplish. We will work with Life Conditions, with the structure and texture of vMemetic Codes, and, in addition, with the content the code has permeated and impacted. And, we will accept that life itself is full of paradoxes, mystery, wonderment, sudden surprises, with peaks and valleys of emotions and feelings. Life becomes a journey, not a destination. And, we develop a deep respect and acceptance of the nature of ebb and flow as we experience life and all that it involves.
We will do the change that the world needs done.
CoP meetings about online workshops
In 2020 we had two online Community of Practice meetings that discussed how to conduct online workshops and how to use Zoom and its break out room functionality. Thanks to Anne-Else, Ursula and Ole for sharing their knowledge about this subject.
Session may 8th 2020 - Framework for online workshops
Session june 5th 2020 - Use of Zoom break out rooms
Working with ValueMatch as a professional
If you are a coach, trainer, consultant or HR professional we offer you different ways to use our instruments in your professional practice.
Incidental use
Those who want to incidentally use our values and/or change assessments can purchase these in our webshop. The person who fills out the assessment gets directly invited and received the full reports, you can also request to get a copy of these reports.
Become a ValueMatch Certified Professional
If you want to use assessments on a regular basis and are interested in using the culture assessments you can become a ValueMatch Certified Professional. As a VCP you also:
- Get a substantial discount on purchases of our assessments.
- Get access to our website with manuals, training materials, workshop structures, information on Spiral Dynamics and much more.
- Become part of our Community of Practice for which we organize regular online meetings to update you on new developments and exchange best practices about the application of Spiral Dynamics and ValueMatch instruments.
To become a VCP you first need a solid understanding of Spiral Dynamics and then attend our ValueMatch Certified Practitioner training.
To learn about Spiral Dynamics we offer the Spiral Dynamics fundamentals level 1 training, see our course schedule for more information, dates and registration. If you already have good knowledge of Spiral Dynamics, you don’t need to attend this training before becoming a practitioner. To find out your level of knowledge you can use our free Spiral Dynamics knowledge test. A score of 65 to 70% is a good indication that you can progress to our ValueMatch Certification program.
The ValueMatch Certification training is offered online. This is a practical training and the course fee includes assessments you can use to practice working with individuals and a small group.
Our online trainings are conducted in English, part of the course material is available in Dutch and German too. We are working with various partners around the world to set up local classroom training in different locations and languages, please check our course schedule for availability.
Certification
If you complete the ValueMatch Certified Practitioner training successfully we provide you with a certificate that demonstrates that you are a ValueMatch Certified Practitioner. You can also use our certification logo on your website and printed communication.
ValueMatch is authorized by Dr. Don Beck to issue Spiral Dynamics level 1, 2 and 3 certifications. These certificates demonstrate that you have a specific level of knowledge of Spiral Dynamics and are used internationally by the various trainers who Dr. Don Beck authorized. More information about the levels can be found here.
If you successfully complete the Spiral Dynamics fundamentals level 1 training, you automatically get the Spiral Dynamics level 1 certificate, it is included in the course fee. If you have successfully completed the ValueMatch Certified Practitioner training, you can in addition to the ValueMatch certificate request the Spiral Dynamics level 2 certificate. You must however already have a level 1 certificate for this and there is an extra fee of 100 euro (ex VAT), which is the fee we also pay to get the certificate issued.
ValueMatch Gizlilik Beyanı:
Kişisel veriler
Kişisel verilerinizi korumakta kararlıyız. Bu gizlilik politikasında, web sitemizi ve / veya hizmetlerini kullandığınız için kişisel verilerinizi nasıl işlediğimizi bilmenizi istiyoruz.
İşleyebileceğimiz kişisel veriler:
Web sitemizi kullandığınızda ve / veya bültenimize abone olduğunuzda ve / veya iletişim formu aracılığıyla bizimle iletişime geçtiğinizde:
- IP adresi;
- ad
- E-posta adresi;
- Telefon numarası;
- Giriş verileri;
- Ve bize aktif olarak gönderdiğiniz diğer tüm kişisel veriler, örneğin iletişim formu aracılığıyla bilgi sağlayarak.
Bir değerlendirmeye katılarak:
- İsim ve adres bilgileri;
- Organizasyon;
- Değerlendirme sorularının cevapları;
- Değerlendirmeye ilişkin sonuç analizi gibi
kişisel verileriniz, GDPR tarafından tanımlanan kişisel verilerin 'özel bir kategorisi' olarak değerlendirilmez.
Web mağazamız üzerinden bir değerlendirme sipariş ettiğinizde:
- Ad;
- E-mail;
- Telefon numarası;
- Ödeme ve fatura için adres verileri;
Ebeveyn izni olmadan 16 yaşından küçük veri sahiplerinin kişisel verilerini işleme niyetimiz yoktur. Ancak, her web sitesi ziyaretçisinin yaşını kontrol etmek mümkün değildir. Ayrıca, özel kişisel veri kategorilerini işleme niyetimiz de yoktur. Bu nedenlerle özel kişisel veri olarak nitelendirdiğiniz herhangi bir kişisel veriyi bizimle paylaşmanızı rica ediyoruz.
Hedefleri
ValueMatch kişisel verilerinizi aşağıdaki amaçlarla işler:
- web sitemizin kullanımı hakkında bilgi toplamak; frekans, cihaz tipi ve internet tarayıcısı;
- size haber bültenimizi göndermek için;
- bir hesap oluşturmanızı ve hesabınıza giriş yapmanızı sağlar;
- atölye çalışmalarımıza ve eğitimimize katılmanıza izin vermek;
- siparişlerinizi web mağazası üzerinden işlemek;
- bir değerlendirme yapmanıza (olanak sağlamanıza);
Değer izninizi ifade ettiyseniz, ValueMatch kişisel verilerinizi işler. Ayrıca, ValueMatch kişisel verilerinizi işleyebilir çünkü ValueMatch bunu yapmak için meşru bir çıkar (ticari çıkar), yani (potansiyel) müşterilere uygun fırsatlar / teklifler sağlamaktır. Veri sahibi, yalnızca otomatik işleme (profil oluşturma dahil) dayalı bir karara tabi tutulamaz.
Alıkoyma
Bu politikada belirtilen herhangi bir amaç için işlediğimiz kişisel bilgiler, bu amaç için gerekenden daha uzun süre saklanmayacaktır.
|
Web sitemizi ziyaret ederseniz |
Hiçbir kişisel veri toplanmaz |
|
Web sitemizdeki iletişim formu aracılığıyla bizimle iletişime geçerseniz |
Talebinizi veya sorunuzu ele aldıktan sonra maksimum 2,5 yıl. |
|
Bültenimize abone olursanız |
Aboneliği bitirene kadar. |
|
Değerlendirmelerimizden birini doldurursanız |
Değerlendirmenin tamamlanmasından en fazla 2,5 yıl sonra. Değerlendirme verileri anonimleştirilecek ve enstrümanlarımızın analizi ve iyileştirilmesi için saklanacaktır. |
|
Web mağazamızda ödeme yaparsanız |
Hollanda vergi dairesinin gerektirdiği maksimum 7 yıl. |
|
çeşitli |
Yasal verileri, kişisel verileri daha uzun süre saklamamıza mecbur bırakmadıkça, kişisel verileri kişisel verilerin işlenme amaçlarına göre gerekenden daha uzun süre saklamayacağız. |
Kişisel verilerinizi üçüncü taraflara ifşa etme
Kişisel verilerinizi üçüncü taraflara satmayacağız. Ancak, kişisel verilerinizi, sunduğumuz hizmetler ve bu gizlilik politikasında belirtilen amaçlar için makul ölçüde gerekli olduğu ölçüde üçüncü taraflarla ifşa edebiliriz. Kişisel verilerinizin güvenliğini sağlamak için bizim adımıza kişisel verileri işleyen üçüncü taraflarla bir veri işleme anlaşması yaptık. Kişisel verilerinizi aşağıdakilere açıklayabiliriz:
- Veri kaydetme için web barındırma ortaklarımız;
- Çevrimiçi sistemimiz aracılığıyla bir değerlendirmeye katılırsanız, sizden anketi doldurmamız için bizi davet eden veya sizi (muhtemelen başka bir kişi aracılığıyla) sizi davet etmek için çevrimiçi sistemimize erişim talep eden kişilere anketi doldurun. ValueMatch'in bu kişileri istihdam eden kuruluşlarla bir Veri İşleme Anlaşması vardır.
- E-postalarımız için Microsoft sunucuları kullanıyoruz. Microsoft muhtemelen verileri ABD'de depolar, Avrupa GDPR düzenlemelerine uyarlar ve onlarla bir Veri İşleme Anlaşmamız var.
- Değerlendirme verilerinin saklanması ve paylaşılması için Dropbox ile;Dropbox muhtemelen verileri ABD'de depolar, Avrupa GDPR düzenlemelerine uygundur ve onlarla bir Veri İşleme Anlaşmamız var.
Haklarınız
ValueMatch sizinle ilgili kişisel verileri işlerse, aşağıdaki (gizlilik) haklarına sahip olursunuz.
Hakkı:
- kişisel verilerinize erişmek için;
- kişisel verilerinizin düzeltilmesi;
- kişisel verilerinizi silmek;
- kişisel verilerinizin işlenmesine ilişkin onayınızı geri çekmek;
- kişisel verilerinizin işlenmesinin kısıtlanması;
- kişisel verilerinizin işlenmesine itiraz etmek;
- kişisel verilerinizin işlenmesine itiraz etmek;
- kişisel verilerinizin taşınabilirliğine
admin@valuematch.net adresine gizlilik haklarınızı kullanmak için bir istek gönderebilirsiniz. Bu e-posta adresi spam robotlarından korunuyor. En kısa sürede cevap vereceğiz, ancak lütfen bize 4 hafta veriniz. Kişisel verilerinizi işleme şeklimizden memnun değilseniz, Hollanda Veri Koruma Kurumu'na şikayette bulunabilirsiniz. Bunu “Autoriteit Persoonsgegevens” web sitesinde yapabilirsiniz.
Kurabiye
ValueMatch yalnızca genel web sitemizde işlevsel çerezler kullanır, bunlar web mağazası alışveriş sepeti ve oturumların sürdürülmesi gibi işlevler için gereklidir. Bunlar yalnızca sitemizle kurduğunuz oturum süresince korunur.
Sertifikalı Ortaklarımız ve atölye katılımcılarımız web sitemizin güvenli bölümüne erişebilir. Burada bazı YouTube videoları mevcut, bunlar için YouTube 'Gizliliği Geliştirilmiş modu' etkinleştirdik. Bu, YouTube tarafından NIC adıyla kullanılan yalnızca bir izleme çerezi olduğu ve yalnızca bu videoları oynattığınızda anlamına gelir. Bu çerezin amacı, dil gibi tercihleriniz hakkında bilgi toplamaktır. Bu çerezler en fazla 6 ay süreyle saklanır. YouTube gizlilik politikası hakkında daha fazla bilgi için bkz:
https://policies.google.com/privacy/key-terms?hl=en&gl=uk#toc-terms-cookie
Temas
ValueMatch ile admin@valuematch.net adresinden iletişime geçebilirsiniz.
DATA PROCESSING AGREEMENT
Click here for a PDF document.
This Processor Agreement shall be concluded with the organization that consents to this processing agreement and relates to the processing of personal data during the performing of an assessment and the provision associated services by ValueMatch B.V..
- Company hereafter referred to as: “Controller”;
and
- VALUEMATCH B.V., with registered office at Schalkwijkstraat 43 in (3512 KR) Utrecht, the Netherlands, registered in the trade register of the Chamber of Commerce under number 73201383 and legally represented by Mr. P.A. van Nimwegen;
hereafter referred to as: “Processor”;
collectively referred to as “Parties”;
CONSIDER THAT:
- an agreement has been concluded between Controller and Processor with regard to carrying out an assessment and/or providing training by completing the application form and agreeing with the general terms and conditions. (hereafter: the “Agreement”);
- In the context of the implementation of the Agreement, the Processor shall obtain personal data and will process this data for the Controller, or customers of the Controller;
- Where appropriate, customers of the Controller qualify as being the Controller as defined in the GDPR;
- Parties for the legal framework regarding privacy assume the applicability of EU Regulation 2016/679 of 27 April 2016 (hereafter: the “GDPR”);
- Terms from the GDPR used in this Processor Agreement, such as processing, personal data, controller and processor, have the meaning as assigned to them in the GDPR;
- In accordance with Article 28 of the GDPR, Parties shall describe in this agreement (the “Processor Agreement”) the subject matter and duration of processing, the nature and purpose of the processing, the type of personal data, categories of data subjects and the rights and obligations of the Parties;
AGREE TO THE FOLLOWING:
Article 1 General
- Processor processes personal data on behalf of and for the benefit of the Controller during the term of the Agreement.
- Processor processes personal data for the Controller in accordance with the written instructions and under the explicit responsibility of the Controller.
- The Controller has control over the processing of the personal data and determines the purpose and means of processing the personal data. The control of the personal data will never rest with the Processor.
- In the event that a European Union or Member State law applicable to the Processor obliges him/her to process in a way that deviates from that which has been agreed in this Processor Agreement, then the Processor will notify the Controller of this legal requirement prior to the processing, unless that provision prohibits such notification.
- The Controller shall ensure that the content, use and/or processing of the personal data by the Processor are not unlawful and do not infringe on any rights of a third party.
- Controller will inform the Processor of any changes to regulations, which form the basis for changing the rights and obligations of the Parties in this Processor Agreement.
Article 2 Security
- In the event the Controller is of the opinion that a change to the security measures to be taken by the Processor, is necessary in order to provide an appropriate level of security, then the Parties shall enter into consultation about the change required to the security measures as requested by the Controller.
- The processor cannot guarantee that the security measures are effective under all circumstances.
- The security measures taken by the Processor, taking into account the latest available technology, implementation costs as well as risks that the processing and the nature of the personal data entail, shall offer an appropriate level of security.
- Parties shall take technical and organizational security measures to protect the personal data against loss or against any form of unlawful processing. On request the Processor will inform the Controller of any measures in the field of security.
Article 3 Audits
- The processor declares that s/he is willing to cooperate with such an assessment and to consult with the Controller about the recommendations made by the expert for improvement. The obligation to cooperate as referred to here does not automatically lead to the obligation to follow all recommendations.
- Controller will notify the Processor in good time of such a planned assessment.
- The Controller is entitled to have an annual assessment performed by an independent expert with regard to the implementation of the Processor Agreement.
Article 4 Security incidents and data leaks
- Communication of a breach to the supervisory authority and the data subject remains at all times the responsibility of the Controller.
- The Processor will inform the Controller of any breach as soon as possible after the Processor has discovered the aforementioned breach.
- Taking into account the nature of the processing and the information available to the Processor, the Processor will assist the Controller in fulfilling the obligations under Article 33 and 34 GDPR regarding the notification of a data breach to the supervisory authority and to the person concerned.
Article 5 Co-operation obligation Processor
- fulfilling the obligations of the Controller set out in articles 32 to 36 GDPR, taking into account the information available to the Processor. The aforementioned obligations concern the security of the processing, the PIA and the prior consultation with a supervisory authority.
- fulfilling the legal obligations of the Controller with regard to rights of the person concerned by means of appropriate technical and organizational measures. The aforementioned responsibilities of the Controller are set out in articles 12 to 23 of the GDPR and include a request for (notification of) the removal or correction of personal data and the right to transfer data;
- The Processor shall assist the Controller, to the extent possible and reasonable according to the nature of his activities, with:
Article 6 Use of other processors
- If the Processor instructs another processor to perform specific processing activities on behalf of the Controller, then the Processor shall ensure that the other processor is subject to the same data protection obligations as in the present Processor Agreement. The obligations shall be agreed in writing. If the other processor does not fulfill his/her data protection obligations, then the Processor shall remain responsible to the Controller for fulfilling the obligations of the other processor.
- The Controller authorizes the Processor to engage other processors to fulfill the obligations arising from the Agreement under the condition that the Processor informs the Controller of the intended changes regarding the addition or replacement of other processors. The Controller may object to an intended change within 5 working days after notification. If the Processor does not accept the objection of the Controller, the Controller may terminate the Agreement without notice.
Article 7 Confidentiality
- The provisions of the first paragraph of this article do not apply if and insofar as the provision of the personal data is necessary pursuant to a court decision, a statutory provision or on the basis of a competent order issued by a governmental authority.
- The parties guarantee that the persons authorized to process the personal data have committed themselves to observe confidentiality or are bound by an appropriate legal obligation of confidentiality.
Article 8 Liability
- An administrative fine imposed by the supervisory authority or claims of data subjects against the Controller cannot be recovered from the Processor, unless there is intent or deliberate recklessness on the part of the management of the Processor.
- The Controller shall indemnify Processor against claims from the supervisory authority and/or data subjects whose personal data are processed by the Processor in the context of the execution of the Agreement, unless the Controller proves that the facts underlying the claim are attributable to the Processor.
Article 9 Duration and termination
- The provisions of paragraph 3 of this article do not apply if a statutory regulation prevents the complete or partial return or destruction of personal data by the Processor. In such a case, the Processor will only continue to process the personal data to the extent necessary under his/her legal obligations.
- If the Controller so requests, the Processor will return the personal data to the Controller or destroy it after the termination of the agreement. If this is not requested, the data will be stored for the duration as stipulated in Annex 1.
- This Processing Agreement ends by operation of law when the Controller terminates the agreement in writing. The provisions of this Processor Agreement that are intended to retain their validity after termination will remain in full force after the termination of the Processing Agreement.
- This Processing Agreement comes into force on the date of the last signature of this Processor Agreement by the Parties and is concluded for an indefinite period of time.
Article 10 Costs
- The reasonable costs incurred by the Processor in complying with provisions regarding “Audits” “Co-operation obligation Processor” “Returning of personal data by termination of agreement” and “Security incidents and data leaks” (insofar as it concerns a notification to the supervisory authority and those involved), including the actual costs incurred and hours spent by the Processor, are borne by the Controller unless the costs are incurred as a result of a substantial attributable shortcoming by the Processor in the implementation of this Processor Agreement.
Article 11 Other
- This Processor Agreement forms an integral part of the Agreement. All rights and obligations under the Agreement, including liability conditions, therefore also apply to this Processor Agreement. In the event of contradictions between the provisions of this Processor Agreement and the Agreement, the provisions of the Processor Agreement prevail.
ANNEX 1:
- SUBJECT PROCESSING AND TYPE OF PERSONAL DATA:
In order to execute the Agreement, personal data will be processed in the context of the implementation of online assessments, the resulting reports and associated services provided by the Processor in the field of coaching, teambuilding, organizational culture and HR-related activities. It mainly concerns:
- Name and address details;
- Contact details: e-mail address and telephone number;
- IP-address;
- Data input assessment and world view.
The Controller shall not permit the processing of any special personal data or data from children (<16 years). Processor does not consider personal data processed in the context of the performance of an assessment as being special personal data as set out in Article 9 of the GDPR.
- DURATION:
The Controller has full control over the duration of the processing and the storage of personal data. The Controller shall not store personal data for longer than required for the provision of the service requested by the party concerned or required to meet the purposes for which the data was provided.
The Parties agree that the Processor will retain personal data for at least 2 years for the benefit of the Controller. The Processor will delete personal data no later than 2 years and 6 months after the assessment data has been made available to the Controller.
The parties agree that the Processor may continue to make unlimited use of assessment data insofar as this data has been anonymized;
- NATURE AND PURPOSE:
Processor shall process personal data as part of the processing of assessments and provision of accompanying services. This includes collecting, recording, storing, retrieving, consulting, using, making available, compiling, correlating and deleting personal data.
- SUB-PROCESSORS / LOCATION
The sub-processors used by ValueMatch are:
- Vservs B.V. in the Netherlands – data storage in the Netherlands
- Strato – data storage in the Netherlands and Germany
- Dropbox – data storage in Europe and the US
- Microsoft – data storage in Europe and the US
These parties comply with the GDPR and have concluded a processing agreement with ValueMatch.
- TECHNICAL AND ORGANIZATIONAL MEASURES:
The processor will - among other things - take the following technical and organizational security measures to protect personal data from infringements:
- Only use sub-processors that comply with the GDPR and ensure that there is a processor agreement between ValueMatch and these parties.
- Implement sound network security techniques and monitoring that offer multiple levels of security. The processor shall use standard security techniques, including firewalls, encryption, access control, monitoring of network security and intrusion detection systems to ensure that only those who are authorized have access to the data.
- Periodic checks and half-yearly audits to delete data and comply with storage duration as given above.
Controller shall take the following technical and organizational security measures to protect personal data from infringements:
- Enter into a processor agreement with Dropbox (by taking a Business account) or remove all offered documents from the Dropbox offered by ValueMatch within 7 working days.
- If use is not made of a Dropbox Business account, the Dropbox offered by ValueMatch cannot be shared with others inside or outside the organization.
- Implement sound network security techniques and monitoring that offer multiple levels of security. Controller shall use standard security techniques, including firewalls, encryption, access control, monitoring of network security and intrusion detection systems to ensure that only those who are authorized have access to the data..
- NOTIFICATION OF INFRINGEMENT:
The Controller will make a report of a breach or infringement by e-mail and by telephone to the person who has entered into the Agreement.
The processor will provide the following information when reporting a breach:
- Contact information notifier (name, function, email, telephone number)
- Data of breach/ infringement:
- Summary incident
- Personal data involved in breach
- When breach took place
- The nature of the breach
- Estimate of the consequences of the breach
- Measures that the processor has taken to limit and prevent breach
