KDVI Limited – Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Agreement between the Client and KDVI for the provision of certain Services by KDVI to the Client, and reflects what the parties have agreed in relation to the Processing of Personal Data. All capitalised terms not defined herein shall have the meaning set forth in the Agreement.

In the course of providing the Services to the Client pursuant to the Agreement, KDVI may Process Personal Data on behalf of the Client (as further detailed in Schedule 1) and the parties agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith.

With effect from 28 June 2021, this DPA shall automatically replace any comparable or additional rights relating to Processing of Personal Data contained in the Agreement (including any existing data processing addendum to the Agreement), unless otherwise agreed in writing between the parties.

Data Processing Terms

 

1. Definitions

“Associates/Affiliates”means KDVI’s coaches and consultants who provide the Services on behalf of KDVI.
“Data Controller”means the entity which determines the purpose and means of Processing of Personal Data.
“Data Processor”means the entity which Processes Personal Data on behalf of the Data Controller.
“Data Protection Laws”

means all laws and regulations, including the UK’s data protection regime as set out in the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 and any successor legislation, applicable to the Processing of Personal Data under the Agreement, as amended or updated from time to time.

The Information Commissioner is the UK’s independent supervisory authority on data protection.

“Data Subject”means the identified or identifiable natural person to whom Personal Data relates.
“Personal Data”means any information relating to an identified or identifiable natural person which is submitted by the Client in respect of the provision and use of the Services. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
“Processing”means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
“KDVI”means KDVI Limited, a company registered in England and Wales, with company number 07295422.
“Sub-processor”means any Data Processor engaged by KDVI, which includes Associates who are not KDVI employees.

2. Processing of Personal Data

2.1 The parties acknowledge and agree that in respect of Processing of Personal Data the Client is the Data Controller, KDVI is the Data Processor, and KDVI will engage Sub -processors pursuant to this DPA.

2.2 The Client shall, in its use of the Services, Process Personal Data in accordance with the requirements of the Data Protection Laws and shall ensure that any instructions provided to KDVI for the Processing of Personal Data shall comply with Data Protection Law

2.3 The Client shall ensure that it informs any Data Subjects whose Personal Data is disclosed to KDVI (or its Associates) pursuant to the Agreement that the Client may use and disclose their Personal Data to KDVI (or its Associates) in accordance with this DPA, and that the relevant Data Subjects have, where necessary, consented to such Processing and disclosure. The Client shall be responsible for ensuring the Personal Data provided by the Client to be processed by KDVI (or its Associates) pursuant to the Agreement is Processed on lawful grounds.

2.4 The Client must promptly notify KDVI in the event of any withdrawal of any relevant consent by any Data Subject whose Personal Data is Processed pursuant to the Agreement, giving sufficient details of the withdrawal to enable KDVI to comply with its obligations under the Data Protection Laws.

2.5 Each party must immediately notify the other if it becomes aware of a complaint or allegation of breach of the Data Protection Laws by any person or an investigation or enforcement action by a regulatory authority, in connection with the Agreement.

2.6 KDVI shall, to the extent required by applicable Data Protection Laws:

2.6.1 not access or use the Personal Data except as necessary to provide the Services, and shall only Process such Personal Data in accordance with this DPA and only on the Client’s instructions;

2.6.2 implement appropriate technical and organisational measures to protect any Personal Data against unauthorised or unlawful Processing and accidental loss, disclosure, access or damage, further details of which can be obtained from KDVI by email at data.protection@kdvi.com;

2.6.3 cooperate and provide reasonable assistance to the Client in connection with the Client’s compliance with the Data Protection Laws insofar as it relates to the Services. This may include assistance with: (i) responding to requests from individuals or authorities, (ii) notifying data breaches to affected individuals or authorities; and (iii) carrying out data protection impact assessments;

2.6.4 delete or return to the Client all Personal Data upon the Client’s request or in accordance with Schedule 1 on termination or expiry of the Agreement, unless otherwise required under applicable laws;

2.6.5 ensure that persons authorised to access the Personal Data are subject to confidentiality obligations, whether by contract or statute;

2.6.6 as soon as reasonably practicable, promptly notify the Client in writing of any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data. The notice will specify (i) the categories and number of individuals concerned, (ii) the categories and number of records involved, (iii) the likely consequences of the breach and (iv) any steps taken to mitigate and address the breach;

2.6.7 give the Client access during normal working hours to audit any relevant records and materials held by KDVI which are necessary to demonstrate compliance by KDVI with its obligations under this DPA. To the extent permissible under Data Protection Laws, the Client shall pay KDVI for any reasonable costs incurred by KDVI with any audit requested and shall take all steps necessary to minimise the disruption to KDVI’s business.

3. Sub-Processors

3.1 Subject to clause 3, the Client hereby acknowledges and agrees that: (i) KDVI’s Associates and Affiliates may be retained as Sub-processors; and (ii) KDVI may engage third party Sub-processors in connection with the provision of the Services. The Client may find a current list of KDVI’s Sub-processors for the Services on our website Legal Centre (“Sub-processor List”), which the Client acknowledges and accepts.

3.2 KDVI shall notify the Client of the relevant Associate(s) and/or Affiliates(s) assigned to provide the Services in the course of arranging the relevant Programme with the Client (subject to any rescheduling during the Programme). KDVI shall notify the Client of any other changes to its Sub-processors by updating the Sub-processor List and notifying the Client by email before authorising the new Sub-processor to Process and Personal Data in connection with the Services provided to the Client. The Client may reasonably object to KDVI’s use of a new Sub-processor by notifying KDVI promptly in writing within five (5) business days after receipt of KDVI’s notice. In the event the Client reasonably objects to a new Sub-processor, KDVI will use reasonable efforts to make available to this Client a change in the Services to avoid Processing of Personal Data by the objected-to new Sub-processor without unreasonably burdening the Client. If KDVI is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, the Client may terminate the Agreement with respect only to those Services which cannot be provided by KDVI without the use of the objected-to new Sub-processor, by providing written notice to KDVI.

3.3 KDVI confirms that it has entered into or (as the case may be) will enter into a written agreement with any Sub-processor incorporating terms which are no less protective than those set out in this Agreement to the extent applicable to the nature of the Services provided by such Sub-processor. KDVI shall remain liable for the acts and omissions of its Sub-processors to the same extent KDVI would be liable if performing the services of each Sub-processor directly under the terms of this DPA.

4. International Transfers

4.1 Where the Client is based inside the UK/EEA, KDVI shall not transfer Personal Data to any country outside of the UK/EEA without prior written consent from the Client, except for transfers to and from: (i) any country which has a valid adequacy decision from the UK/European Commission; or (ii) any organisation which ensures an adequate level of protection in accordance with the applicable Data Protection Laws; or (iii) otherwise in accordance with the Data Protection Laws. If any international transfer outside the UK/EEA requires the execution of UK/EU standard contractual clauses (“SCC”) in order to comply with Data Protection Laws and KDVI is the entity exporting Personal Data to a sub-processor outside the UK/EEA, the Client authorises KDVI to enter into SCC with the sub-processor in the Client’s name and on its KDVI will make the executed SCC available to the Client on request.

4.2 The Client acknowledges that Associates may be based outside the UK/EEA. Where Personal Data is required to be Processed by an Associate based outside the UK/EEA in order to provide the Services (or part thereof), the Client shall notify the relevant Data Subject accordingly and obtain from the relevant Data Subject explicit consent to the proposed transfer.

5. Limitation of Liability

5.1 Each party’s liability arising out of or related to this DPA, whether in contract, tort (including negligence), for breach of statutory duty or otherwise, is subject to the limitations of liability contained within the Agreemen Any reference in such section to the liability of a party means the aggregate liability of that party under the Agreement and this DPA together.

SCHEDULE 1 – PROCESSING ACTIVITIES

 

Data Subjects

The Personal Data processed shall concern the following categories of Data Subjects:

  • Individual employees and/or consultants of the Client
  • Coachees or students of the Client

Categories of data

The Personal Data processed shall concern the following categories of data:

  • Information submitted by on behalf of the Data Subject as part of any programme or engagement, e.g. employment & educational history (biography), job title, gender, personal development plan
  • Information submitted by or on behalf of the Data Subject as part of any survey, e.g. name, e-mail address
  • Feedback reports

Special categories of data (if appropriate)

The Personal Data processed shall concern the following special categories of data:

Processing operations and duration of processing

The Personal Data processed will be subject to the following basic processing activities:

 

  • The Personal Data shall be processed by KDVI solely to provide the Client with the Services pursuant to the Agreement.
  • KDVI shall process the Personal Data only in accordance with the Client’s instructions from time to time and shall not process the Personal Data for any purpose other than those expressly authorised by the Client or as set out in this DPA.
  • After termination of the Agreement, the Personal Data will be retained for six (6) calendar months following completion of the engagement and in back-up files for a further three (3) months to ensure KDVI is able to deliver the Service to the Client, and maintain business continuity and disaster recovery requirements.

Margot Schumacher:

Senior Associate at KDVI, Adjunct Professor of Leadership Development at TIAS Business School, and executive coach at INSEAD. Margot has coached senior leaders across global organisations following senior roles at Unilever and Kraft Heinz. Since 2010, she has advised multinationals on leadership and organisational development, with a focus on enhancing effectiveness at the top team and board levels. She also serves on the Supervisory Board of Thales Netherlands. Her global perspective is shaped by living and working in Shanghai, Pittsburgh, and London before returning to the Netherlands

Oriane Kets de Vries:

Oriane Kets de Vries is CEO and owner of the Kets de Vries Institute. She leads a global team of coaches, consultants and educators dedicated to developing reflective, emotionally intelligent leaders and cultivating workplaces where people can thrive. In her faculty role, she draws on extensive experience designing and directing leadership programmes for senior executives, contributing her expertise in psychodynamic coaching, organisational culture, and transformational leadership development.

Oriane has served as consultant, coach, and programme director for clients including Pictet, Deutsche Bank, Merck, UBS, Mishcon de Reya, and Engie, and she has taught on open-enrolment programmes with leading institutions such as Cambridge Judge Business School, Oxford Saïd, INSEAD, ESCP, ESMT and CEDEP. Her interests centre on the human side of leadership, particularly identity, creativity, entrepreneurship and gender dynamics. She holds an MBA and Executive MA in Coaching and Consulting for Change from INSEAD, has trained at the Harvard Kennedy School, and brings more than a decade of professional experience in creative and entrepreneurial industries into her work with leaders.

Manfred Kets de Vries:

Manfred Kets de Vries is a pioneering authority in leadership development, coaching, and organisational change. He is a founder and director of the Kets de Vries Institute (KDVI) and served as Distinguished Clinical Professor of Leadership Development and Organisational Change at INSEAD. With academic credentials in economics (University of Amsterdam), management (MBA and DBA, Harvard Business School), and psychoanalysis (trained in Canada), he brings a uniquely interdisciplinary perspective to leadership. His work bridges management theory and clinical insight, establishing him as a global thought leader in executive coaching and transformation. At INSEAD, he founded the Global Leadership Centre and led the flagship programme The Challenge of Leadership for 31 years. He also served as scientific director of Coaching and Consulting for Change, an 18-month Executive Master’s programme that has shaped over 3,000 senior leaders and executive coaches worldwide. He has advised and coached senior executives at global firms including Goldman Sachs, BP, Shell, Unilever, McKinsey, and Volvo. A prolific author of over 60 books and 400 articles, his work appears regularly in The Financial Times, The Economist, and Harvard Business Review. Recognised by Le Capital, Wirtschaftswoche, and The Financial Times as one of the world’s top 50 management thinkers, he is widely regarded for advancing more human-centred approaches to leadership.

Yulia Chupina:

Senior Adviser (Luminary) at Accenture and executive coach with over 12 years of board experience. Formerly a banker and McKinsey consultant, Yulia has led banking transformations in digital, agile, organisational change, and talent development. Her coaching spans the finance, tech, and consumer goods sectors, blending technological insight with emotional intelligence to guide leaders through transformation. Recently, she advised BBVA on agile methodologies and senior talent development. Influenced by thought leaders such as Manfred Kets de Vries and Gabor Maté, Yulia brings an analytical, reflective approach to leadership. She has lived and worked across the UK, Spain, the US, and Russia.

Elizabeth Florent:

Elizabeth has worked closely with Manfred Kets de Vries for many years and has served as a Senior Lecturer and Research Fellow at INSEAD. Her extensive background in leadership development spans organisational consulting, executive coaching, and academic research. She holds advanced degrees in Organisational Development and Clinical Organisational Psychology and is a certified Coaching Supervisor through the Tavistock Institute. Her doctoral research explored experiential domains in executive education, and she has authored or co-authored numerous academic articles, case studies, and books on leadership and organisational dynamics. Elizabeth led the development teams behind KDVI’s diagnostic instruments, including the GELM, OCA™, and ITI. Drawing on her diverse training and global experience, she brings deep cross-cultural insight to her work with leaders worldwide. Originally from California, Elizabeth has made France her home for over 30 years.