GDPR Compliance Statement

RIADVICE SUARL (“RIADVICE”, “we”, “us” or “our”) protects personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Tunisian Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data. This statement explains how we comply with the GDPR when we process personal data on behalf of our Customers, what we commit to as processor, and how data subjects can exercise their rights. It uses the definitions of our Terms of Use and complements our Privacy Policy, which covers the processing for which RIADVICE is controller.

1. Scope

This statement applies to the Hosted Services and to Professional Services in which RIADVICE processes personal data on a Customer’s behalf. Where a Customer has signed a data processing agreement with RIADVICE, that agreement prevails over this statement. Where it has not, the commitments in Section 4 apply as the processing terms required by Article 28 GDPR, as provided in Section 5 of our Terms of Use.

2. Our services and the data they involve

RIADVICE provides hosting and managed services for BigBlueButton and for other applications used by educational, public and commercial organisations. BigBlueButton enables real-time collaboration through audio, video, chat, polls, shared notes, whiteboards and screen sharing. Sessions may be recorded, depending on the Customer’s policies and settings. Our add-ons convert recordings to video, produce attendance and engagement dashboards and reports from session data, and distribute meetings across several servers. We also operate applications for Customers, such as file sync and sharing, online shops and mailing middleware. Protecting the privacy and security of this data is central to our work, and we apply the GDPR principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability.

3. Roles

• In most cases the Customer, for example an educational institution, a training provider or a company, is the controller. RIADVICE is its processor.
• Where the Customer itself acts as processor for another organisation, for example a training provider serving a client, RIADVICE acts as its sub-processor.
• RIADVICE is controller only for the data it processes for its own purposes, such as Customer account management, billing and support, as the Privacy Policy describes.

4. Our commitments as processor

When RIADVICE processes personal data on behalf of a Customer, it:

• processes the data only on the Customer’s documented instructions, including with regard to international transfers, unless the law to which RIADVICE is subject requires otherwise, in which case it informs the Customer before processing unless that law prohibits it. The Terms of Use, the Order Form and the configuration the Customer chooses in the service constitute its instructions;
• informs the Customer if, in its opinion, an instruction infringes the GDPR or other data protection law;
• ensures that persons authorised to process the data are bound by confidentiality;
• implements the security measures described in Section 8, in accordance with Article 32 GDPR;
• engages sub-processors only under the conditions in Section 10;
• assists the Customer, taking into account the nature of the processing, in responding to requests from data subjects;
• assists the Customer in ensuring compliance with its obligations on security, breach notification, data protection impact assessments and prior consultation, taking into account the information available to RIADVICE;
• at the end of the services, deletes or returns the personal data at the Customer’s choice, as described in Section 13, unless the law requires it to be kept;
• makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR, and allows for and contributes to audits as described in Section 14.

Assistance that goes beyond what RIADVICE provides as part of the standard service may be charged at its current rates, unless the need for it results from a breach by RIADVICE.

5. Legal basis and consent

As controller, the Customer determines the legal basis for the processing under Article 6 GDPR, for example the performance of a contract, a legal obligation, a task carried out in the public interest, legitimate interests or consent, and, where needed, a condition under Article 9 GDPR. Where consent is required, for example for some recordings, the Customer obtains it, typically through its learning management system or another front-end platform. The Customer also informs participants before a session is recorded. BigBlueButton shows participants when a session is being recorded.

6. Categories of data and data subjects

Depending on the service and on how the Customer uses it, the data subjects include the Customer’s staff, teachers, students, trainees, participants, guests and contacts. The data may include:

• identification data, such as names, usernames, email addresses and user identifiers passed by the Customer’s platform;
• participation data, such as join and leave times, talk time, webcam and screen-sharing time, chat activity, poll answers and reactions;
• content shared during sessions, such as audio, video, chat messages, presentations, notes, whiteboard annotations and recordings;
• files, documents and messages stored in applications operated for the Customer;
• technical data, such as IP addresses, browser and operating system types, and connection logs.

The Customer must not use the services to process special categories of personal data or data relating to criminal convictions unless it has a legal basis for doing so and, where specific measures are needed, has told RIADVICE in advance.

7. Retention

Retention periods are decided by the Customer as controller. Recordings and meeting data are deleted automatically after the retention periods configured for the Customer’s platform or stated in the Order Form, unless the Customer asks otherwise or the law requires them to be kept. Technical logs are kept only as long as needed to operate and secure the service.

8. Security measures

RIADVICE applies technical and organisational measures appropriate to the risk, including:

• encryption of data in transit and encryption of confidential data;
• access controls, authentication mechanisms and access restricted to authorised staff on a need-to-know basis;
• separation of Customer environments and data, where the service design provides for it;
• regular updates and security patches;
• monitoring of systems and services;
• backups and restoration procedures;
• confidentiality undertakings and training of staff on data protection and the GDPR.

9. Personal data breaches

RIADVICE notifies the Customer without undue delay after becoming aware of a personal data breach affecting the Customer’s data. The notification describes, as far as the information is available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. RIADVICE then provides further information as it becomes available and helps the Customer meet its own obligation to notify the supervisory authority and, where required, the data subjects.

10. Sub-processors

The Customer gives RIADVICE a general authorisation to engage sub-processors. RIADVICE imposes on each sub-processor data protection obligations equivalent to those in this statement, by a written contract, and remains responsible to the Customer for its sub-processors. RIADVICE gives notice of any intended addition or replacement of a sub-processor, by email or by updating this list, before the change takes effect where reasonably possible. A Customer may object on reasonable data protection grounds. If the parties cannot resolve the objection, the Customer may terminate the affected service.

The sub-processors used for the hosted and managed services are:

Not every sub-processor is used for every service. The Order Form or the Customer’s platform configuration states where the Customer’s service is hosted. The sub-processors involved in a specific service are available on request.

11. International transfers

RIADVICE is established in Tunisia, which is not covered by an adequacy decision of the European Commission. Personal data transferred to RIADVICE by a Customer in the European Union or European Economic Area is protected by the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 (module two, controller to processor, or module three, processor to processor), supplemented by the measures in Section 8. Where a sub-processor processes personal data outside the European Union or European Economic Area, RIADVICE relies on an adequacy decision or on the Standard Contractual Clauses. Transfers from Tunisia are made under the conditions of Organic Law No. 2004-63, including the authorisation of the INPDP where it is required.

12. Data subject requests

Under the GDPR, data subjects have the right to access, rectify and erase their data, to restrict or object to its processing and to data portability. Users of a hosted service should first contact their organisation, which is the controller. If RIADVICE receives a request directly, it forwards it to the Customer without undue delay and does not answer it itself unless the Customer authorises it. RIADVICE helps the Customer to answer, for example by locating, exporting or deleting data.

13. Return and deletion

At the end of the services, the Customer may export its data as provided in Section 25 of the Terms of Use. RIADVICE then deletes the personal data from its active systems, and from backups as they are overwritten in their normal rotation, unless the law requires it to be kept. Data waiting to be deleted from backups is not processed further, except to restore a system. On request, RIADVICE confirms the deletion in writing.

14. Audits and information

RIADVICE answers reasonable written questions and security questionnaires from Customers about its processing. Where this information is not sufficient to demonstrate compliance, a Customer may carry out an audit, by itself or through an independent auditor bound by confidentiality, no more than once a year unless a personal data breach or a request from a supervisory authority justifies it, with at least thirty (30) days’ notice, during office hours and without disrupting the services or compromising the security or confidentiality of other customers’ data. Each party bears its own costs, unless the audit reveals a material breach by RIADVICE.

15. Data protection contact

RIADVICE’s data protection contact oversees compliance and answers questions and requests about personal data at privacy@riadvice.tn.

16. Contact

For further information about our GDPR compliance or our privacy practices, contact privacy@riadvice.tn or contact@riadvice.com, or write to RIADVICE SUARL, Appartement B1, Résidence Ramzi, 2074 Mourouj 5, Ben Arous, Tunisia.

Last updated: 9 October 2026