Brightly Software (Siemens)
Round 1 · Operational Triage · Operational Triage — Round 1 · assessed
🔴 Do Not Approve
Privacy score 70.0% · band Good
Hard no: the vendor explicitly does something disqualifying — Q16 (AI & Model-Training). An explicit gate violation beats the privacy score.
Hard-fail gate(s): Q16 — an explicit disqualifying practice. This beats the privacy score.
Quote check: 14 of 14 quotes found in the vendor's document. Code compares every quote with the text that was read. No model takes part in this check.
Dimension scorecard
| Dimension | Score | |
|---|
| Data Collection |
| 100.0% |
| Purpose & Use GATE |
| 60.0% |
| Data Sharing GATE ⚠ | n/a | — |
| Data Sold GATE ⚠ | n/a | — |
| Data Rights |
| 100.0% |
| Retention | n/a | — |
| Data Security | n/a | — |
| Breach Notice | n/a | — |
| Biometrics & Surveillance GATE ⚠ |
| 20.0% |
| Payments | n/a | — |
| AI & Model-Training GATE ⚠ |
| 20.0% |
| Jurisdiction & Residency |
| 100.0% |
| Contract & Assurance |
| 100.0% |
Findings — 19 questions, every answer cited
Data Collection
Q1Does the vendor limit collection and use of staff personal information to what the service needs?
? Not addressed
T0
Answer: Unclear
Policy describes broad categories of data collected and purposes but does not explicitly state a data minimisation principle or commitment to collect only what is necessary for the service.
Q2Does the vendor name the categories of sensitive staff data it holds (government ID or SSN, bank details, health or benefits data, biometrics)?
✓ Good
T3
Answer: Yes
“Payment data, such as data necessary for processing payments and fraud prevention, including credit/debit card numbers, security code numbers and other related billing information”
Policy names payment/billing data as a sensitive category held for customers.
Purpose & Use
Q3Does the vendor commit to use the school's data only to provide the contracted service, and not for its own purposes? GATE
✓ Good
T3
Answer: Yes
“If your organization provides you with access to an Offering, our processing of personal data provided by or collected from you or your organization in connection with the Offering's content is performed under the direction of your organization and is subject to a data processing agreement between your organization and us.”
Policy states processing is under customer direction and subject to a DPA.
Q4Does the vendor use school or staff data for marketing, profiling or product analytics beyond operating the service?
✗ Concern
T3
Answer: Yes
“To train and improve our products or services and enhance the overall user experience, including but not limited to, identifying patterns, correcting inaccuracies, and enhancing response quality”
Policy explicitly states use of data to train and improve products/services beyond operating the service.
Data Sharing
Q5Does the vendor limit sharing with third parties to the purpose for which the data was collected? GATE
? Not addressed
T3
Answer: Unclear
“We may transfer personal data to other third parties in connection with complying with legal obligations or establishing, exercising or defending rights or claims”
Policy describes sharing with service providers and for legal compliance, but does not clearly limit sharing to service providers acting on vendor's behalf or customer instructions.
Q6Does the vendor publish or offer a list of sub-processors, naming its cloud host, and commit to notice before adding one?
? Not addressed
T3
Answer: Unclear
“We employ affiliates and other companies to perform functions on our behalf, such as IT-services or payment processing services. These affiliates and other companies process personal data only for the purpose of such services.”
Policy mentions service providers but does not publish a sub-processor list, name the cloud host, or commit to notice before adding sub-processors.
Data Sold
Q7Is staff or school personal information ever sold or rented to any outside party? GATE
? Not addressed
T0
Answer: Unclear
Policy does not explicitly state whether personal information is sold or rented to outside parties.
Data Rights
Q8Does the vendor support access, correction and deletion requests from the school, with a stated process or response time?
✓ Good
T3
Answer: Yes
“In particular, and subject to the legal requirements, you may be entitled to Obtain from us confirmation as to whether or not personal data concerning you are being processed, and where that is the case, access to the personal data; Obtain from us the correction of inaccurate personal data concerning you; Obtain from us the erasure of your personal data”
Policy describes access, correction, and deletion rights but does not state a specific response time or process.
Q9Does the school keep ownership of its data, with return or deletion at the end of the contract?
? Not addressed
T3
Answer: Unclear
“Unless indicated otherwise at the time of the collection of your personal data (e.g. within a form completed by you), we erase your personal data if the retention of that personal data is no longer necessary for the purposes for which they were collected or otherwise processed, or to comply with legal obligations”
Policy describes deletion but does not clearly state school ownership of data or commitment to return data at end of contract.
Retention
Q10Does the vendor state a retention period for staff data after the service ends, and whether deletion is automatic?
? Not addressed
T3
Answer: Unclear
“Unless indicated otherwise at the time of the collection of your personal data (e.g. within a form completed by you), we erase your personal data if the retention of that personal data is no longer necessary for the purposes for which they were collected or otherwise processed, or to comply with legal obligations”
Policy does not state a specific retention period after service ends or whether deletion is automatic.
Data Security
Q11Does the vendor disclose baseline safeguards: encryption in transit and at rest, single sign-on with MFA for admin roles, and an independent attestation (SOC 2, ISO 27001) or equivalent?
? Not addressed
T3
Answer: Unclear
“To protect your personal data against accidental or unlawful destruction, loss, use, or alteration and against unauthorized disclosure or access, we use adequate physical, technical and organizational security measures.”
Policy mentions security measures but does not name encryption standards (TLS, AES), SSO/MFA for admin access, or independent attestations (SOC 2, ISO 27001).
Breach Notice
Q12Does the vendor commit to notify the customer of a security incident without undue delay, with a stated hour count?
? Not addressed
T0
Answer: Unclear
Policy does not disclose a commitment to notify customers of security incidents without undue delay or within a stated timeframe.
Biometrics & Surveillance
Q13For products that capture faces, fingerprints or other biometric identifiers: does the vendor require written notice and consent before collection, and publish a retention and destruction schedule? GATE
? Not addressed
T3
Answer: Unclear
“Personal data accessed through permissions you grant to our mobile applications, such as your device's location data (e.g. GPS coordinates for asset tracking), camera input (e.g. barcode scans for inventory), microphone input (e.g. for voice commands)”
Product category is Security & Facilities Operations. Policy mentions camera input but does not explicitly require written consent before biometric collection or publish a retention/destruction schedule for biometric data.
Q14Does the vendor use customer video, images or biometric data for its own analytics or model training?
✗ Concern
T3
Answer: Yes
“To train and improve our products or services and enhance the overall user experience, including but not limited to, identifying patterns, correcting inaccuracies, and enhancing response quality”
Product category is Security & Facilities Operations. Policy states use of data (including video/images from camera input) to train and improve products.
Payments
Q15For products that take card payments: does the vendor state PCI DSS compliance and name the scope it covers for the customer?
— N/A
T0
Answer: N/A
not applicable to this product type
AI & Model-Training
Q16Does the vendor use customer or staff data, including uploaded documents, to train or improve AI or machine-learning models? GATE
✗ Concern
T3
Answer: Yes
“To train and improve our products or services and enhance the overall user experience, including but not limited to, identifying patterns, correcting inaccuracies, and enhancing response quality”
Policy explicitly states use of customer data to train and improve AI/ML models.
Q17Does the vendor disclose automated decisions that affect staff (screening, scheduling, pay, access) and offer human review?
? Not addressed
T0
Answer: Unclear
Policy does not disclose automated decisions affecting staff (screening, scheduling, pay, access) or offer human review options.
Jurisdiction & Residency
Q18Does the vendor disclose where data is stored and which privacy laws it complies with?
✓ Good
T3
Answer: Yes
“In the event that we transfer your personal data outside the European Economic Area, we ensure that your data is protected in a manner which is consistent with the General Data Protection Regulation.”
Policy names GDPR compliance and references EEA as a storage region, though specific storage locations are not explicitly named.
Contract & Assurance
Q19Does the vendor offer a data-processing agreement or equivalent written terms to customers?
✓ Good
T3
Answer: Yes
“If your organization provides you with access to an Offering, our processing of personal data provided by or collected from you or your organization in connection with the Offering's content is performed under the direction of your organization and is subject to a data processing agreement between your organization and us.”
Policy states a data processing agreement is in place between organization and vendor.
Jurisdiction & residency — your footprint
Vendor named 0 of 4 countries in your footprint. Shown alongside the verdict, not folded into the score —
a vendor can be strong on privacy yet leave residency gaps for specific countries.
“In the event that we transfer your personal data outside the European Economic Area, we ensure that your data is protected in a manner which is consistent with the General Data Protection Regulation.”
| Country | Privacy law | Coverage |
|---|
| United States (federal) | FERPA / COPPA / PPRA | ⚠ Gap |
| Illinois | SOPPA | ⚠ Gap |
| Texas | Texas Education Code ch. 32 (student data privacy) | ⚠ Gap |
| California | SOPIPA / CCPA | ⚠ Gap |
| GDPR (overlay) | Applies when a school holds data on EU or UK students, families or staff | ✓ Named |