What happens to our data, and the models trained on it, when the contract ends?

Item by item, at the end of the contract

The Standard Terms, the Data Processing Addendum and the Security Overview all cover this. Here is what each says happens, in one place:

Deletion covers BestPair’s sub-processors too. Today there is one: Amazon Web Services, which hosts, stores and processes the data in the United States.

Your data is yours, and it leaves when the contract does

The Standard Terms say your agency owns its data. BestPair has a licence to use it during the term to provide the services, and for aggregated data as described below. The Security Overview puts it plainly: BestPair keeps your data only for the engagement.

While BestPair holds it, the data is pseudonymised only. BestPair never asks for consumer names, Social Security numbers, phone numbers, email or street addresses, or bank or card details. Account IDs are your own, so BestPair cannot tell who a consumer is. The data is processed only in BestPair’s production environment, and it is not copied to development, test or research environments. What BestPair receives.

Models trained on your data belong to BestPair

Security and legal reviewers look for this clause, so here it is without softening. The Standard Terms say BestPair owns the platform, including models trained using your data, and may keep and use those models after the agreement ends. The Security Overview says the same: models trained on your data belong to BestPair and may be kept after the engagement ends. What is deleted is your data itself.

BestPair may also create aggregated data from your data, combined with data from other sources and de-identified so that it does not identify your agency, any consumer or any of your staff. It may use that aggregated data to improve the platform and for benchmarking. Where your data includes protected health information, aggregated data is created only as the Business Associate Agreement permits.

If your client agreements limit what a vendor may keep after the work ends, raise this clause with your counsel before signing. BestPair does not provide legal or compliance advice. When creditor clients need to approve a vendor.

What your agency keeps

• The report. Once the Floor Assessment fee is paid, your agency may use the report for its internal business purposes without time limit, and share it with its advisers and clients under a duty of confidentiality. BestPair keeps ownership of the report’s format and methods.
• Confidentiality. The confidentiality terms last three years after the agreement ends, and for your data, for as long as BestPair holds any of it.
• The monthly record. Every Stage 2 invoice shows both groups’ results, so your own files hold the history of what live pairing did.

When the agreement ends, fees accrued up to that date are paid and the deletion steps above begin. How and when Stage 2 can end is covered in the contract term and leaving early.