Effective Date: 08/01/2026

Last Updated: 06/15/2026

This Privacy Policy describes how Spencer, Shenk, Capers & Associates, operating as DoorTwo (“DoorTwo,” “we,” “us” or “our”), collects, uses, discloses and protects personal information in connection with DoorTwo’s websites, online content, social media pages, the Lyra platform (“Lyra”)  and any other DoorTwo platform, product or service that links to or incorporates this Privacy Policy or that is described in an applicable product-specific privacy notice or supplement.  DoorTwo websites, Lyra and other DoorTwo platforms, products and services are collectively the “DoorTwo Offerings.”

This Privacy Policy replaces DoorTwo’s prior website privacy policy and supplements any written agreement between DoorTwo and a client organization (each, a “Client”). It should be read together with the DoorTwo Terms of Use, Cookie Notice, Social Media Guidelines and, where applicable, DoorTwo’s Data Processing Addendum. If a separate written agreement with a Client includes privacy or data-processing terms, those terms govern DoorTwo’s processing for that Client to the extent they conflict with this Privacy Policy.

DoorTwo may also provide product-specific privacy notices for particular DoorTwo Offerings, features or services, including a Prism Supplemental Privacy Notice. Any applicable product-specific privacy notice supplements this Privacy Policy and controls for the relevant DoorTwo Offering, feature or service to the extent it conflicts with this Privacy Policy.

For purposes of this Privacy Policy, “you” and “your” refer to the individual whose personal information is processed, including, as applicable, a Participant, Client Administrator, DoorTwo Personnel member, DoorTwo website visitor, other DoorTwo Offering user, or Business Contact.

1. Scope and Our Role

DoorTwo provides leadership development, coaching, workshops, assessments and related consulting services. Lyra is designed primarily as a closed business platform used by DoorTwo to administer leadership and team assessments for Clients, host the calendar of engagements and events scheduled with those Clients and support internal operations associated with those engagements, including billing, invoicing and consultant payroll. Lyra is not intended as a public consumer service or general-purpose messaging or content platform.

This Privacy Policy covers personal information collected through: (a)  DoorTwo Offerings; (b) DoorTwo social media pages and online forms; (c) email, event registration and customer-service communications; and (d) DoorTwo’s delivery of other features or services to Clients.

The individuals whose personal information may be processed include:

• Participants (also referred to in some DoorTwo materials as Respondents): employees, contractors or other personnel who are invited by Client to complete an assessment through DoorTwo Offerings or participate in other DoorTwo services.
• Client Administrators: Client personnel who are authorized to interact with DoorTwo Offerings or DoorTwo on behalf of that Client, including Client Admin and OCA Admin roles.
• DoorTwo Personnel: employees, consultants, contractors, Trainers and TAT Scorers who use DoorTwo Offerings or other DoorTwo systems to deliver services, manage engagements and operate the business.
• Website Visitors, Other Users and Business Contacts: individuals who visit DoorTwo websites or use DoorTwo Offerings, interact with DoorTwo social media pages, subscribe to DoorTwo communications, contact DoorTwo or attend DoorTwo events.

Controller and Processor Roles. For personal information processed about Participants in connection with assessments and engagements that a Client has commissioned, the Client is typically the data controller (or, under applicable U.S. privacy laws, the “business”), and DoorTwo acts as a data processor or service provider on the Client’s behalf and in accordance with DoorTwo’s agreement with that Client. For personal information that DoorTwo processes for its own purposes (including website operation, marketing, security, fraud prevention, legal compliance, business administration, billing, invoicing, payroll and improving DoorTwo services), DoorTwo acts as the controller or business.

DPA.  If DoorTwo processes personal information on behalf of a Client and the Client is subject to the GDPR, UK GDPR, Swiss FADP, CCPA/CPRA or similar data protection laws, DoorTwo’s Data Processing Addendum, available at doortwo.com/legal, applies to that processing as provided in the applicable Client agreement.

The Data Processing Addendum may include service-specific schedules, including a Prism Processing Schedule, that apply to particular DoorTwo Offerings, features or services.

2. Personal Information We Collect

We collect personal information that is reasonably necessary or appropriate to operate DoorTwo, provide DoorTwo Offerings and deliver our services. The categories generally include:

2.1 Account and Profile Information

When you create, are invited to or use a DoorTwo account, we may collect:

• Required account information, including email address, first name, last name and authentication credentials. Passwords are stored in hashed form; we do not have access to your plaintext password.
• Optional profile information, which may include Client organization affiliation, business phone number, mobile phone number, mailing or business address, age, gender and job title.

2.2 Assessment Data

If you complete an assessment through Lyra or other DoorTwo Offerings or services, we may collect:

• Assessment item responses, including narrative content such as TAT stories.
• Assessment results, scores, profiles and reports generated from your responses.
• Summary results stored at the profile level, such as PCM Base and Phase and TAT percentages.
• Demographic information collected as part of certain assessment instruments, where the instrument requires it.

Certain assessments administered through DoorTwo Offerings may be owned, licensed or scored by third-party assessment providers, including Kahler Communications, Change Cycle and The Myers-Briggs Company. When you complete those assessments, the information needed to score and return that assessment may be transmitted to and processed by the applicable third-party provider under that provider’s own privacy practices. Those providers may request additional identifying information from you as required by their policies. See Section 5.

2.3 Engagement, Calendar and Operational Data

Depending on how you interact with DoorTwo, we may collect the following categories of information about your engagement with DoorTwo Offerings, other services, programs, assessments and related activities:

• Scheduled sessions, events and engagements you are associated with.
• Engagement type, duration, location (virtual or physical), assigned consultant and Client or engagement identifiers.
• Records derived from calendar entries used to calculate consultant compensation, generate Client invoices and support billing, payroll and business administration.
• Internal notes and references tied to Client engagements, subject to any applicable confidentiality commitments in the Client agreement.

Lyra does not currently collect or store payment card data, bank account numbers or other financial account information. Payment of consultants, invoicing of Clients and collection from Clients are handled outside of Lyra.

2.4 Website, Cookie and Usage Information

When you visit or use DoorTwo Offerings, we may collect technical and usage information, including login timestamps, session activity, browser type and version, device information, pages viewed, referring pages, approximate location derived from IP address and cookies or similar technologies.

Lyra uses session cookies and similar technologies to keep users logged in and maintain session security. Lyra also uses Microsoft Azure Application Insights to collect operational and diagnostic information, such as performance, errors and the items above, to keep the service secure, reliable and performant. This information is used for operational and diagnostic purposes and retained according to DoorTwo’s applicable technical and security settings.

DoorTwo websites may use Google Analytics and similar analytics technologies to understand website traffic and improve content. DoorTwo does not currently use DoorTwo Offerings for advertising cookies, cross-site tracking or behavioral advertising analytics.

2.5 Client Organization Information

DoorTwo Offerings store information about each Client organization in connection with the engagements that DoorTwo administers for that Client. Although much of this information is organizational rather than personal, it may include personal information about Client personnel, such as Client organization name and address, names and contact details of Client Administrators, engagement records, assessments commissioned, dates, assigned DoorTwo personnel and billing or contract reference information.

2.6 Sensitive Information

DoorTwo does not intentionally collect government identifiers, precise geolocation, biometric data, health or medical information or other sensitive personal information through DoorTwo Offerings, except to the extent an assessment instrument lawfully requests demographic information or a Client or individual provides information in free-text communications outside DoorTwo Offerings. You should not submit sensitive personal information through DoorTwo Offerings unless DoorTwo specifically asks for it and explains why it is needed. If DoorTwo becomes aware that unnecessary sensitive information has been submitted, DoorTwo may take reasonable steps to delete, restrict or otherwise handle that information in accordance with applicable law and Client instructions.

3. How We Use Personal Information

DoorTwo uses personal information for the following purposes:

• To provide DoorTwo Offerings: to create and authenticate accounts, deliver assessments, generate and deliver reports, operate engagement calendars and provide account support.
• To deliver services to our Clients: to administer assessments selected by the Client, schedule and manage engagements, provide coaching and development services, generate reports and produce outputs that the Client has engaged DoorTwo to provide.
• To support coaching and development engagements: where you participate in a coaching, training or development engagement with a DoorTwo Trainer or Consultant, your assessment results and report may be reviewed and discussed with you as part of that engagement. DoorTwo does not disclose underlying item responses beyond the report itself except as described in this Privacy Policy, as authorized by the applicable Client or individual, or as otherwise permitted or required by applicable law or agreement.
• For internal operations: to calculate consultant compensation, generate Client invoices, monitor platform performance and security, manage vendors and maintain business records.
• For website, marketing and communications: to respond to inquiries, send requested information, manage event registrations, send promotional communications and analyze website use. You may unsubscribe from promotional email communications using the unsubscribe mechanism provided in the email or by contacting DoorTwo.
• For security and integrity: to detect, investigate and prevent unauthorized access, fraud, abuse and security incidents and to enforce DoorTwo terms and agreements.
• For legal and compliance purposes: to comply with applicable law, respond to lawful requests, exercise or defend legal claims and satisfy contractual obligations to Clients.
• Aggregated or De-identified Information: to create and use aggregated or de-identified information for internal research, service improvement, product development and statistical analysis, provided that DoorTwo does not attempt to reidentify the information and does not use individual assessment responses, TAT stories, assessment reports, results documents, profiles, screenshots, PDFs, exports or full summaries as inputs into external AI tools.

3.1 Artificial Intelligence and Automated Decisions

Lyra does not currently include a chatbot, AI assistant or other generative AI feature. DoorTwo does not use Lyra Assessment Artifacts to train external artificial intelligence or machine learning models, and DoorTwo does not provide Lyra Assessment Artifacts to third parties for that purpose.  AI features included in other DoorTwo Offerings are described in the applicable product-specific privacy notice.

DoorTwo’s internal AI use policy prohibits DoorTwo Personnel from inputting Assessment Artifacts, whether generated through Lyra or a third-party assessment platform, into external AI tools, even in altered or pseudonymized form.  “Assessment Artifacts” means assessment item responses, TAT stories and formal assessment reports, results documents, profiles and full summaries.

DoorTwo may use AI tools for other internal business purposes, such as drafting documents, reviewing agreements, summarizing meeting notes, researching ideas, brainstorming or referencing a Participant’s typology at a summary level in DoorTwo Personnel’s own work product, provided those uses do not involve prohibited Assessment Artifacts and comply with DoorTwo’s internal policies.

DoorTwo does not currently use Lyra to make solely automated decisions that produce legal or similarly significant effects concerning individuals. DoorTwo assessments and reports are intended for coaching, leadership development and organizational development purposes and are not intended to be used as the sole basis for employment or other consequential decisions.  If DoorTwo later adds AI-enabled features to Lyra or approves any workflow involving Assessment Artifacts and external AI tools, DoorTwo will evaluate whether updates to this Privacy Policy, additional disclosures, contractual terms, notices, consent mechanisms or other transparency measures are appropriate or required by applicable law, including the EU Artificial Intelligence Act where applicable.

4. Legal Bases for Processing (EEA, UK and Switzerland)

If you are located in the European Economic Area, the United Kingdom or Switzerland, DoorTwo relies on the following legal bases under the GDPR, UK GDPR and Swiss FADP, as applicable:

• Contract: to provide DoorTwo Offerings to you, perform our contract with the Client that engaged DoorTwo or provide requested services.
• Legitimate interests: to secure and improve DoorTwo Offerings, operate DoorTwo’s business, provide services to Clients, conduct research and service-improvement activities and communicate with business contacts, where those interests are not overridden by your rights.
• Legal obligation: to comply with applicable law, tax, accounting, employment, regulatory and legal-process obligations.
• Consent: where DoorTwo asks for consent for a specific purpose. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Where DoorTwo acts as a processor on behalf of a Client, that Client is responsible for identifying and documenting the legal basis for the processing it directs.

5. How We Share Personal Information

DoorTwo may share personal information as described below and as otherwise permitted by applicable law or agreement. DoorTwo does not sell personal information, and DoorTwo does not share personal information for cross-context behavioral advertising.

5.1 With the Client That Engaged DoorTwo

DoorTwo shares assessment reports, engagement records and related summary information with the Client that commissioned the engagement, in accordance with the Client agreement. If you are a Participant, your Client determines who within its organization may view your report.

Individual responses are treated differently than reports. For the Organizational Culture Assessment (OCA), Thematic Apperception Test (TAT) and Leadership Behavior Inventory (LBI), individual item responses, including TAT stories, are not shared with the Client or any other party outside certified DoorTwo Trainers and Consultants involved in your engagement, or yourself, except as described in this Privacy Policy, as authorized by the applicable individual or Client, or as otherwise permitted or required by applicable law or agreement. The Client receives the report generated from your responses; it does not receive the underlying item responses unless you authorize that disclosure or another permitted basis applies.

You should review your Client’s privacy notices and policies for details on how it handles the information it receives from DoorTwo about you.

5.2 With Third-Party Assessment Providers

When you complete an assessment owned, licensed or scored by a third-party provider, including Kahler Communications, Change Cycle and The Myers-Briggs Company, the information needed to score and return that assessment is transmitted to that provider. Their processing is governed by their own privacy policies and contractual terms.

5.3 With Service Providers and Sub-processors

DoorTwo uses vendors to host, secure and operate DoorTwo Offerings and business systems. These vendors are contractually obligated to process personal information only on DoorTwo’s instructions or as otherwise permitted by law and to maintain appropriate safeguards. Current categories include cloud hosting and storage providers, email and transactional messaging providers, security, logging and infrastructure monitoring providers, website analytics providers and ordinary business systems such as email, document management, accounting and customer-support tools.

For Lyra, DoorTwo makes subprocessor information available through DoorTwo’s Data Processing Addendum, an online subprocessor list or another reasonable mechanism.

For other DoorTwo Offerings, features or services, DoorTwo may provide subprocessor information in a product-specific privacy notice, service-specific DPA schedule, online subprocessor list or another reasonable mechanism.

5.4 Legal, Safety and Corporate Transactions

DoorTwo may disclose personal information when DoorTwo believes in good faith that disclosure is required to comply with applicable law, legal process or a lawful government request; to enforce agreements; to protect the rights, property or safety of DoorTwo, Clients, personnel or others; or to investigate suspected or actual unlawful activity. If DoorTwo is involved in a merger, acquisition, financing, reorganization, bankruptcy or sale of assets, personal information may be transferred as part of that transaction. DoorTwo will provide notice consistent with applicable law before personal information becomes subject to a materially different privacy policy.

6. International Data Transfers

DoorTwo is based in the United States, and personal information may be stored and processed in the United States and other jurisdictions where DoorTwo or its service providers operate. If you access DoorTwo Offerings from outside the United States, including from the European Economic Area, United Kingdom, Switzerland or other jurisdictions, your personal information may be transferred to and processed in the United States or other jurisdictions that may have data protection laws different from those in your jurisdiction.

Where required by applicable law, DoorTwo relies on appropriate safeguards for international transfers, including the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum and any additional safeguards required by applicable law. For Client processing subject to DoorTwo’s Data Processing Addendum, applicable transfer terms are included in the Data Processing Addendum, available at doortwo.com/legal. DoorTwo will provide additional information about applicable safeguards where required by law.

For other DoorTwo Offerings, features or services, applicable transfer terms may be described in the relevant product-specific privacy notice, service-specific DPA schedule or other applicable documentation.

7. Data Retention

DoorTwo retains personal information for as long as reasonably necessary to provide DoorTwo Offerings and other services, satisfy the purposes described in this Privacy Policy and meet legal, contractual, accounting, tax, reporting and Client obligations. In general:

• Account and profile information is retained for the duration of the relationship with the Client that invited you and for so long as that Client maintains an active engagement with DoorTwo, subject to lawful deletion or restriction requests.
• Assessment data, item responses, summary results and reports are retained for the period reasonably necessary to support continued use of assessments by Participants and certified Trainers and Consultants over time, maintain the historical record of assessments administered through DoorTwo Offerings and satisfy applicable legal, contractual and Client obligations, unless a different retention period applies under applicable law, the applicable Client agreement or Client instructions.
• Calendar, engagement, billing, invoicing and payroll records are retained for the period required by applicable tax, accounting, employment and audit obligations.
• Security and access logs are retained for the operational period reasonably needed for security investigations and audit needs.
• Website analytics information is retained according to the settings of the applicable analytics provider.

You may request deletion of personal information as described in Section 8. Where DoorTwo is the controller, or where the Client that engaged DoorTwo authorizes deletion of information that DoorTwo processes on its behalf, DoorTwo will respond within the timeframe required by applicable law and will delete applicable personal information where required or authorized, subject to legally required retention, Client instructions and backup or archival limitations.

If you are located in the European Economic Area, United Kingdom or Switzerland, you may have rights under the GDPR, UK GDPR or Swiss FADP that apply to DoorTwo’s retention practices, including the right to request restriction of processing where retention exceeds what is necessary for the applicable purposes. DoorTwo will work with you and the applicable Client to honor those rights as required by law.

8. Your Privacy Rights

Depending on where you live and DoorTwo’s role for the relevant data, you may have rights to request access, correction, deletion, portability, objection, restriction of processing, withdrawal of consent and non-discrimination for exercising privacy rights.

How to exercise your rights. Because DoorTwo typically processes Participant and Client Administrator personal information on behalf of a Client, requests to exercise rights with respect to assessment and engagement data should generally be directed to your Client. If you submit a request directly to DoorTwo for data that DoorTwo processes on a Client’s behalf, DoorTwo will refer the request to the applicable Client and respond as that Client directs, in accordance with applicable law.

For personal information that DoorTwo processes as a controller, you may submit a request using the contact details in Section 13. DoorTwo will respond within the timeframe required by applicable law and may need to verify your identity before responding.

8.1 U.S. State Privacy Rights

To the extent applicable, residents of California and other U.S. states with comprehensive privacy laws may have additional rights, such as the right to know or access categories and specific pieces of personal information, correct inaccurate personal information, delete personal information, obtain a copy of personal information, opt out of sales or sharing, opt out of targeted advertising, limit certain uses of sensitive personal information and appeal a privacy-rights decision. DoorTwo does not sell personal information or share personal information for cross-context behavioral advertising. DoorTwo also does not currently use DoorTwo Offerings to make automated decisions that produce legal or similarly significant effects.

California “Shine the Light.” California residents may request information regarding certain disclosures of personal information to third parties for their direct marketing purposes. DoorTwo does not disclose personal information to third parties for their own direct marketing purposes without permission.

8.2 EEA, UK and Swiss Rights

If you are located in the European Economic Area, United Kingdom or Switzerland, you have the right to lodge a complaint with your local data protection authority. DoorTwo encourages you to contact DoorTwo first, so that DoorTwo can try to resolve your concern.

9. Security

DoorTwo maintains administrative, technical and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration and destruction. These safeguards may include, as appropriate, encryption, access controls, authentication requirements and logging or monitoring.

No method of transmission or storage is completely secure, and DoorTwo cannot guarantee absolute security. DoorTwo maintains an internal incident-response and breach-notification procedure for DoorTwo Offerings that covers detection, internal reporting, triage, containment, risk assessment and notifications where required by applicable law or applicable Client agreements.

10. Children

DoorTwo Offerings are not directed to, marketed to or intended for individuals under the age of 16, and DoorTwo does not knowingly collect personal information from individuals under 16. If DoorTwo learns that it has collected personal information from a person under 16, DoorTwo will take reasonable steps to delete it, unless retention is required or permitted by applicable law. If you believe a child has provided personal information to DoorTwo, please contact DoorTwo using the details in Section 13.

11. Cookies and Similar Technologies

DoorTwo uses cookies and similar technologies to operate DoorTwo Offerings, including maintaining login sessions and platform security for Lyra and other platforms. DoorTwo websites may use necessary cookies and analytics cookies. You can control cookies through your browser settings, but disabling cookies may affect website or DoorTwo Offering functionality.  DoorTwo’s current website cookie disclosures identify Google Analytics as a third-party analytics provider.  DoorTwo websites do not currently respond to “Do Not Track” browser signals. Because DoorTwo does not sell or share personal information, opt-out preference signals such as Global Privacy Control do not change how DoorTwo processes personal information.

12. Changes to This Privacy Policy

DoorTwo may update this Privacy Policy and any product-specific privacy notice from time to time. When DoorTwo makes material changes, DoorTwo will update the “Last Updated” date above and provide notice through the DoorTwo website, the applicable DoorTwo Offering, email or other reasonable means. The updated Privacy Policy will apply from the effective date stated in the updated policy, except where additional notice or consent is required by applicable law.

13. How to Contact DoorTwo

For questions or requests regarding this Privacy Policy or DoorTwo’s privacy practices, please contact:

Spencer, Shenk, Capers & Associates, d/b/a DoorTwo

Attention: Privacy

Email: privacy@doortwo.com

Mailing address: 180 E. Ocean Blvd., Suite 650, Long Beach, CA 90802

If you are a Participant or Client Administrator, you may also wish to contact your Client organization’s privacy contact for questions about how your information is used by your Client.

DoorTwo Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement between Spencer, Shenk, Capers & Associates, d/b/a DoorTwo (“DoorTwo”) and the client identified in the applicable agreement, order form, statement of work or other written agreement with DoorTwo (“Client”) for DoorTwo’s provision of services that involve Processing of Client Personal Data (the “Agreement”). DoorTwo and Client are each a “party” and collectively the “parties.”

This DPA applies to DoorTwo’s Processing of Client Personal Data under the Agreement and is incorporated into the Agreement by reference where the Agreement, an order form, a statement of work, DoorTwo’s online terms or another written agreement between the parties states that this DPA applies or incorporates this DPA by reference. If there is a conflict between this DPA and the Agreement regarding DoorTwo’s Processing of Client Personal Data, this DPA controls to the extent of the conflict, except that the Agreement controls with respect to commercial terms, payment terms, service descriptions, limitations of liability and any other terms that do not specifically govern the Processing of Client Personal Data.

1. DEFINITIONS

1.1  In this DPA:

(a) “Assessment Artifacts” means assessment item responses, TAT stories, narrative assessment content, formal assessment reports, results documents, scored profiles and full summaries generated through Lyra or third-party assessment platforms.

(b) “Controller,” “Data Subject,” “Personal Data,” “Processing,” “Processor” and “Supervisory Authority” have the meanings given to them under applicable Data Protection Law. “Business,” “Service Provider,” “Sell,” “Share” and “Consumer” have the meanings given to them under the CCPA.

(c) “CCPA” means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., including as amended by the California Privacy Rights Act and its implementing regulations.

(d) “Client Personal Data” means Personal Data that DoorTwo Processes on behalf of Client in providing the Services and that is subject to Data Protection Law.

(e) “Data Protection Law” means, as applicable to the Processing of Client Personal Data under the Agreement, the GDPR, UK GDPR, Swiss FADP, CCPA and other applicable privacy, data protection and data security laws of the United States, European Union, European Economic Area, United Kingdom, Switzerland and their respective member states or jurisdictions, in each case as amended, replaced or supplemented.

(f) “Data Subject Request” means a request from a Data Subject to exercise rights under Data Protection Law, including rights of access, correction, deletion, portability, objection, restriction, withdrawal of consent, opt-out or appeal.

(g) “DoorTwo Offerings” means DoorTwo websites, Lyra and any other DoorTwo platform, product or service made available by DoorTwo and described in an applicable Service Schedule.

(h) “DoorTwo Personnel” means DoorTwo employees, consultants, contractors, Trainers and other personnel who Process Client Personal Data or otherwise use DoorTwo Offerings or other DoorTwo systems to provide the Services.

(i) “GDPR” means Regulation (EU) 2016/679. “UK GDPR” means the GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018. “Swiss FADP” means the Swiss Federal Act on Data Protection.

(j) “Lyra” means DoorTwo’s Lyra platform.

(k) “Personal Data Breach” means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Client Personal Data.

(l) “Restricted Transfer” means a transfer of Client Personal Data that would be prohibited under Data Protection Law without implementation of additional safeguards, such as Standard Contractual Clauses.

(m) “Services” means DoorTwo’s services under the Agreement that involve Processing of Client Personal Data, including Lyra and any other DoorTwo Offering to the extent ordered or used by Client or described in an applicable Service Schedule.

(n) “Service Schedule” means a schedule, annex or other written document that supplements this DPA for a particular DoorTwo Offering, feature or service, including a Prism Processing Schedule.

(o) “Standard Contractual Clauses” or “SCCs” means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of June 4, 2021, as amended, replaced or supplemented.

(p) “Sub-processor” means a Processor engaged by DoorTwo to Process Client Personal Data in providing the Services.

(q) “UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner.

1.2  Capitalized terms used but not defined in this DPA have the meanings given to them in the Agreement.

2. ROLES

2.1  The parties acknowledge that for Client Personal Data, Client is the Controller or Business and DoorTwo is the Processor or Service Provider, except to the extent the Agreement expressly states otherwise or DoorTwo Processes Personal Data for DoorTwo’s own controller or business purposes as described in DoorTwo’s Privacy Policy.

2.2  Each party will comply with Data Protection Law applicable to it in its respective role.

2.3  If Client is a Processor or Service Provider acting on behalf of a third-party Controller or Business, Client represents that Client’s instructions to DoorTwo are authorized by the relevant Controller or Business.

3. SCOPE AND DETAILS OF PROCESSING

3.1  This DPA applies to DoorTwo’s Processing of Client Personal Data in connection with the Services.

3.2  The subject matter, nature, purpose and duration of the Processing, the categories of Data Subjects and the types of Client Personal Data are described in Annex I.

3.3  If the parties incorporate a Service Schedule, the Service Schedule supplements Annex I, Annex II and Annex III for the applicable DoorTwo Offering, feature or service. If a Service Schedule conflicts with the general descriptions in this DPA regarding the applicable DoorTwo Offering, feature or service, the Service Schedule controls for that DoorTwo Offering, feature or service only, except to the extent the SCCs or Data Protection Law require otherwise.

4. INSTRUCTIONS

4.1  DoorTwo will Process Client Personal Data only in accordance with Client’s documented lawful instructions, including as set forth in this DPA, the Agreement and Client’s use or configuration of the Services, or as necessary to comply with applicable law. DoorTwo will inform Client if DoorTwo believes an instruction violates Data Protection Law, unless prohibited by law.

4.2  DoorTwo will not: (a) Sell or Share Client Personal Data; (b) retain, use or disclose Client Personal Data for any purpose other than the business purposes specified in the Agreement or as otherwise permitted by Data Protection Law; (c) retain, use or disclose Client Personal Data outside the direct business relationship between DoorTwo and Client; or (d) combine Client Personal Data with Personal Data received from or on behalf of another person or collected from DoorTwo’s own interaction with the Data Subject, except as permitted by Data Protection Law.

4.3  DoorTwo may Process Client Personal Data to detect security incidents, protect against malicious, deceptive, fraudulent or illegal activity, debug, perform services on behalf of Client, maintain or improve the quality or safety of the Services and undertake other activities permitted for Processors or Service Providers under Data Protection Law.

4.4  DoorTwo will notify Client if DoorTwo determines that it can no longer meet its obligations under applicable Data Protection Law with respect to Client Personal Data, in which case Client may take reasonable and appropriate steps, consistent with the Agreement, to stop and remediate any unauthorized use of Client Personal Data.

5. CLIENT RESPONSIBILITIES

5.1  Client is responsible for: (a) the lawfulness of Client Personal Data Processing under and in connection with the Services; (b) providing all notices and obtaining all consents, permissions and rights necessary for DoorTwo to Process Client Personal Data; (c) ensuring Client’s instructions comply with Data Protection Law; (d) determining which Client personnel may access reports or other outputs; and (e) not using DoorTwo assessments, reports, profiles or other outputs as the sole basis for hiring, firing, promotion, compensation, discipline, team selection or other decisions that may affect an individual’s employment, job prospects, advancement, credit, education, housing, healthcare or other legal rights or opportunities unless DoorTwo expressly authorizes that use in writing, and being solely responsible for any decisions Client makes or actions Client takes based on DoorTwo assessments, reports, profiles or other outputs, including compliance with applicable law and any notice, consent or human-review requirements.

5.2  Client will not provide sensitive Personal Data to DoorTwo or through DoorTwo Offerings unless the Agreement expressly permits it or the applicable assessment instrument requires it and Client has satisfied all legal requirements for that Processing.

6. SUBPROCESSING

6.1  Client grants DoorTwo general authorization to engage Sub-processors to provide the Services, subject to this Section 6.

6.2  DoorTwo will maintain a current list of Sub-processors for the Services available upon request. DoorTwo may identify platform-specific Sub-processors in an applicable Service Schedule, online subprocessor list or another reasonable mechanism.

6.3  DoorTwo will provide notice of any new Sub-processor as required by the Agreement or, if the Agreement is silent, by updating the Sub-processor list or otherwise providing commercially reasonable advance notice (at least thirty (30) days) before the new Sub-processor Processes Client Personal Data, except where earlier use is reasonably necessary to maintain security, availability or continuity of the Services. Client may object to a new Sub-processor within the period stated in the notice or, if no period is stated, within thirty (30) days, on reasonable data-protection grounds. The parties will work in good faith to resolve the objection.

6.4  DoorTwo will enter into a written agreement with each Sub-processor imposing data-protection obligations substantially similar to those imposed on DoorTwo under this DPA. DoorTwo remains responsible for its Sub-processors’ performance of such obligations.

6.5  DoorTwo will use commercially reasonable efforts to include terms in applicable Sub-processor agreements requiring each Sub-processor that Processes Client Personal Data or data processed through a DoorTwo Offering to notify DoorTwo of a Personal Data Breach affecting that data without undue delay and, where practicable, within forty-eight (48) hours after the Sub-processor becomes aware of the breach.

7. INTERNATIONAL TRANSFERS

7.1 To the extent DoorTwo’s Processing of Client Personal Data involves a Restricted Transfer, the parties agree that the SCCs and, where applicable, UK Addendum apply and are incorporated into this DPA by reference.

7.2 For EEA transfers, Module Two (Controller-to-Processor) of the SCCs applies where Client is a Controller and DoorTwo is a Processor. If Client is a Processor and DoorTwo is a Sub-processor, Module Three (Processor-to-Processor) applies. The optional docking clause in Clause 7 is not used. Clause 9(a) Option 2 applies with the notice period in Section 6.3. The optional redress language in Clause 11(a) is not used. Clause 17 Option 1 applies, with Irish law governing. The courts in Clause 18(b) are the courts of Ireland. Annexes I, II and III to the SCCs are completed by Annexes I, II and III to this DPA.

7.3 For UK transfers, the UK Addendum applies and is completed by the information in this DPA and the SCCs. For Swiss transfers, the SCCs apply as modified to address Swiss law, the Swiss Federal Data Protection and Information Commissioner and references to Switzerland and the Swiss FADP.

7.4 DoorTwo may make onward transfers of Client Personal Data to Sub-processors in connection with the Services, provided those onward transfers comply with Data Protection Law.

8. PERSONNEL

DoorTwo will ensure that personnel authorized to Process Client Personal Data are subject to appropriate confidentiality obligations and receive instructions regarding the permitted Processing of Client Personal Data.

9. SECURITY AND PERSONAL DATA BREACHES

9.1  DoorTwo will implement and maintain technical and organizational measures designed to protect Client Personal Data against Personal Data Breaches. The current measures are described in Annex II. DoorTwo may update those measures from time to time, provided the updates do not materially reduce the overall level of protection described in this DPA.

9.2  DoorTwo will notify Client without undue delay after becoming aware of a Personal Data Breach affecting Client Personal Data and will endeavor to provide initial notice within forty-eight (48) hours where practicable. Notification may be preliminary and supplemented as DoorTwo’s investigation continues. DoorTwo may provide notice before all facts are known and will not delay notice solely because the investigation is incomplete. Failure to meet the forty-eight (48)-hour target will not constitute a breach of this DPA if DoorTwo otherwise provides notice without undue delay.

9.3  DoorTwo’s notice will include, to the extent known and applicable: (a) a description of the nature of the Personal Data Breach; (b) the categories and approximate number of Data Subjects affected; (c) the categories and approximate volume of records affected; (d) likely consequences; (e) measures taken or proposed to address the breach and mitigate adverse effects; and (f) a DoorTwo contact point for the incident. DoorTwo will provide reasonable updates as material additional information becomes available.

9.4  DoorTwo’s notification of or response to a Personal Data Breach is not an admission of fault or liability. Client is responsible for determining whether regulatory, Data Subject or third-party notifications are required for Client Personal Data where DoorTwo acts as Processor, except to the extent DoorTwo is independently required by law to provide a notification. DoorTwo will reasonably support Client’s notification efforts as required by Data Protection Law.

10. ASSISTANCE

10.1  Taking into account the nature of the Processing and information available to DoorTwo, DoorTwo will reasonably assist Client with: (a) responding to Data Subject Requests; (b) data protection impact assessments and prior consultations; (c) security obligations; and (d) breach notifications, in each case to the extent required by Data Protection Law and applicable to the Services.

10.2  If DoorTwo receives a Data Subject Request or regulatory inquiry relating to Client Personal Data, DoorTwo will, unless prohibited by law, inform the requester to contact Client or forward the request to Client. DoorTwo will not respond to the request except on Client’s documented instructions or as required by law.

11. AUDIT

11.1  DoorTwo will make available information reasonably necessary to demonstrate compliance with this DPA, subject to appropriate confidentiality restrictions, which may include responses to reasonable security or privacy questionnaires, summaries of relevant security practices or other information that DoorTwo determines is appropriate under the circumstances.

11.2  Solely if required by Data Protection Law and the information in Section 11.1 is insufficient to demonstrate DoorTwo’s compliance with this DPA, Client may request an audit no more than once per calendar year during the term of the Agreement, on at least thirty (30) days’ reasonable advance written notice. Any audit must be limited to the Processing of Client Personal Data under the Agreement and conducted during DoorTwo’s normal business hours, in a manner that does not unreasonably interfere with DoorTwo’s operations, systems, personnel or services. Any auditor must be independent, qualified, not a competitor of DoorTwo and bound by written confidentiality obligations reasonably acceptable to DoorTwo. DoorTwo may require the audit to be conducted remotely or through review of documentation where DoorTwo reasonably determines that on-site access is unnecessary or would create security, confidentiality, operational or legal risk. DoorTwo may restrict or redact access to systems, premises, records or information where necessary to protect other customers, confidential information, trade secrets, security, privacy, legal privilege or the integrity of DoorTwo’s systems. Client is responsible for all costs and expenses of any audit unless Data Protection Law requires otherwise.

12. RETURN AND DELETION

12.1 This DPA remains in effect for so long as DoorTwo Processes Client Personal Data.

12.2 Upon termination or expiration of the Agreement, DoorTwo will delete or return Client Personal Data in accordance with the Agreement and Client’s reasonable written instructions, subject to legal retention requirements, archival backups, security records, dispute records, technical limitations and other documented exceptions.

13. LIABILITY

To the maximum extent permitted by law, each party’s and its affiliates’ aggregate liability arising out of or relating to this DPA is subject to the limitations and exclusions of liability in the Agreement, unless prohibited by Data Protection Law.

14. GENERAL

14.1  This DPA is without prejudice to the rights and obligations of the parties under the Agreement. If this DPA conflicts with the Agreement regarding Processing of Client Personal Data, this DPA controls. If the SCCs conflict with this DPA, the SCCs control to the extent of the conflict.

14.2  This DPA may be modified only by written amendment or by DoorTwo posting an updated version where the Agreement permits online terms to be updated by reference, subject to any notice requirements in the Agreement.

14.3  If any provision of this DPA is invalid or unenforceable, the remaining provisions remain in effect.

14.4  Except where required by Data Protection Law or the SCCs, this DPA does not confer third-party beneficiary rights.

Accepted and agreed to by the authorized representative of each party if this DPA is signed separately. If incorporated by reference into the Agreement, no separate signature is required unless the Agreement requires one.

ANNEX I

A. List of Parties

Data exporter / Client: The client identified in the Agreement. Role: Controller or Processor, as applicable.

Data importer / DoorTwo: Spencer, Shenk, Capers & Associates, d/b/a DoorTwo, 180 E. Ocean Blvd., Suite 650, Long Beach, CA 90802. Role: Processor or Sub-processor, as applicable.

B. Description of Processing

Subject Matter: DoorTwo’s provision of leadership development, coaching, workshop, assessment, DoorTwo Offerings and related services to Client, together with any additional DoorTwo Offering, feature or service described in an applicable Service Schedule.

Duration: The term of the Agreement plus any retention period permitted or required by the Agreement, this DPA, DoorTwo’s Privacy Policy or applicable law.

Nature and Purpose: To administer assessments, manage engagements, generate reports, provide coaching and development services, support Client administration, operate and secure DoorTwo Offerings and any applicable feature or service described in a Service Schedule, provide support and perform related business operations.

Categories of Data Subjects: Participants, Client Administrators, Client personnel and other individuals whose Personal Data is submitted to or Processed through the Services.

Types of Personal Data: Account and profile information, business contact information, assessment item responses, narrative assessment content, scores, profiles, reports, engagement and calendar data, Client organization information, technical and usage data and other Personal Data submitted to or generated through the Services, together with any additional categories described in an applicable Service Schedule.

Sensitive Data: DoorTwo does not intentionally collect sensitive Personal Data through a DoorTwo Offering except where an assessment instrument requires demographic information or Client submits such data. Client is responsible for ensuring that any sensitive Personal Data submitted to DoorTwo or through a DoorTwo Offering is provided lawfully and in accordance with the Agreement.

Frequency of Transfer: Continuous or as needed to provide the Services.

C. Competent Supervisory Authority

For Restricted Transfers subject to the SCCs, the competent supervisory authority is determined in accordance with Clause 13 of the SCCs, based on the establishment or representative of the data exporter identified in the Agreement.

ANNEX II

Technical and Organizational Measures

DoorTwo maintains administrative, technical and physical safeguards designed to protect Client Personal Data. These may include access controls, unique user accounts, password hashing, encryption in transit, encryption at rest, role-based access controls, logging and monitoring, secure cloud hosting, backup and recovery practices, personnel confidentiality obligations and incident-response procedures.

Incident Response. DoorTwo maintains incident-response and breach-notification procedures for Lyra and other DoorTwo Offerings designed to support prompt internal escalation, triage, containment, preservation of relevant evidence, risk assessment, Client notification where DoorTwo acts as Processor, regulatory and individual notification where DoorTwo acts as Controller and such notification is required by law and post-incident review. DoorTwo may update those procedures from time to time to reflect changes in the Services, vendors, laws or DoorTwo’s operations, provided the updates do not materially reduce the overall level of protection described in this DPA.

AI Governance. DoorTwo maintains an internal AI Use Policy or similar governance measures that restrict DoorTwo Personnel from inputting Assessment Artifacts into external AI tools except pursuant to an approved workflow that satisfies applicable Client agreements, data-processing terms, DoorTwo’s written policies and applicable law.

ANNEX III

Sub-processors

DoorTwo will maintain a current Sub-processor list that is available upon request.

ANNEX IV

Service-Specific Processing Schedules

DoorTwo may make Service Schedules available for particular DoorTwo Offerings, features or services. A Service Schedule supplements this DPA for the applicable Services and may describe additional Processing details, technical and organizational measures, Sub-processors, retention details and other service-specific terms.

Effective Date: October 4, 2023

Cookies and similar other technologies
Depending on if your browser is configured to accept cookies, we and third parties who provide services tous may collect certain information automatically when you visit the Sites, including through the use of cookies and web beacons, such as the browser you are using (e.g., Safari, Internet Explorer, Chrome, Mozilla Firefox, etc.), the internet address from which you linked to the Sites, the operating system of your computer (e.g., Microsoft Windows, iOS, Android, etc.), the unique IP address of the computer you used toaccess our Sites and usage and browsing habits.

What is a cookie?
A cookie is a small data file stored on your computer to identify you as a previous visitor to the Sites, which helps us to personalize your experience when you arrive. These are invisible to you, and any portion of our Sites may contain them.

What is a web beacon?
A web beacon is a small piece of data embedded with images on pages of the Sites or in emails, which allow us to collect information such as the number of users that have visited a web page or opened an email. We use may web beacons to measure the effectiveness of our content and campaigns and how visitors use our Sites. This allows us to learn what pages are most attractive to our visitors and what content our visitors like to see.

What categories of cookie and similar technologies do we use?
Depending on how you navigate the Sites, we may use all or some of the following first and third party cookies:

Necessary cookies.These are cookies that enable the core operation of our Sites. As an example – they include, cookies that we use to help control secure areas of our Sites and to make sure it is accessible to you.

Analytics cookies. These allow us to collect certain internet log information and the details of the behavior patterns of people using the Sites.

How do I control cookies?
We are working to update our technology so that users will have better direct control over cookies on our site. At this time, the best way to control cookies is through your browser.

Most web browsers are set to initially accept cookies. You can change your browser settings to notify you when you receive a cookie or not accept cookies generally. However, if you disable this function, you may not be able to use some of the features on our Sites. To learn more about how to control privacy settings and cookie management, click the link for your browser below.

Firefox
Chrome
Internet Explorer
Safari

Third-Party cookies and other similar technologies
The following is our list of third party service providers who may use cookies and other technologies, including for their own purposes such as analytics tracking (please be aware that this cookie policy doesnot govern the use of third party websites or services or providers of third party services):

Google Analytics

Contact: http://www.google.com/intl/af/contact
Privacy Policy: https://policies.google.com/privacy 
Opt-Out: https://tools.google.com/dlpage/gaoptout

We use Google Analytics to collect certain internet log information and details regarding Site visit behaviorpatterns. We configure Google Analytics to avoid collecting information which could directly identify a person, as we do not seek to identify those visitors whose interactions with the Sites are being monitored. Google Analytics uses their own cookies to perform these functionalities.

To learn more about cookies; how to control, disable or delete them, please visit http://www.aboutcookies.org. Some third party advertising networks, like Google, allow you to opt out of orcustomize preferences associated with your internet browsing. For more information on how Google lets you customize these preferences, see their documentation.

PUBLIC GUIDELINES FOR SOCIAL MEDIA
Our social media platforms are intended to allow participation in open communication between DoorTwo and the public. However, occasionally we might need to remove comments to meet industry regulations, data privacy restrictions, and/or uphold the intent of our social media guidelines, including, but not limited to:

COMMENTS SEEKING CUSTOMER SERVICE ISSUES
We may address broad customer service questions online, but we might have to remove comments to protect your privacy. If you have customer service issues or questions, we suggest contacting DoorTwo Customer Service at 310.515.7555 or info@DoorTwo.com.

COMMENTS CONTAINING PERSONALLY IDENTIFIABLE INFORMATION
For general protection, and to comply with data privacy regulations, we will remove posts that contain personally identifiable information, including a phone number, address, email or date of birth.

COMMENTS CONTAINING OFFENSIVE LANGUAGE OR MISLEADING INFORMATION
We will remove any comment that uses profanity, hate speech or other offensive language. We will also remove any comment that makes unsupported claims or accusations or contains false or misleading information. Comments that promote the buying or selling of goods or services or that are clearly spam will also be removed.

Please know that DoorTwo reserves the right to delete any posting at its sole discretion that affects the integrity of our social media platforms.

Effective Date: 08/01/2026

Supersedes prior website terms and the prior Lyra Terms of Use effective January 1, 2021

These Terms of Use (“Terms”) govern access to and use of DoorTwo websites, the Lyra platform (“Lyra”) and any other DoorTwo platform, product or service made available by DoorTwo and linked to these Terms or described in applicable product-specific supplemental terms (each, a “Supplement”) (collectively, the “DoorTwo Offerings”), as well as DoorTwo online content and social media pages, operated by Spencer, Shenk, Capers & Associates, doing business as DoorTwo (“DoorTwo,” “we,” “us” or “our”). For purposes of these Terms, “you” and “your” refer to the individual accessing or using DoorTwo Offerings, DoorTwo online content or DoorTwo social media pages, including, as applicable, a Participant, Client Administrator, DoorTwo Personnel member, Website Visitor or Business Contact (each as described in the Privacy Policy). By accessing or using any DoorTwo Offering, clicking “I accept” (or a similar mechanism) where presented, or creating, accepting or using an account for a DoorTwo Offering, you agree to these Terms.

If you use a DoorTwo Offering or DoorTwo online content on behalf of a client organization (each, a “Client”), your use may also be governed by a written agreement between DoorTwo and that Client (“Client Agreement”). If these Terms conflict with a Client Agreement, the Client Agreement controls as between DoorTwo and the Client, and these Terms continue to apply to individual use of DoorTwo Offerings and DoorTwo online content to the extent not inconsistent with that Client Agreement.

If a Supplement applies to your access to or use of a DoorTwo Offering, that Supplement forms part of these Terms for that DoorTwo Offering. If a Supplement conflicts with these Terms, the Supplement controls for that DoorTwo Offering only.

1. DOORTWO OFFERINGS AND ONLINE CONTENT

DoorTwo provides leadership development, coaching, workshops, assessments and related consulting services. DoorTwo websites provide information about DoorTwo’s business, services, content, events and resources. Lyra, available at https://lyra.doortwo.com, is a closed business platform used to provide online assessment and engagement-management tools for DoorTwo and its Clients.  Other DoorTwo Offerings are described in the applicable Supplement.

By creating or using an account for a DoorTwo Offering, you may be able to complete assessments offered, administered, licensed or scored by DoorTwo, Kahler Communications, Change Cycle, The Myers-Briggs Company or other third-party assessment providers. Each account may be used only by a single, named user (“User”). DoorTwo Offerings may include role-based access, and these Terms apply to all Users regardless of the role assigned to their account.

DoorTwo strives to provide accurate information, but DoorTwo online content and outputs made available through DoorTwo Offerings are intended for leadership development, coaching and organizational development purposes. They are not exhaustive, may evolve over time and should not be treated as legal, medical, psychological, employment, financial or other professional advice.

2. DATA, PRIVACY AND DATA PROCESSING TERMS

DoorTwo’s collection, use and disclosure of personal information is described in the DoorTwo Privacy Policy, available at doortwo.com/legal. The Privacy Policy is provided for informational and disclosure purposes and is not incorporated into these Terms. To the extent applicable data protection laws, a Data Processing Addendum (“DPA”) or a Client Agreement govern DoorTwo’s processing of personal information, those laws or terms control.

For Participants invited by a Client to complete assessments or participate in services through a DoorTwo Offering, that Client is typically the data controller or business for the Participant’s assessment and engagement data, and DoorTwo acts as a data processor or service provider on the Client’s behalf. DoorTwo’s DPA is available at doortwo.com/legal and applies to DoorTwo’s processing of personal information on behalf of a Client where the applicable Client Agreement, order form, statement of work or other written agreement between DoorTwo and the Client incorporates the DPA by reference or otherwise states that the DPA applies.

Your individual assessment item responses, narrative content (including TAT stories) and underlying responses are treated differently than reports. The Client receives the report generated from your responses; it does not receive the underlying item responses except as described in the Privacy Policy, as authorized by you or the applicable Client, or as otherwise permitted or required by applicable law, a Client Agreement, assessment-provider requirements or other applicable agreement.

DoorTwo’s processing of personal information may involve transmission to and storage in the United States. If you access DoorTwo Offerings from outside the United States, your personal information may be transferred to and processed in the United States as described in the Privacy Policy.

DoorTwo may engage service providers and subprocessors to provide, secure and support DoorTwo Offerings and related services, as described in the Privacy Policy and any applicable DPA.

3. YOUR RESPONSIBILITIES

As a condition of your access to and use of DoorTwo Offerings, DoorTwo online content and DoorTwo social media pages, you agree to the following:

3.1  Account Security. DoorTwo makes DoorTwo Offerings available on a one-user-per-account basis, unless otherwise expressly set forth in an applicable Client Agreement or order form. You may not share your username, password or authentication method with anyone else. You are responsible for maintaining the confidentiality of your account credentials and for all activity under your account. You must notify DoorTwo promptly at privacy@doortwo.com  if you become aware of unauthorized access or use.

3.2  Acceptable Use. You may not use DoorTwo Offerings to store, transmit or post unlawful, infringing, libelous, tortious, harmful, malicious or privacy-invasive material; introduce malware or malicious code; interfere with or disrupt DoorTwo systems; attempt to gain unauthorized access to DoorTwo systems, accounts or data; scrape, harvest or bulk download content except as expressly authorized; or violate any applicable law or third-party right.

3.3  No Resale or Service Bureau Use. You may not sell, resell, rent, lease, sublicense, commercially exploit or offer access to DoorTwo Offerings or assessment scoring services on a service bureau basis. You may not contract with parties other than DoorTwo for the scoring of instruments made available through a DoorTwo Offering unless DoorTwo expressly authorizes that use in writing.

3.4  No Copying, Reverse Engineering or Competitive Use. You may not copy, frame, mirror, modify, adapt, translate, reverse engineer, decompile or attempt to derive source code, scoring methods, models, questionnaires, reports, templates, methodologies or other content made available through DoorTwo Offerings, except to the extent applicable law prohibits this restriction. You may not access DoorTwo Offerings to build a competitive product or service or copy any features, functions, scoring, methodology or content.

3.5  Proprietary Notices. You may not remove any copyright, trademark, patent, design-right, trade-secret or other proprietary notices from DoorTwo Offerings or other DoorTwo materials. You may not use DoorTwo or Spencer, Shenk, Capers & Associates trademarks in domain names, social media handles, advertising or public materials without DoorTwo’s written permission.

3.6  Artificial Intelligence Tools. Unless DoorTwo expressly authorizes a specific workflow in writing, you may not upload, paste, transcribe, screenshot or otherwise input Lyra Assessment Artifacts or third-party Assessment Artifacts into an external artificial intelligence or machine learning tool in a manner that violates the Privacy Policy, the applicable Client Agreement, assessment-provider requirements, applicable law or DoorTwo’s written instructions. ”Assessment Artifacts” means assessment item responses, narrative content (including TAT stories) and formal assessment reports, results documents, profiles and full summaries. This restriction does not prohibit DoorTwo or authorized users from using AI tools for general business, coaching, administrative or work-product purposes that do not involve prohibited Assessment Artifacts.

3.7  No Employment or Consequential Decisions. Assessments, reports, profiles and other outputs made available through DoorTwo Offerings are designed for coaching, leadership development and organizational development. They are not designed or authorized for use as the sole basis for hiring, firing, promotion, compensation, discipline, team selection or other decisions that may affect an individual’s employment, job prospects, advancement, credit, education, housing, healthcare or other legal rights or opportunities. If a Client elects to use any assessment, report or other output in connection with any such decision, the Client is solely responsible for that use and for compliance with applicable law, including any notice, consent or human-review requirements.

4. RESTRICTED INSTRUMENTS

Certain assessments made available through a DoorTwo Offering are “Restricted Instruments” and have additional requirements.

4.1  Authorization. You may purchase, administer, interpret or maintain access to Restricted Instruments only if you have been authorized and certified by DoorTwo or one of DoorTwo’s partner certification organizations as eligible to purchase, administer or interpret those Restricted Instruments.

4.2  Interactive Interpretation Sessions. Where required by DoorTwo, the applicable assessment provider, an applicable Client Agreement or applicable law, you agree to provide real-time feedback and interpretation to each Participant who completes a Restricted Instrument, in person, by telephone or through confidential videoconference (each, an “Interactive Interpretation Session”). Any required Interactive Interpretation Session must be more comprehensive than simply providing or passing along a report and must allow the Participant to ask questions and receive feedback in a non-automated format.

4.3  Ethical Standards. If you use a DoorTwo Offering to administer Restricted Instruments, your use must comply with applicable ethical standards, including any written requirements DoorTwo makes available and, where relevant, standards such as the Ethical Principles of Psychologists and Code of Conduct published by the American Psychological Association or the Standards for Educational and Psychological Testing published by the American Educational Research Association.

4.4  Prohibited Uses. You may not use Restricted Instruments or other assessments available through a DoorTwo Offering in a manner prohibited by DoorTwo, an assessment provider, an applicable Client Agreement or applicable law.

5. SUPPORT, DOWNTIME AND AVAILABILITY

If you need assistance creating or using your account for a DoorTwo Offering, DoorTwo may provide limited, basic support as determined by DoorTwo in its discretion. Please contact lyra@doortwo.com.

DoorTwo uses commercially reasonable efforts to make DoorTwo Offerings available, except for planned downtime, maintenance, updates and unavailability caused by circumstances beyond DoorTwo’s reasonable control, including acts of God, acts of government, flood, fire, earthquakes, civil unrest, acts of terror, labor disputes, equipment malfunctions, power failures, Internet service failures and third-party service outages.

Unless a Client Agreement expressly provides otherwise, DoorTwo Offerings are provided without any uptime service level, support service level or commitment to deliver additional functionality. DoorTwo may suspend, restrict, modify or discontinue any DoorTwo Offering in whole or in part at any time, subject to any applicable Client Agreement.

6. INTELLECTUAL PROPERTY

6.1  Ownership. DoorTwo and its licensors own all rights, title and interest in and to DoorTwo Offerings, DoorTwo online content, assessment materials, reports, templates, methodologies, software, text, graphics, user interfaces, workflows, documentation and other materials made available through or in connection with DoorTwo Offerings or other DoorTwo services, including all intellectual property rights in the foregoing. Except for the limited rights expressly granted in these Terms, no rights are granted by implication, waiver or otherwise.

6.2  Limited License. Subject to these Terms, any applicable Client Agreement and any requirements imposed by DoorTwo or an applicable assessment provider, DoorTwo grants you a limited, non-exclusive, non-transferable, non-sublicensable and revocable right to access and use DoorTwo Offerings and DoorTwo online content solely for authorized business, coaching, training, assessment, administrative or participation purposes.

6.3  Restrictions. You may not, and may not permit any other person to: (a) rent, lease, lend, sell, resell, sublicense, redistribute, make available as a service bureau or otherwise commercially exploit DoorTwo Offerings, DoorTwo online content, assessment materials, reports or other DoorTwo materials; (b) copy, reproduce, modify, adapt, translate, publish, publicly display, distribute, create derivative works from or prepare adaptations of DoorTwo Offerings, DoorTwo online content, assessment materials, reports or other DoorTwo materials, except as expressly permitted by DoorTwo in writing or by an applicable Client Agreement; (c) remove, obscure or alter any proprietary rights notices; (d) reverse engineer, decompile, disassemble or otherwise attempt to derive the source code, underlying structure, ideas or algorithms of a DoorTwo Offering, except to the extent such restriction is prohibited by applicable law; (e) access or use DoorTwo Offerings or DoorTwo materials to build or support a competing product or service; or (f) use DoorTwo Offerings or DoorTwo materials in any unauthorized, infringing, unlawful or prohibited manner.

6.4  Unauthorized Use. Any unauthorized use, reproduction, distribution, modification, adaptation, commercial exploitation or other misuse of DoorTwo Offerings, DoorTwo online content, assessment materials, reports or other DoorTwo materials may violate these Terms and applicable intellectual property or other laws. DoorTwo reserves all rights and remedies available at law, in equity and under any applicable Client Agreement.

6.5  Feedback. If you provide DoorTwo with comments, suggestions, ideas, enhancement requests, recommendations or other feedback regarding DoorTwo Offerings, DoorTwo online content, other DoorTwo services or related materials (“Feedback”), you grant DoorTwo a perpetual, irrevocable, worldwide, royalty-free, fully paid, transferable and sublicensable right to use, reproduce, modify, create derivative works from, distribute, display, perform and otherwise exploit that Feedback for any purpose, without restriction or compensation to you. DoorTwo is not required to treat Feedback as confidential unless DoorTwo has separately agreed in writing to do so.

7. SOCIAL MEDIA AND USER SUBMISSIONS

DoorTwo social media pages are intended to allow professional communication between DoorTwo and the public. DoorTwo may remove posts or comments that seek customer service involving private information, contain personal information, use offensive language, include unsupported or misleading claims, promote goods or services, constitute spam or otherwise affect the integrity of DoorTwo’s social media pages.

If you submit comments, feedback, email messages or other materials to DoorTwo, you are responsible for ensuring that the submission is lawful, accurate and does not include confidential, sensitive or third-party personal information unless you are authorized to provide it.

8. TERM, SUSPENSION AND TERMINATION

Your use of DoorTwo Offerings is governed by these Terms starting on the first date you create, accept or use your DoorTwo account. DoorTwo may suspend or terminate your access to any DoorTwo Offerings if DoorTwo determines that you have violated these Terms, an applicable Client Agreement or applicable law, or if suspension is reasonably needed to protect DoorTwo, Clients, Users, systems or data.

If your access to a DoorTwo Offering terminates or expires for any reason, you must stop using the DoorTwo Offering and applicable DoorTwo intellectual property except to the extent expressly permitted by DoorTwo in writing or by an applicable Client Agreement. Provisions that by their nature should survive termination will survive.

9. INDEMNIFICATION

To the fullest extent permitted by law, you agree to defend, indemnify and hold harmless DoorTwo, its officers, directors, employees, contractors, agents, licensors, successors and assigns from and against any claims, damages, losses, costs, expenses and liabilities, including reasonable attorneys’ fees and costs, arising out of or relating to: (1) your violation of these Terms; (2) your misuse of DoorTwo Offerings, assessment materials, reports, outputs or other DoorTwo materials; (3) your violation of applicable law or third-party rights; or (4) content, data, instructions or materials you submit, upload, transmit or otherwise provide through or in connection with DoorTwo Offerings or other DoorTwo services.

DoorTwo will provide you with reasonably prompt written notice of any claim for which DoorTwo seeks indemnification, provided that any failure to provide prompt notice will relieve you of your indemnification obligations only to the extent you are materially prejudiced. DoorTwo may, at its election, control the defense and settlement of the claim, and you will reasonably cooperate with DoorTwo in the defense. You may not settle any claim in a manner that imposes any admission of liability, non-monetary obligation or unreimbursed monetary obligation on DoorTwo without DoorTwo’s prior written consent. DoorTwo may participate in the defense with counsel of its choosing at its own expense.

10. LIMITATION OF LIABILITY

TO THE FULLEST EXTENT PERMITTED BY LAW, DOORTWO WILL NOT BE LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, COVER, EXEMPLARY OR PUNITIVE DAMAGES, INCLUDING DAMAGES FOR LOST PROFITS, LOST REVENUES, LOST DATA, BUSINESS INTERRUPTION, LOSS OF GOODWILL, COST OF SUBSTITUTE SERVICES OR OTHER SIMILAR LOSSES, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, INCLUDING CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY, STATUTE OR OTHERWISE, WHETHER OR NOT DOORTWO HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND EVEN IF ANY LIMITED REMEDY FAILS OF ITS ESSENTIAL PURPOSE.

TO THE FULLEST EXTENT PERMITTED BY LAW, DOORTWO’S AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS, DOORTWO OFFERINGS, ASSESSMENTS, REPORTS, CONTENT OR SERVICES WILL NOT EXCEED THE FEES PAID TO DOORTWO UNDER THE APPLICABLE CLIENT AGREEMENT FOR THE DOORTWO OFFERINGS OR OTHER DOORTWO PRODUCTS OR SERVICES GIVING RISE TO THE CLAIM DURING THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY. IF NO SUCH FEES WERE PAID, OR IF THE CLAIM DOES NOT ARISE UNDER A CLIENT AGREEMENT, DOORTWO’S AGGREGATE LIABILITY WILL NOT EXCEED ONE HUNDRED DOLLARS ($100).

11. DISCLAIMER OF WARRANTIES

DOORTWO OFFERINGS, ASSESSMENTS, REPORTS, OUTPUTS, CONTENT AND SERVICES ARE PROVIDED “AS IS” AND “AS AVAILABLE.” TO THE FULLEST EXTENT PERMITTED BY LAW, DOORTWO DISCLAIMS ALL WARRANTIES, EXPRESS, IMPLIED AND STATUTORY, INCLUDING WARRANTIES OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, AVAILABILITY AND ERROR-FREE OPERATION.

DOORTWO DOES NOT WARRANT THAT DOORTWO OFFERINGS, ASSESSMENTS, REPORTS, OUTPUTS, SCORES, PROFILES, RECOMMENDATIONS, CONTENT, THIRD-PARTY MATERIALS OR OTHER MATERIALS WILL BE ACCURATE, COMPLETE, TRUTHFUL, CURRENT, RELIABLE, ERROR-FREE OR FIT FOR ANY PARTICULAR PURPOSE. DOORTWO DOES NOT WARRANT THAT DOORTWO OFFERINGS OR RELATED SERVICES WILL BE UNINTERRUPTED, TIMELY, SECURE OR FREE FROM ERRORS, DEFECTS, VIRUSES OR OTHER HARMFUL COMPONENTS, OR THAT ANY ERRORS OR DEFECTS WILL BE CORRECTED. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF CERTAIN WARRANTIES OR DAMAGES, SO SOME OF THE ABOVE EXCLUSIONS AND LIMITATIONS MAY NOT APPLY TO YOU; IN THAT CASE, THEY APPLY TO THE FULLEST EXTENT PERMITTED BY LAW.

12. GENERAL

12.1  Third-Party Sites and Providers. DoorTwo Offerings may link to or interoperate with third-party websites, tools, assessment providers or services. DoorTwo does not control and is not responsible for third-party websites, tools, services, content, terms, policies or privacy practices. You are responsible for reviewing and complying with any applicable third-party terms, policies and agreements that govern your access to or use of third-party websites, tools, assessment providers or services.

12.2  Independent Contractors. These Terms do not create a partnership, franchise, joint venture, fiduciary, agency or employment relationship between DoorTwo and any User. Neither party has authority to bind the other party or to incur any obligation on the other party’s behalf without that party’s prior written consent.

12.3  Notices. Notices to DoorTwo must be sent to legal@doortwo.com or to the address listed in the Privacy Policy. Notices to you may be sent to the email address associated with your account, through the applicable DoorTwo Offerings or by other reasonable means. Notices are deemed delivered: (a) when delivered personally; (b) when sent by email or electronic delivery via DoorTwo Offerings, unless the sender receives an automated notice of delivery failure; (c) one (1) business day after deposit with a nationally recognized overnight courier; or (d) three (3) business days after deposit in the U.S. mail, postage prepaid, certified or registered mail, return receipt requested. Either party may update its notice address or contact information by giving notice in accordance with this Section.

12.4  No Waiver. No failure or delay by DoorTwo in exercising any right under these Terms constitutes a waiver of that right. A waiver is effective only if in writing and signed by DoorTwo. DoorTwo’s remedies are cumulative and not exclusive.

12.5  Severability. If any provision of these Terms is held invalid or unenforceable, that provision will be modified to the minimum extent necessary to make it enforceable or severed if modification is not permitted, and the remaining provisions will remain in effect.

12.6  Assignment. You may not assign, delegate or transfer these Terms or any rights or obligations under them without DoorTwo’s prior written consent, and any attempted assignment, delegation or transfer in violation of this Section is void. DoorTwo may assign, delegate or transfer these Terms or any rights or obligations under them, in whole or in part, without restriction, notice or consent. These Terms bind and inure to the benefit of the parties and their respective successors and permitted assigns.

12.7  Governing Law; Exclusive Venue. These Terms and disputes arising out of or relating to these Terms are governed by the internal laws of the State of California, without regard to conflict-of-laws rules, the United Nations Convention on the International Sale of Goods or the Uniform Computer Information Transactions Act, as enacted or as may be codified in any jurisdiction. Subject to any applicable Client Agreement, the state and federal courts located in Los Angeles County, California will have exclusive jurisdiction and venue over any dispute arising out of or relating to these Terms, DoorTwo Offerings or DoorTwo online content. Each party consents to personal jurisdiction in those courts and waives any objection based on improper venue, inconvenient forum or lack of personal jurisdiction.

12.8  Jury Trial Waiver. TO THE FULLEST EXTENT PERMITTED BY LAW, EACH PARTY KNOWINGLY AND VOLUNTARILY WAIVES ANY RIGHT TO A TRIAL BY JURY IN ANY ACTION, PROCEEDING, CLAIM OR COUNTERCLAIM ARISING OUT OF OR RELATING TO THESE TERMS, DOORTWO OFFERINGS OR DOORTWO ONLINE CONTENT.

12.9  Class Action Waiver. TO THE FULLEST EXTENT PERMITTED BY LAW, EACH PARTY AGREES THAT ANY CLAIM OR DISPUTE ARISING OUT OF OR RELATING TO THESE TERMS, DOORTWO OFFERINGS OR DOORTWO ONLINE CONTENT MUST BE BROUGHT ONLY IN THAT PARTY’S INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF, CLASS MEMBER OR REPRESENTATIVE IN ANY CLASS, COLLECTIVE, REPRESENTATIVE, PRIVATE ATTORNEY GENERAL OR CONSOLIDATED ACTION OR PROCEEDING.

12.10  Force Majeure. DoorTwo will not be liable for any delay, failure or interruption in performance, availability or access caused by events beyond DoorTwo’s reasonable control, including acts of God, natural disasters, acts of government, war, terrorism, civil unrest, labor disputes, power failures, Internet or telecommunications failures, third-party service outages, denial-of-service attacks or other malicious activity, equipment failures or other events outside DoorTwo’s reasonable control.

12.11  No Third-Party Beneficiaries. Except as expressly stated in these Terms, there are no third-party beneficiaries to these Terms.

12.12  Changes. DoorTwo may modify these Terms from time to time. Material changes will be communicated through the applicable DoorTwo Offerings, email or other reasonable means. Your continued use of DoorTwo Offerings, DoorTwo online content or DoorTwo social media pages after the effective date of a modification constitutes acceptance of the modified Terms, to the extent permitted by applicable law. DoorTwo may also require you to accept modified Terms at your next login.

12.13  Entire Agreement. These Terms, together with any terms expressly incorporated by reference, constitute the entire agreement between DoorTwo and you regarding your individual use of DoorTwo Offerings, DoorTwo online content and DoorTwo social media pages and supersede prior terms regarding that subject matter, including the prior Lyra Terms of Use effective January 1, 2021. Any applicable Client Agreement remains in effect according to its terms.

12.14  Interpretation. Section headings are for convenience only and do not affect interpretation. The words “including,” “includes” and similar terms are deemed to be followed by “without limitation.”

The DoorTwo AI Use Policy lists Leadership Circle as a fourth third-party assessment platform.  Are Leadership Circle assessments administered through Lyra or DoorTwo services?  If yes, add “Leadership Circle” to the provider list here (after “Change Cycle”).  If it’s only used outside Lyra, leave the draft as it is.