Data Processing Agreement

1. Scope

This Data Processing Agreement ("DPA") applies where «TO CONFIRM: registered company name, GEMI number, VAT number and registered address» ("Didache", "we", the "Processor") processes personal data on behalf of the customer organization (the "Customer", the "Controller") in providing the Service.

It forms part of, and is incorporated into, the terms of service between the parties. It is accepted when the Customer accepts those terms or signs an order form referring to them. «TO CONFIRM: whether a countersigned copy is offered to customers who require one»

Terms defined in the GDPR — controller, processor, personal data, processing, personal data breach, sub-processor, supervisory authority — carry the same meaning here.

2. Roles of the parties

For personal data relating to the Customer's Authorized Users and their use of the Service, the Customer is the controller and Didache is the processor.

The Customer determines the purposes and means of the processing. It is responsible for the lawfulness of the personal data it and its Authorized Users provide, for having a lawful basis, and for meeting its own transparency obligations towards its people.

Where Didache processes personal data as a controller in its own right — for example account administration and enquiries — that processing is governed by our privacy policy and not by this DPA.

3. Processing on documented instructions

Didache processes personal data only on the Customer's documented instructions, including in relation to transfers to a third country, unless required to do otherwise by law — in which case we will inform the Customer before processing, unless the law prohibits it on important grounds of public interest.

The terms of service, this DPA including its annexes, and the Customer's use of the features of the Service constitute the Customer's complete documented instructions.

If we consider an instruction infringes data protection law, we will inform the Customer without undue delay and may suspend performance of that instruction until it is confirmed or withdrawn.

We will not sell personal data, and we will not use it for our own purposes, including to develop, train or improve any artificial intelligence model.

4. Confidentiality of personnel

Didache ensures that persons authorised to process personal data are bound by an appropriate obligation of confidentiality, whether contractual or statutory, and are granted access only to the extent needed to perform their duties.

Access to production systems holding personal data is limited to personnel who require it. «TO CONFIRM: who holds such access and the controls applied»

5. Security of processing

Taking account of the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risks to individuals, Didache implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

The measures in force are described in Annex II. We may update them provided the level of security is not reduced.

6. Sub-processors

The Customer gives a general written authorisation for Didache to engage sub-processors. Those engaged at the date of this DPA are listed in Annex III and are authorised on acceptance.

We will give the Customer at least 30 days' notice before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service without penalty, with a pro-rata refund of prepaid fees for the unused period.

Each sub-processor is engaged under a written contract imposing data protection obligations no less protective than those in this DPA. Didache remains fully liable to the Customer for the performance of each sub-processor's obligations.

7. International transfers

Where personal data is transferred outside the European Economic Area, Didache ensures an appropriate transfer mechanism is in place before the transfer takes place.

Our AI provider processes data in the United States. «TO CONFIRM: the transfer mechanism relied on — Standard Contractual Clauses and/or the EU–US Data Privacy Framework — and confirmation of the module and version, once the contractual position is verified»

As a supplementary measure, Didache does not transmit the name, email address or user identifier of any Authorized User to the AI provider. Only the exercise content, the rubric and the generated response are sent.

«TO CONFIRM: whether the EU Standard Contractual Clauses are to be appended to this DPA as a schedule and, if so, which modules and annex content»

8. Assistance with data subject rights

Taking into account the nature of the processing, Didache assists the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling its obligation to respond to requests to exercise rights under Chapter III of the GDPR.

If a data subject contacts Didache directly about personal data processed for the Customer, we will not respond substantively. We will forward the request to the Customer without undue delay and assist the Customer in responding.

Administrators of the Customer can access, correct and remove the personal data of their Authorized Users through the Service. Where a request cannot be met through the Service, we will assist on the Customer's written instruction. «TO CONFIRM: whether self-service export and deletion tooling will be provided, and by when — this obligation is currently met by manual assistance»

9. Assistance with security, notification and assessments

Taking into account the nature of the processing and the information available to us, Didache assists the Customer in complying with its obligations under Articles 32 to 36 of the GDPR: security of processing, notification of personal data breaches to the supervisory authority and to data subjects, data protection impact assessments, and prior consultation.

Assistance beyond the provision of information we already hold may be charged at our then-current professional rates, unless the assistance is required because of our breach of this DPA.

10. Personal data breach

Didache notifies the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting personal data processed on the Customer's behalf.

The notification will describe, to the extent known at the time: the nature of the breach and the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address it; and a contact point for further information. Where the full picture is not available at once, we will provide information in phases without further undue delay.

Didache does not notify supervisory authorities or data subjects on the Customer's behalf unless legally required or specifically instructed in writing; that assessment and any notification remain the Customer's responsibility as controller.

11. Information and audits

Didache makes available to the Customer the information necessary to demonstrate compliance with Article 28 of the GDPR, including by responding to reasonable written security questionnaires and providing available documentation about the measures in Annex II.

Where that information is not sufficient, the Customer may audit Didache, or appoint an independent auditor bound by confidentiality to do so, no more than once in any twelve-month period, on at least 30 days' written notice, during business hours, and in a manner that does not disrupt the Service or compromise the confidentiality of other customers' data. More frequent audits may take place where required by a supervisory authority or following a confirmed personal data breach.

Each party bears its own costs, and the Customer bears the cost of any third-party auditor it appoints.

12. Return and deletion

On termination or expiry of the Service, Didache will, at the Customer's choice, return the personal data processed on its behalf in a commonly used machine-readable format, or delete it, within «TO CONFIRM: number» days of the end of the agreement.

The Customer may make that choice at any time before the end of that period. If the Customer gives no instruction, we will delete the personal data at the end of the period.

We may retain personal data to the extent required by law, in which case we will keep it only for as long as the law requires and continue to protect it under this DPA.

Copies held in routine backups are deleted in the ordinary course of the backup cycle. «TO CONFIRM: the backup retention cycle, once confirmed»

13. The Customer's obligations

The Customer warrants that it has a lawful basis for the processing it instructs, and that it has given its Authorized Users the information required by Articles 13 and 14 of the GDPR — including, where the Customer uses the reporting features, that their activity and results are visible to their managers.

The Customer will not instruct processing of special categories of personal data under Article 9, nor data relating to criminal convictions, and will instruct its Authorized Users not to enter such data into free-text fields such as prompts, submissions and attachments. The Service is not designed to safeguard such data.

The Customer is responsible for the accuracy of the personal data it provides and for keeping its list of Authorized Users current.

14. Liability

The limitations and exclusions of liability in the terms of service apply to this DPA and to any claim arising from it, except where data protection law prevents them from applying.

Nothing in this DPA limits either party's liability towards a data subject under Article 82 of the GDPR.

15. Precedence

In the event of a conflict, this DPA prevails over the terms of service in relation to the processing of personal data. Where Standard Contractual Clauses are agreed between the parties, those clauses prevail over this DPA in relation to transfers they govern.

16. Governing law

This DPA is governed by the law stated in the terms of service, without prejudice to mandatory provisions of data protection law. «TO CONFIRM: confirm alignment with the governing law chosen in the terms of service»

Annex I — Details of the processing

Subject matter: provision of the Didache learning platform to the Customer.

Duration: the term of the agreement, plus the return or deletion period in section 12.

Nature and purpose: hosting and operating a workplace learning platform, including delivering learning content, generating and automatically scoring exercise submissions, scheduling practice, recording progress and producing reports for the Customer's administrators and managers.

Categories of data subjects: the Customer's employees and contractors who are given accounts as learners, managers or reviewers, and the Customer's administrators.

Categories of personal data: identity and contact data (name, email address, profile picture, language, time zone); authentication identifiers; content authored by Authorized Users (prompts, submissions, attachments and saved prompt library entries), which is free text and may contain whatever the author enters; assessment data (generated responses, scores per rubric criterion, quiz answers); activity and progress data (lesson progress, experience points, badges, streaks, practice scheduling, notifications); and organizational records (membership, roles, and audit records of significant changes).

Special categories of personal data: none. The Customer must not instruct processing of special category data, and Annex II describes no measures specific to it.

Frequency of processing: continuous, for the duration of the agreement.

Annex II — Technical and organisational measures

Access control and tenant isolation: every database table is protected by row-level security enforced by the database itself rather than by application code, so one organization's data is not reachable from another even if the application requested it. Access within an organization is governed by roles, and participation in learning activity requires the relevant role rather than mere membership.

Authentication: passwords must be at least 12 characters; access tokens expire after one hour; refresh tokens are rotated. Public self-registration is disabled — accounts exist only by invitation from the Customer. In production, session tokens are held in memory and are not written to browser storage.

Storage: profile images are held in a private storage bucket with enforced file type and size limits, not at a public address. Attachments are subject to size and length limits enforced by the Service.

Data minimisation towards our AI sub-processor: identity attributes are not transmitted; only exercise content, rubric and generated output are sent.

Encryption: personal data is encrypted in transit using TLS. «TO CONFIRM: encryption at rest as provided by each hosting provider, to be stated once confirmed»

Environment separation: staging and production run as separate projects with separate credentials.

Accountability: significant changes are recorded in an audit log identifying the actor, the entity affected and the change made.

Secure development: changes pass automated type checking, linting, an authentication-boundary check and an automated test suite before release; dependencies are scanned for known vulnerabilities on a scheduled basis.

Availability: «TO CONFIRM: backup schedule, retention and the date restoration was last tested — backups are configured but restoration has not yet been exercised against production, and this measure must not be stated until it has been»

Monitoring: «TO CONFIRM: error monitoring and alerting are not yet deployed. This annex must describe the arrangements actually in place before this DPA is offered to a customer, since breach detection under section 10 depends on them»

Annex III — Authorised sub-processors

The following sub-processors are authorised at the date of this DPA. «TO CONFIRM: the exact processing region for Railway and Sentry, and the name of the email provider»