Data Processing Addendum (DPA)

1. Scope, Subject Matter and Duration

This Data Processing Addendum ("DPA") supplements the Master Subscription Agreement between Personal Academy and Customer. The subject matter comprises the processing of personal data solely to provide, support, and secure the LMS service for the duration of the subscription agreement.

2. Mandatory GDPR Article 28 Commitments

Personal Academy covenants and agrees to the following statutory requirements:

1. Documented Instructions: Process personal data only on documented instructions from Customer (including transfers to third countries unless required by applicable law).
2. Confidentiality: Ensure that persons authorized to process the personal data have committed themselves to strict confidentiality.
3. Security Measures: Implement appropriate technical and organizational measures pursuant to Article 32 (including TLS, AES-256 encryption, and PostgreSQL RLS organisation boundaries).
4. Sub-Processors: Adhere to Article 28(2) requirements, providing 30 days prior notice before engaging new sub-processors and imposing equivalent data protection obligations.
5. Data Subject Rights Assistance: Assist Customer through appropriate technical measures to fulfill obligations to respond to DSR requests (access, rectification, erasure).
6. Security & Breach Assistance: Assist Customer in ensuring compliance with Articles 32–36 (security of processing, notification of personal data breaches without undue delay and within 72 hours).
7. Deletion or Return: At the choice of Customer, delete or return all personal data upon completion of services, and delete existing copies unless European or statutory law requires storage.
8. Audits & Inspections: Make available to Customer all information necessary to demonstrate compliance with Article 28, and contribute to reasonable audits conducted by Customer or an independent auditor.

3. Standard Contractual Clauses (SCCs Annex)

For transfers of personal data outside the European Economic Area (EEA) to jurisdictions without an adequacy decision, the European Commission Standard Contractual Clauses (Module 2: Controller-to-Processor) are incorporated herein by reference.

4. Authorised Sub-Processors

Customer authorises the sub-processors listed on our sub-processor register, which states what each one processes, where, and why. Some are engaged only when a feature is switched on or when Customer connects its own account. The register currently lists:

• Supabase
• Vercel
• OpenRouter
• Anthropic
• OpenAI
• Google Gemini
• ElevenLabs
• Resend (or the organisation’s own SMTP provider)
• Google Workspace
• Sentry (only when error monitoring is switched on)
• Razorpay
• Stripe (only where an organisation connects its own account)
• Browser push services (Google, Apple, Mozilla, Microsoft)
• Google Analytics / Tag Manager
• Meta Platforms (Pixel)
• Google Ads (conversion tag)
• LinkedIn (Insight Tag)
• Postmark and SendGrid (only where selected as the email provider)
• Pexels
• Integrations an organisation connects itself (Slack, Microsoft Teams and 365, Google Calendar and YouTube, Salesforce, HubSpot, LinkedIn Learning, Canva)
• Learning Record Store an organisation names (xAPI forwarding and import)
• Microsoft Teams bot connector (chat-native learning)
• Content-library providers an organisation connects itself (Percipio, Udemy Business, Go1, edX, Microsoft Learn)
• Google (Gmail and Google Drive connectors)
• Microsoft (Outlook and SharePoint connectors)
• Zendesk (support-ticket connector)
• Freshworks (Freshdesk support-ticket connector)
• ServiceNow (incident connector)
• Atlassian (Jira and Confluence connectors)
• GitHub (code connector)
• Notion (knowledge connector)
• HubSpot (CRM connector)
• Salesforce (CRM connector)
• Zoho (Zoho CRM connector)
• Meta (WhatsApp Business Platform; only where the WhatsApp and SMS add-on is enabled)
• Twilio (WhatsApp and SMS; only where the WhatsApp and SMS add-on is enabled)
• MSG91 (SMS; only where the WhatsApp and SMS add-on is enabled)

Support: our team uses Anthropic (Claude) to triage support requests and draft replies, Google Workspace for the support and contact mailboxes and for sending email, and Sentry, when error monitoring is switched on, to find and fix faults.