1. Scope and how this agreement applies
This Data Processing Agreement (the “DPA”) forms part of the agreement between Edusodes (“Edusodes”) and the business customer that uses Edusodes for its personnel (the “Customer”), whether that agreement is our Terms of Service or a signed order form for a Teams plan (the “Agreement”).
It applies whenever Edusodes processes Customer Personal Data on the Customer’s behalf in providing the Service. It takes effect automatically when the Customer accepts the Agreement. A countersigned copy is available on request from legal@edusodes.com.
This DPA does not apply to personal data that Edusodes processes as an independent controller, such as data about individual learners who sign up on their own behalf, account administration and billing. That processing is described in our Privacy Policy.
2. Definitions
In this DPA:
- “Data Protection Laws” means all laws that apply to the processing of Customer Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the GDPR as retained in UK law (“UK GDPR”) and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended (“CCPA”).
- “Customer Personal Data” means personal data that Edusodes processes on behalf of the Customer in providing the Service, as described in Annex I.
- “Subprocessor” means a third party engaged by Edusodes to process Customer Personal Data.
- “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
- “Standard Contractual Clauses” means the clauses adopted by European Commission Implementing Decision (EU) 2021/914.
Terms such as “controller”, “processor”, “data subject”, “personal data” and “processing” have the meanings given in the GDPR. Capitalized terms not defined here have the meanings given in the Agreement.
3. Roles of the parties
The Customer is the controller of Customer Personal Data, and Edusodes is its processor. Where the Customer is itself a processor acting for a third-party controller, Edusodes is a subprocessor and the Customer warrants that its instructions are authorized by that controller.
The Customer is responsible for the lawfulness of the Customer Personal Data it provides, for having a lawful basis for the processing, and for giving any notices to data subjects that Data Protection Laws require.
4. Processing on documented instructions
Edusodes will process Customer Personal Data only on the Customer’s documented instructions. The Agreement, this DPA and the Customer’s use and configuration of the Service are the Customer’s complete instructions. Further instructions must be in writing and consistent with the Agreement.
Edusodes will tell the Customer promptly if, in its opinion, an instruction infringes Data Protection Laws, and may suspend that processing until the instruction is confirmed or changed. Edusodes may also process Customer Personal Data where required by law, in which case it will inform the Customer first unless the law prohibits it.
Edusodes will not use Customer Personal Data to train AI models, for advertising, or for any purpose other than providing, securing and supporting the Service.
5. Confidentiality
Edusodes will ensure that every person it authorizes to process Customer Personal Data is bound by an appropriate obligation of confidentiality and has access only to the extent needed to perform their role.
6. Security
Edusodes will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as described in Annex II. Edusodes may update these measures provided the overall level of security is not reduced.
7. Subprocessors
The Customer gives Edusodes general authorization to engage Subprocessors. The Subprocessors in use on the effective date are listed in Annex III and in our Trust Center.
Edusodes will give the Customer at least 30 days’ notice before engaging a new Subprocessor, by updating the Trust Center and emailing the Customer’s account contact. The Customer may object on reasonable data protection grounds within that period. The parties will then discuss the objection in good faith. If it cannot be resolved, the Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the remaining term.
Edusodes will impose data protection obligations on each Subprocessor that are no less protective than this DPA, and remains liable to the Customer for each Subprocessor’s performance of those obligations.
8. Data subject requests and assistance
Taking into account the nature of the processing, Edusodes will assist the Customer, by appropriate technical and organizational measures, in responding to requests from data subjects to exercise their rights. If Edusodes receives such a request directly, it will refer the data subject to the Customer and will not respond itself, except to confirm the referral, unless the Customer authorizes it.
Edusodes will also provide reasonable assistance with the Customer’s data protection impact assessments and prior consultations with supervisory authorities, to the extent the Customer cannot reasonably meet these obligations using information already available to it.
9. Security incidents
Edusodes will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe, to the extent then known:
- the nature of the incident, including the categories and approximate number of data subjects and records affected;
- the likely consequences;
- the measures taken or proposed to address the incident and mitigate its effects;
- a contact point for further information.
Edusodes will update the Customer as more information becomes available and will take reasonable steps to contain and remediate the incident. Notification is not an acknowledgement of fault or liability.
10. Return and deletion
When the Agreement ends, Edusodes will delete Customer Personal Data within 30 days, unless the Customer asks in writing before then for a copy in a commonly used, machine-readable format. Copies held in backups are overwritten on a rolling basis within a further 35 days. Edusodes may keep Customer Personal Data where retention is required by law, in which case this DPA continues to apply to it and it will be processed only for that purpose.
11. Information and audits
Edusodes will make available to the Customer the information reasonably necessary to demonstrate compliance with Article 28 of the GDPR, including written responses to reasonable security questionnaires.
Where that information is not sufficient, or a supervisory authority requires it, the Customer may conduct an audit, including an inspection, no more than once in any 12-month period. Audits require at least 30 days’ written notice, must take place during business hours, must avoid disrupting the Service and other customers, and are subject to confidentiality obligations. The Customer bears its own costs. Auditors must not be competitors of Edusodes.
12. International transfers
Edusodes and its Subprocessors may process Customer Personal Data outside the European Economic Area, the United Kingdom and Switzerland, including in the United States. Where a transfer is not covered by an adequacy decision or another valid mechanism, such as the EU-U.S. Data Privacy Framework, the parties agree that:
- for transfers subject to the GDPR, the Standard Contractual Clauses are incorporated into this DPA, using Module Two (controller to processor) and, where the Customer is a processor, Module Three (processor to processor). Clause 7 (docking clause) applies; Clause 9 option 2 applies with the notice period in section 7 of this DPA; the option in Clause 11 does not apply; Clauses 17 and 18 select the law and courts of Ireland; and Annexes I, II and III of this DPA complete the corresponding annexes;
- for transfers subject to the UK GDPR, the International Data Transfer Addendum issued by the UK Information Commissioner applies, completed with the information in this DPA;
- for transfers subject to Swiss law, the Standard Contractual Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection and the competent authority being the Swiss Federal Data Protection and Information Commissioner.
If there is a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses prevail.
13. CCPA service provider terms
To the extent the CCPA applies, Edusodes acts as the Customer’s service provider and will not:
- sell or share Customer Personal Data, as those terms are defined in the CCPA;
- retain, use or disclose Customer Personal Data for any purpose other than the business purposes set out in the Agreement;
- retain, use or disclose Customer Personal Data outside the direct business relationship with the Customer;
- combine Customer Personal Data with personal information it receives from other sources, except as the CCPA permits.
Edusodes will comply with the CCPA’s applicable obligations, provide the same level of privacy protection the CCPA requires of businesses, and notify the Customer if it can no longer meet these obligations. The Customer may take reasonable steps to stop and remediate unauthorized use of Customer Personal Data.
14. Liability, term and precedence
Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where Data Protection Laws or the Standard Contractual Clauses do not permit such limitation.
This DPA remains in force for as long as Edusodes processes Customer Personal Data. If this DPA conflicts with the Agreement, this DPA prevails in relation to the processing of Customer Personal Data. This DPA is governed by the law that governs the Agreement, which is the laws of the jurisdiction in which Edusodes is established unless the Agreement provides otherwise, except where the Standard Contractual Clauses require a different law.
Edusodes may update this DPA to reflect changes in Data Protection Laws or the Service, provided the update does not materially reduce the protection of Customer Personal Data. The version in effect is the one published here.
15. Annex I: Details of processing
| Data exporter | The Customer, as identified in the Agreement. Role: controller (or processor, for Module Three). |
|---|---|
| Data importer | Edusodes. Contact: legal@edusodes.com. Role: processor. |
| Categories of data subjects | The Customer’s employees, contractors and other personnel whom the Customer invites to use the Service. |
| Categories of personal data | Name and work email address; learning activity, including series assigned and enrolled, episodes completed and when, quiz answers and scores, review and assessment results, and streaks; topics and goals entered when creating series; the content of any documents the Customer provides to produce seasons; technical data such as IP address, browser type and request logs. |
| Special categories of data | None intended. The Customer must not submit special categories of personal data in topics, goals or documents. |
| Frequency of transfer | Continuous, for the duration of the Agreement. |
| Nature and purpose of processing | Hosting, storage and processing necessary to provide the Service: producing learning content, delivering episodes, grading quizzes, scheduling reviews, reporting progress to the Customer, providing support, and keeping the Service secure. |
| Duration and retention | For the term of the Agreement, then deleted as described in section 10. |
| Competent supervisory authority | The supervisory authority of the EU member state where the Customer is established or, where the Customer is not established in the EU, the authority of the member state where its EU representative is appointed. |
16. Annex II: Technical and organizational measures
Access control and authentication
- Passwords are stored only as salted bcrypt hashes and are never logged.
- Sessions use cryptographically signed, HTTP-only, same-site cookies that page scripts cannot read.
- Every page, server action and API request re-verifies the session and checks authorization on the server.
- Personnel access to production systems is limited to those who need it, and is removed when no longer required.
Encryption
- All traffic between users and the Service is encrypted in transit using TLS.
- Production data and backups are stored with hosting providers that encrypt data at rest.
Data minimization
- Requests to the AI provider contain learning topics, goals and content only, never names, emails or payment details.
- Payment card details are collected and held by Stripe; Edusodes never receives full card numbers.
- One essential cookie is used; there are no advertising or analytics trackers.
Integrity and availability
- Quiz answer keys stay on the server until submission, and grading happens server-side.
- Production data is backed up regularly, and backups are overwritten on a rolling basis.
- Server and security logs are kept for up to 90 days to investigate abuse and incidents.
Incident response and assurance
- Security incidents are handled under section 9, including notification within 72 hours.
- Vulnerability reports are accepted at security@edusodes.com.
- Edusodes does not currently hold SOC 2 or ISO 27001 certification. The current status is published in the Trust Center.
17. Annex III: Subprocessors
| Subprocessor | Purpose | Personal data | Location |
|---|---|---|---|
| Anthropic | AI models that write season outlines and episodes | Topics, goals and produced content. No names, emails or payment details. | United States |
| Stripe | Payments, subscriptions and fraud prevention | Name, email, billing details | United States |
| Hosting and infrastructure providers | Running the application, database and backups | All service data, stored on our behalf | United States |
| Email provider | Sending and receiving service and support email | Name, email, message content | United States |