Data Processing Agreement (DPA)

The Processor processes personal data on behalf of the Controller solely to provide e-learning platform services (hosting of accounts, courses, learning progress, certificates, communication). The processing includes: identification data (first name, last name, e-mail address, username), training activity data (progress, quiz results, certificates), technical data (logs, IP addresses) and data necessary for payment processing (passed to the payment operator).

Processing lasts for the duration of the licence agreement and, after its termination, until the data is deleted or returned in accordance with section 8, unless the law requires longer retention.

The Processor processes data solely on the documented instructions of the Controller, unless processing is required by EU or Member State law. Persons authorised to process the data have committed themselves to confidentiality.

The Processor implements appropriate technical and organisational measures to ensure the security of the data, including: transmission encryption (SSL/TLS), access control, regular backups, security monitoring and incident response procedures.

The Processor may use sub-processors (including the hosting provider, the payment operator Stripe, e-mail providers), informing the Controller thereof. The use of sub-processors is based on a contract imposing obligations consistent with this DPA. The current list of sub-processors is available upon the Controller's request.

The Processor assists the Controller in fulfilling data subjects' rights (access, rectification, erasure, restriction, portability, objection), including by providing the relevant platform features and cooperating in the handling of requests.

The Processor notifies the Controller of a personal data breach without undue delay after becoming aware of it and assists the Controller in complying with the obligation to notify the supervisory authority and the data subjects.

After the provision of services ends, the Processor deletes or returns to the Controller all personal data and deletes copies thereof, unless the law requires their retention. The Controller has the right to audit/verify the processing in justified cases.