Data Processing Addendum

1. Roles

For Customer Personal Data — personal data the customer, its users or its learners provide to the service, or that the service generates about them on the customer’s behalf — the customer is the controller and Coursentials is the processor. Where the customer is itself a processor for another organisation, we act as its sub-processor. Data we handle as a controller (such as account and billing data) is covered by our Privacy Policy, not this DPA.

2. Details of the processing

Subject matter and purpose: providing the service — authoring, publishing and delivering courses, labs and practice conversations; recording and reporting learner results; and the AI features the customer chooses to use.
Duration: the term of the agreement, plus the deletion period in section 9.
Nature: collection, storage, structuring, analysis, transmission to connected systems, retrieval and deletion.
Data subjects: the customer’s learners, authors, reviewers and administrators, and any individuals appearing in content the customer uploads.
Categories of data: identifiers received from the customer’s LMS or launch link (such as learner ID, name and email via LTI, SCORM, xAPI or cmi5); progress, completion, scores and answers; written responses; voice recordings and transcripts of spoken answers and measurements derived from them; conversation transcripts; reviewer notes; and any personal data contained in uploaded content.
Special categories: none are required by the service. The customer should not upload them unless it has a lawful basis and appropriate safeguards.

3. Our obligations

We will:

Process Customer Personal Data only on the customer’s documented instructions — the agreement, this DPA and the customer’s configuration of the service — unless the law requires otherwise, in which case we will tell the customer first where allowed.
Tell the customer if we believe an instruction breaks data-protection law.
Ensure everyone authorised to process the data is bound by confidentiality.
Not sell the data, not use it for our own purposes beyond providing and securing the service, and not use it to train AI models.
Maintain the security measures in section 10.

4. Sub-processors

The customer authorises us to use sub-processors in these categories: cloud hosting and databases; file storage and content delivery; AI model providers (text, image, speech synthesis, speech recognition and video); email delivery; and error monitoring. We impose data-protection terms on each that are at least as protective as this DPA, and we remain responsible for their performance. A current list is available on request. We will give at least 30 days’ notice before adding or replacing a sub-processor; the customer may object on reasonable data-protection grounds, and if we cannot address the objection, the customer may terminate the affected service and receive a pro-rata refund of prepaid fees.

5. International transfers

Where Customer Personal Data is transferred out of the EEA, the UK or Switzerland to a country without an adequacy decision, the parties agree to the European Commission’s Standard Contractual Clauses (Module 2, controller to processor, or Module 3, processor to processor, as applicable) and the UK International Data Transfer Addendum, which are incorporated by reference. We put equivalent safeguards in place with our sub-processors.

6. Data subject requests

Taking into account the nature of the processing, we will help the customer respond to requests from data subjects to exercise their rights. If we receive a request directly about Customer Personal Data, we will pass it to the customer without undue delay and will not respond ourselves except to redirect the person.

7. Assistance

We will give reasonable help with the customer’s data-protection impact assessments and consultations with supervisory authorities, to the extent they relate to our processing.

8. Personal data breaches

We will notify the customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We will provide the information the customer reasonably needs to meet its own obligations, and take reasonable steps to contain and remedy the breach.

9. Return and deletion

During the term the customer can export or delete its content and learner results through the service or by request. When the agreement ends, we will delete Customer Personal Data within 30 days (after which it ages out of backups within 35 days), unless the law requires us to keep it.

10. Security measures

Encryption of data in transit, and hosting and storage providers that encrypt data at rest.
Stored credentials and integration secrets encrypted with a key held outside the database.
Logical separation of each customer’s data by workspace, enforced on every request.
Signed, time-limited launch links and signed requests between integrated systems.
Role-based access for customer users; staff access limited to what is needed and logged.
Version history and backups to recover from accidental loss.
Monitoring and error reporting to detect and respond to incidents.
Screening of user-typed text sent to AI models, which is handled as content and never as instructions.

11. Audits

On reasonable written request, no more than once a year, we will provide information necessary to demonstrate compliance with this DPA, such as answers to a security questionnaire. Where that is not sufficient, or a supervisory authority requires it, the customer may conduct an audit on reasonable notice, at its own cost, during business hours, and subject to confidentiality.

12. Order of precedence

If this DPA conflicts with the Terms of Service, this DPA prevails for the processing of Customer Personal Data. If it conflicts with the Standard Contractual Clauses, the Clauses prevail.