Data Processing Agreement

1. Parties

This Data Processing Agreement ("DPA") is entered into between:

• Data Controller ("Customer"): the organisation or individual subscribing to CourseFoundry services.
• Data Processor ("CourseFoundry"): CourseFoundry, operated by John Jennings, Ireland. Contact: privacy@coursefoundry.com.

2. Subject Matter & Duration

CourseFoundry processes personal data on behalf of the Customer solely to provide the CourseFoundry platform services described in the applicable subscription agreement. Processing continues for the duration of the subscription and ceases upon account deletion. Deletion takes effect immediately in the live system; the specific records that are kept afterwards, and in what form, are set out in Section 11.

3. Nature & Purpose of Processing

• Storing and serving course content created by the Customer.
• Authenticating users and managing access to Customer content.
• Processing prompts and content via AI APIs to provide AI-assisted authoring features. Which AI providers are used, when each is used, and what each receives are listed on our Trust page.
• Sending transactional emails (account notifications, invitations).
• Processing subscription payments via Stripe.

4. Categories of Personal Data

• Identity data: name, email address, username.
• Account data: plan, usage history, progression data (XP, badges).
• Content data: course files and materials uploaded or created by the Customer.
• Technical data: IP addresses, user-agent strings, access logs.
• Payment data: handled exclusively by Stripe; CourseFoundry does not store card details.

5. Data Subject Categories

Customers' employees, contractors, and students who access CourseFoundry under the Customer's subscription.

6. Obligations of CourseFoundry

• Process personal data only on documented instructions from the Customer.
• Ensure personnel authorised to process data are bound by confidentiality.
• Implement appropriate technical and organisational security measures (Article 32 GDPR).
• Assist the Customer in responding to data subject rights requests.
• Notify the Customer within 48 hours of becoming aware of a personal data breach.
• Delete or return all personal data upon termination of the agreement.
• Provide all information necessary to demonstrate compliance with this DPA.

7. Sub-processors

CourseFoundry uses the sub-processors listed on our Trust page, which is the current list. The Customer provides general authorisation for these sub-processors. CourseFoundry will give Customers who have signed this DPA 30 days' prior written notice of any new sub-processor, and the Customer may object in writing within that period. Every addition, removal or correction to the list, including corrections to how an existing sub-processor is described, is recorded in the change history beneath it.

8. International Data Transfers & Data Residency

Data location: Customer Personal Data, including course content, lesson files, workspace metadata, and user authentication data (email addresses, JWT sessions), is stored in the United States and is subject to the transfer mechanisms below. The database, file storage, authentication and application are hosted in the United States (Supabase US-East and Vercel US regions), and so is rendered course output. AI processing takes place in the regions of the selected AI provider. EU data residency is not currently available. EU data residency is planned for Enterprise Customers; Customers who require it may contact enterprise@coursefoundry.com.

Where personal data is transferred outside the EEA or UK to a sub-processor CourseFoundry contracts with (including authentication data and AI processing), CourseFoundry ensures an appropriate transfer mechanism is in place:

• EU Standard Contractual Clauses (Commission Decision 2021/914/EU) for EU personal data transferred to the USA.
• UK International Data Transfer Agreement (IDTA) for UK personal data.
• EU-US Data Privacy Framework self-certification (in progress).

Some services listed on the Trust page are loaded directly by the browser of a visitor, author or learner, such as bot protection, web fonts, content delivery networks for scripts and course runtimes, and videos an author chooses to embed. These services operate under their providers' standard terms; CourseFoundry has no separate signed data processing agreement with them.

Customers who require a transfer impact assessment (TIA) or supplementary measures documentation may request these from enterprise@coursefoundry.com.

9. Security Measures

CourseFoundry implements and maintains the technical and organisational measures described on our Trust page, including TLS encryption in transit, AES-256 encryption at rest, row-level security, access controls, and annual penetration testing.

10. Audit Rights

CourseFoundry will provide, on reasonable notice, information necessary to demonstrate compliance with this DPA, including making available relevant audit reports (SOC 2, pen test executive summary) under NDA. On-site audits may be agreed on a case-by-case basis at the Customer's cost.

11. Data Subject Rights

Customers can export all personal data at any time via Settings → Export My Data (GDPR Article 20). Account deletion (Article 17) is self-service in Settings and takes effect immediately in the live system: the account and the records that belong to it are removed at once. Some records survive in a stated form: security and activity audit events are kept with the link to the account removed, but can still contain the user's email address, IP address and browser details; programme change-log entries are kept with the author link removed; beta feedback text is kept with the email address and username removed; images held for deferred AI processing and rendered course output are not removed from storage; and database backups may still hold deleted data for up to 7 days. The full list is on our Trust page. CourseFoundry will assist Customers in fulfilling data subject access, rectification, and erasure requests within statutory timeframes.

12. Contact

To request a countersigned DPA, EU SCCs, or UK IDTA addendum, contact enterprise@coursefoundry.com. For privacy queries: privacy@coursefoundry.com.