Data Processing Agreement

You are the controller. We are the processor for the personal data that reaches us because of how you use the product: the material you upload, the course plans drafted from it, and support correspondence in which you describe a person.

We are an independent controller for your account itself: the registration details, the subscription, the licence keys, the billing record, and the security logs about use of the product. Those are described in the privacy policy rather than here.

Nature: storage, transmission, automated analysis and text generation, and deletion, in IT systems.

Purpose: producing the course plan and the course activities you ask for, and supporting you while you do it. Nothing else. We do not profile learners, sell data, or use it for advertising.

Duration: for as long as your subscription lasts, plus the retention periods in the privacy policy, unless law requires longer.

The product does not need a class list, and asking it for one is not part of any workflow. In practice the personal data we process on your behalf is whatever happens to sit inside the teaching material you upload.

Data subjects may therefore include your staff who use the product, and any person named or depicted in the material you upload. Categories may include names, contact details, images, and free text in documents, slides or PDFs.

Special categories of data under Article 9 are not required by the product, and you should not upload them. If your material contains them, you remain responsible for the lawful basis.

We process personal data only on your documented instructions: this agreement, the terms, your configuration of the product, and written instructions through support. If we believe an instruction breaks data-protection law we will tell you, unless we are legally prevented from doing so.

Everyone we authorise to process your data is bound by confidentiality, by contract or by statute, and is made aware of what that means in practice.

Taking account of the state of the art and the risk involved, we apply appropriate technical and organisational measures. They include:

You authorise us to engage sub-processors in the following categories: hosting and infrastructure, the automated writing and image services that produce course content, transactional email, and payment processing.

We impose data-protection obligations on each of them that are no less protective than this agreement, and we remain responsible for their performance. A current list of named sub-processors is available on request through the contact page.

We will tell you before adding or replacing a sub-processor in a material category. You may object on reasonable data-protection grounds within 15 days; if we cannot resolve the objection, you may terminate the affected service, which is your remedy for it.

The application and its database run on infrastructure in the Netherlands.

Writing a course means sending the relevant part of your material to the automated writing service we use as a supplier, and drawing the illustrations a course has means sending a short description of the page, written for that purpose, to the automated image service we use as a supplier. Either may process what it receives outside the European Economic Area. Where that happens it is covered by a transfer mechanism permitted under Chapter V of the GDPR (an adequacy decision or the European Commission’s standard contractual clauses), together with supplementary measures where appropriate.

Both suppliers are contractually prohibited from using what we send them to train their models. They may use it only to provide the service, to detect and prevent misuse, and where the law requires, and they keep it for at most 30 days unless it is flagged for misuse review or the law requires longer.

Taking account of the nature of the processing, we will help you respond to requests from data subjects under Chapter III of the GDPR, and will reasonably assist with data protection impact assessments and prior consultation where the information is available to us.

Most of what you need is self-service: deleting a draft deletes the material in it. Where it is not, ask through the contact page and a person answers.

If we become aware of a breach affecting personal data we process for you, we will notify you without undue delay and give you the information reasonably available to us so that you can meet your own obligations under Articles 33 and 34. A notification is not an admission of fault.

On termination, or on your written request, we delete or return the personal data we hold for you and delete existing copies, unless EU or member-state law requires us to keep it. Backup media may lag primary deletion by a limited period before they expire.

Courses already built into your Moodle are not ours to delete: they are in your system, and they stay there.

We make available the information needed to demonstrate compliance with Article 28, and allow for and contribute to audits on reasonable notice, under confidentiality, during business hours, and without disrupting the service, no more than once in any twelve months unless a breach or a supervisory authority requires otherwise.

Liability under this agreement is subject to the limits in the terms of service, except where mandatory data-protection law says otherwise.

Data protection contact: [email protected]. Postal: Ldesign Media, Vissershavenweg 65 - III, 2583 DL The Hague, Netherlands.

Dutch law governs this agreement. You may also complain to the Autoriteit Persoonsgegevens.