Data Processing Addendum
This Data Processing Addendum (“DPA”) forms part of the agreement between the customer (“Controller”) and [Legal entity name] (“SCORM Craft”, “Processor”) for the processing of personal data contained in Customer Content.
How to execute. By accepting the Terms and uploading a course that contains personal data, or by signing or accepting this DPA by email, the parties agree to this DPA. The DPA prevails over the Terms for data-protection matters. Contact privacy@scormcraft.app for a signed copy or the executed SCCs.
1. Definitions
“Personal data”, “processing”, “controller”, “processor”, “data subject”, “supervisory authority”, “GDPR” and “UK GDPR” have the meanings given in applicable data-protection law. “Customer Content” means the SCORM packages and related materials the Controller uploads. “Services” means the SCORM Craft conversion, branding, preview, storage and download service. “Subprocessor” means a third party engaged by the Processor to process personal data on behalf of the Controller.
2. Roles and scope
The Controller determines the purposes and means of processing Customer Content and is responsible for its lawfulness. The Processor processes personal data only to provide the Services, on documented instructions from the Controller, and as required by law. The subject matter, duration, nature and purpose of processing, the types of personal data and the categories of data subjects are described in Annex A.
This DPA does not cover account, payment or website data for which SCORM Craft is the controller; that processing is described in the Privacy Policy.
3. Processor obligations
- Process personal data only on the Controller’s documented instructions, including for transfers, unless required by law (in which case the Processor will inform the Controller unless prohibited).
- Ensure that personnel authorised to process personal data are bound by confidentiality obligations.
- Implement and maintain the technical and organisational measures in Annex B.
- Assist the Controller, taking into account the nature of processing, in responding to data-subject requests and in meeting obligations under Articles 32–36 GDPR/UK GDPR (security, breach notification, impact assessments and prior consultation).
- Notify the Controller of a personal-data breach without undue delay and, where feasible, within 48 hours of confirmation, with the information reasonably available.
- Make available information reasonably necessary to demonstrate compliance and allow audits as described in section 8.
- Return or delete personal data at the end of the Services, as described in section 10.
- Not sell personal data, use it for advertising, or use it to train generative AI models.
4. Controller obligations
The Controller represents and warrants that it has a lawful basis for processing, has provided all notices and obtained all consents required for the Customer Content (including learner data), has the right to upload the content, and will not instruct the Processor to process special-category data or data of children without appropriate safeguards. The Controller is responsible for the accuracy, quality, accessibility and legality of Customer Content and for configuring branding and access appropriately.
5. Subprocessors
The Controller authorises the Processor to engage the subprocessors listed in Annex D and at /legal/subprocessors.html. The Processor will give reasonable notice (at least 30 days where practicable) of a new subprocessor or a material change, and the Controller may object on reasonable data-protection grounds. If the parties cannot resolve an objection, the Controller may terminate the affected Services. The Processor remains liable for its subprocessors’ performance to the extent required by law.
6. Security
The Processor will implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art, costs and the nature, scope, context and purposes of processing. The current measures are described in Annex B and in Security & Data Handling.
7. Breach notification
The Processor will notify the Controller without undue delay after becoming aware of a personal-data breach affecting Customer Content. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, and the measures taken or proposed. The Processor will cooperate with the Controller’s investigation and notifications, but will not make public statements about the breach without the Controller’s prior consent unless required by law. Notification is not an admission of fault.
8. Audits
Once per year, or after a confirmed material breach, the Controller may request a remote audit or a completed security questionnaire. The Processor will respond within a reasonable time. On-site audits require 30 days’ notice, a mutually agreed scope, confidentiality undertakings, and reimbursement of reasonable costs. Audits must not compromise the security or confidentiality of other customers. The Processor’s compliance with a recognised certification or a recent independent audit may satisfy this obligation where appropriate.
9. International transfers
Where the processing involves a transfer of personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the parties agree to the European Commission’s Standard Contractual Clauses (Module 2: controller to processor), the UK International Data Transfer Addendum and the Swiss addendum, incorporated by reference. Annex C completes the SCCs. The Processor will implement supplementary measures as described in Annex B and will notify the Controller if it can no longer comply with the SCCs.
10. Return and deletion
On termination of the Services, the Processor will return or delete Customer Content within 30 days, at the Controller’s choice, except for copies required by law, for legal claims, or in provider backups that are isolated and deleted on the provider’s schedule. The Processor will certify deletion on request. The Controller may export its course packages before termination using the download features.
11. Liability and indemnity
Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms, except where applicable data-protection law prohibits limitation. The Processor will indemnify the Controller for fines or damages to the extent caused by the Processor’s breach of this DPA, subject to the Terms’ cap. The Controller will indemnify the Processor for claims arising from Customer Content or the Controller’s instructions, as described in the Terms.
12. Term, precedence and changes
This DPA applies while the Processor processes Customer Content. If there is a conflict between this DPA and the Terms, this DPA prevails for data-protection matters. Changes required by law or by a subprocessor may be made with notice. The parties will negotiate in good faith any amendment required by a supervisory authority.
Annex A — Processing details
Subject matter: conversion, branding, storage, preview and delivery of SCORM packages. Duration: the term of the Services plus the deletion period. Nature of processing: collection, extraction, transformation, storage, transmission, display, deletion. Purpose: provide the Services requested by the Controller. Personal data: identifiers, contact details, employment/training records, quiz responses, progress, and any other personal data the Controller includes in a course. Data subjects: the Controller’s learners, employees, contractors and other individuals included in Customer Content. Special categories: not intentionally processed; the Controller must not include special-category data without a lawful basis and appropriate safeguards.
Annex B — Security measures
- TLS 1.2+ for data in transit; encryption at rest at the infrastructure provider.
- Cloudflare Workers, Containers and R2 object storage; isolated container per deployment; least-privilege access to secrets and production systems.
- Authentication via single-use magic links; HttpOnly, SameSite cookies; session signing; rate limiting on login requests.
- Access to production data limited to authorised personnel with a business need; logging and monitoring of service health and errors.
- Vendor review and contractual data-protection commitments with subprocessors.
- Secure development practices, dependency updates, and separation of code and customer data.
- Incident response and breach notification procedures; data minimisation and deletion on request.
- No sale of personal data, no advertising use, and no training of generative AI models on Customer Content.
Annex C — Standard Contractual Clauses
The SCCs are incorporated by reference. For Module 2: the data exporter is the Controller; the data importer is [Legal entity name]; the competent supervisory authority is the one identified by the Controller’s establishment in the EEA, or the Irish Data Protection Commission where the Controller is not established in the EEA. The processing details in Annex A and the security measures in Annex B complete Annexes I and II. Annex III (subprocessors) is completed by Annex D. The parties agree to the optional clause for indemnification of data subjects and to the governing law of the EU member state where the Controller is established, or Chile where the Controller is not established in the EU, without prejudice to mandatory rights.
Annex D — Subprocessors
See /legal/subprocessors.html for the current list, purposes and locations. The list includes Cloudflare, Inc. (hosting, containers, R2 storage, email sending), Dodo Payments (payments), and GitHub, Inc. (source code and CI/CD, no Customer Content).
Contact
Data protection contact: privacy@scormcraft.app. Legal: legal@scormcraft.app. Controller entity: [Legal entity name], [Registered address], [City], Chile.