Data Processing Agreement (DPA)

This data processing agreement (DPA) governs the processing of personal data by CourseKit (PassionFlow Ltd) as processor on behalf of the customer as controller, in connection with the use of the member area. It applies for the duration of the main contract (terms) and ends when that contract ends; any expressly continuing deletion, return and evidence duties remain unaffected.

CourseKit processes data to host and operate the member area, to provide sign-in with Google or an email link, to send emails, to create backups, and to evaluate usage (visit days, watch time) on the customer's behalf.

The following are processed: members' names and email addresses, the linked provider identifier when Google sign-in is used, course access and access windows, learning progress (watch time, completed lessons) and visit days. Google access, refresh and ID tokens are not stored. The application itself does not store IP addresses or browser fingerprints. For payment events, the buyer's email address and the purchased product are also processed; the full payment payload is automatically deleted (set to null) 90 days after receipt.

Data subjects are the members of the customer's member area and the customer's own staff (team members with access to the administration).

The instruction does not cover special categories of personal data under Art. 9 GDPR or personal data of people under 16. Such data may be processed only under a prior written addendum defining the purpose, legal basis, risks and additional safeguards. If excluded data is transferred accidentally, the customer informs CourseKit without delay and instructs its deletion.

CourseKit processes personal data only on the customer's documented instructions, including for transfers to third countries, unless processing is required by law. In that case CourseKit informs the customer before processing unless the law prohibits it. If CourseKit considers an instruction to infringe data protection law, it informs the customer without delay and suspends the affected processing until clarified. Every authorised person is bound to confidentiality. CourseKit maintains required records, makes compliance information available and fulfils the duties in Art. 28(3) GDPR.

CourseKit's operator can access a member area's administration through the “View as customer” function for a limited period of 30 minutes to handle support requests. Access is read-only at first; write access must be enabled separately and visibly. Every access and every change is logged (audit log). This support access is a form of processing under this DPA and is expressly named as such.

A current list of the sub-processors CourseKit uses, with purpose, location and transfer basis, is in the Sub-processors.

The customer gives general authorisation for the sub-processors in the published list. CourseKit gives at least four weeks' prior notice by email of a new or replacement sub-processor. The customer may object within that period on legitimate data-protection grounds. The parties seek a reasonable solution; if none is possible, the affected service may be terminated. CourseKit binds each sub-processor in writing to at least equivalent data-protection duties and remains responsible for its performance.

Application functions are configured for Frankfurt and the database for AWS eu-central-1 (Frankfurt). Providers may perform other processing and technical delivery worldwide; section 12 and the sub-processor list apply. Tenant separation is enforced at database level by row level security. Further measures include TLS, AES-256-GCM for payment-provider credentials, sign-in without a CourseKit password, no storage of Google bearer tokens, operator access only with a second factor and audit log, private delivery of protected files, daily backups retained for 30 days, automatic deletion of raw payment data after 90 days and a documented deletion process. CourseKit regularly tests effectiveness and adjusts these measures according to risk.

Taking account of the nature of processing, CourseKit assists the customer through access, export and deletion functions and on request with data-subject rights, security obligations, data protection impact assessments and any required prior consultation with the supervisory authority. If CourseKit receives a data-subject request concerning commissioned data, it refers or forwards it to the customer without deciding the substance itself.

After becoming aware of a personal data breach affecting commissioned data, CourseKit informs the customer without undue delay and in principle within 24 hours where information is then available. The notice contains the available information about nature, scope, likely consequences and measures taken or proposed. Missing information follows without undue delay. The customer as controller decides whether to notify an authority or affected people.

Where a sub-processor processes data outside the European Economic Area, CourseKit uses a Chapter V GDPR transfer mechanism, in particular an adequacy decision, the EU Standard Contractual Clauses and supplementary measures where required. Current locations and safeguards are stated in the sub-processor list. An EU function region does not by itself exclude third-country support, logging or sub-processor access.

During the contract the customer can export their data. After termination they choose, within the technically available period, return by export or deletion; unless otherwise instructed, a deletion request made in the product is the deletion instruction. CourseKit irrevocably deletes all data and files 30 days later, including application-level backups, unless a statutory retention duty prevents this. Data retained by law is restricted and processed only for that purpose.

On request, CourseKit provides the information necessary to demonstrate compliance with this DPA. Current documentation, audit reports and suitable certifications are used first. If these are reasonably insufficient, CourseKit permits an audit no more than once a year and additionally after a relevant data-protection incident, by an independent party bound to confidentiality and on reasonable notice, provided security and other customers' rights are not impaired.

The customer remains the controller, ensures the lawfulness of processing, information of data subjects and a valid legal basis, gives only lawful instructions and protects their own administrator and payment-provider access. Payment, video or embed providers connected by the customer are not CourseKit sub-processors; their selection, contracts and privacy notices are the customer's responsibility.