Data Processing Addendum

• For Learner data — the launch, tracking and learning-record data described in Annex 1 — the Customer is the controller and we are the processor. Where a Publisher licenses a Course to a Client, each is an independent controller for its own purposes (the Client for delivering training to its Learners; the Publisher for reporting on use of its Course), and we process for each of them under this DPA.
• The Client instructs us, as part of the service, to make launch and completion statistics for its Licences available to the Publisher of the Course. That sharing is a disclosure between the two controllers and is governed by their agreement with each other.
• For the accounts of your staff who sign in to the portal, we are the controller, as set out in the Privacy Policy; this DPA does not apply to that data.

We will:

1. process personal data only on your documented instructions — which are the Terms, this DPA, and the settings and actions you take in the portal (granting licences, setting seat limits or domains, suspending or expiring licences, requesting exports or deletion) — unless required to do otherwise by law, in which case we will tell you first where the law allows;
2. tell you promptly if we believe an instruction infringes Data Protection Law;
3. ensure that people we authorise to process the data are bound by confidentiality;
4. implement the technical and organisational measures in Annex 2 and keep them appropriate to the risk;
5. engage sub-processors only as set out in section 4;
6. assist you, taking into account the nature of the processing, in responding to data-subject requests (access, rectification, erasure, restriction, portability, objection) — normally within 10 business days of your request — and in meeting your obligations on security, breach notification, data-protection impact assessments and prior consultation;
7. notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal-data breach affecting your data, with the information we have at the time and updates as we learn more;
8. at the end of the service, delete or return the data as set out in section 6;
9. make available the information needed to demonstrate compliance with this DPA, and allow and contribute to audits as set out in section 7.

• You are responsible for the lawfulness of the processing you instruct, including having a lawful basis for delivering courses to Learners and for the reporting the service produces, and for giving Learners the privacy information the law requires (the LMS operator’s privacy notice normally does this).
• You will not instruct us to process special-category data, criminal-offence data or data about children under 13 through the Platform unless we have agreed to it in writing first. SCORM suspend_data and similar fields can carry free text; you are responsible for what your Courses store there.
• You will keep the Licence settings (seats, domains, expiry) accurate and promptly tell us if you need a Licence suspended for a data-protection reason.

You give general authorisation for the sub-processors listed in Annex 3. We will give at least 30 days’ notice (by email to organisation administrators or a notice in the portal) before adding or replacing one; if you object on reasonable data-protection grounds and we cannot address the objection, you may terminate the affected service and we will refund any fees paid in advance for the remaining period. We impose data-protection obligations on sub-processors no less protective than this DPA and remain responsible to you for their performance.

Our databases, course content and profile images are stored in Cloudflare’s Western Europe region; requests are processed at Cloudflare locations close to the user. Where data is transferred outside the UK or EEA, the transfer is made under the UK International Data Transfer Agreement / Addendum or the EU Standard Contractual Clauses contained in the sub-processor’s data-processing terms (Annex 3), together with supplementary measures where needed. We will not transfer your data to a country without adequate safeguards.

• During the service, organisation administrators can request an export of their Licences’ launch and completion data, and can delete member accounts. Publishers can delete Course versions and Courses, which removes the content from storage.
• Within 30 days of termination of the service (or earlier on your written request), we will make your data available for export and then delete it, unless we must keep it to comply with law. Copies in point-in-time backups are overwritten within a further 30 days.
• We will delete specific Learner records within 30 days of a verified request from you, for example to satisfy an erasure request you have received.

On request we will provide the information reasonably needed to demonstrate compliance with this DPA, including our security documentation and our sub-processors’ current reports and certifications (for example Cloudflare’s and Stripe’s SOC 2 / ISO 27001 reports). Where that is not enough to meet a legal obligation, you (or an independent auditor bound by confidentiality) may audit our processing once in any 12-month period on at least 30 days’ written notice, during business hours, in a way that does not disrupt the service or breach our obligations to other customers, at your cost. We will cooperate with a supervisory authority’s inquiry.

Each party’s liability under this DPA is subject to the exclusions and limits in the Terms. If this DPA conflicts with the Terms on a data-protection matter, this DPA prevails. Where a signed agreement between us contains its own processor terms, that agreement prevails over this DPA.

• Encryption. TLS for all traffic (HTTPS only, including between the LMS, the Learner’s browser and the Platform). Data at rest is encrypted by the hosting provider (Cloudflare D1 and R2).
• Content gating. Course files are held in private storage and served only through signed, short-lived links bound to a specific licence and course version; the licence is re-checked on every HTML document request, so suspension or expiry takes effect at the next page load.
• Access control. Role-based, tenant-scoped authorisation on every API endpoint (platform admin, publisher, client administrator, client member); publishers cannot see other publishers’ tenants; clients see only their own organisation. Operator access to production is limited to the founder, via individually authenticated accounts.
• Authentication. Passwords are stored as salted hashes (scrypt via Better Auth); sessions expire; users can review and revoke their sessions; invitation links expire after 7 days and can be revoked.
• Abuse protection. Per-IP rate limits on the public launch endpoints and on the demo form; licence enforcement at launch (status, dates, seats, launch caps, domain allow-list); refusals are logged for investigation.
• Secrets and configuration. Credentials are held in the hosting provider’s encrypted secret store, never in code; production and preview environments use separate databases, storage and secrets.
• Logging and monitoring. Request and error logs at the hosting provider; a health endpoint for external uptime monitoring; operator alerts for signups, licence grants and failures.
• Resilience and backup. Multi-region hosting provider with point-in-time database recovery for up to 30 days; course content stored with high durability object storage.
• Development practice. Changes go through version control and code review, automated type-checking, linting and tests before deployment; dependencies are kept current.
• Incident response. Security incidents are triaged on discovery; affected Customers are notified within 48 hours (section 2) with mitigation steps and follow-up findings.
• Data minimisation. IP addresses are not stored against launch records; analytics identify users by opaque id only; learner names are stored only as the LMS supplies them.

No other third party receives your data. The current list is always at scormbridge.app/dpa; notice of changes is given under section 4.