Data Processing Agreement

1. Parties and scope This Data Processing Agreement ("DPA") is between the Creator ("Controller") and ⟦not yet provided⟧ ("Processor"). It applies when the Processor processes personal data on the Controller's behalf in providing the Platform, and forms part of the Terms and Conditions.

2. Controller and processor responsibilities The Controller decides the purposes and means of processing Student and team data and must have a lawful basis and give privacy information to individuals. The Processor processes that data only to provide the Platform.

3. Documented instructions The Processor processes personal data only on the Controller's documented instructions, including those given through the Terms and the Controller's use of Platform settings, unless required by law (in which case it will tell the Controller unless legally prohibited). The Processor will tell the Controller if it believes an instruction infringes data protection law.

4. Confidentiality The Processor ensures that people authorised to process the personal data are bound by confidentiality.

5. Security measures The Processor implements appropriate technical and organisational measures, as described in Schedule 2.

6. Subprocessors The Controller gives general authorisation for the subprocessors listed in Schedule 3. The Processor will give notice of intended changes, giving the Controller the opportunity to object. The Processor imposes data protection obligations on subprocessors equivalent to this DPA and remains liable for them.

7. International transfers The Processor will only transfer personal data outside the UK where permitted by UK GDPR, using adequacy regulations or appropriate safeguards such as the UK International Data Transfer Addendum.

8. Data subject rights Taking into account the nature of processing, the Processor will assist the Controller, by appropriate technical and organisational measures, to respond to requests from individuals exercising their rights.

9. Personal data breaches The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller data, and provide information reasonably needed for the Controller to meet its obligations.

10. Assistance The Processor will assist with data protection impact assessments and prior consultation with the ICO where reasonably required.

11. Audit arrangements The Processor will make available information necessary to demonstrate compliance with Article 28 and allow for audits, including inspections, by the Controller or an auditor it mandates, on reasonable notice, no more than once a year unless required by a regulator or following a breach.

12. Return and deletion At the end of the services, the Processor will, at the Controller's choice, delete or return personal data (subject to the Controller exporting what it needs before closure), unless law requires storage.

Schedule 1 — Processing details - **Subject matter and duration:** provision of the Platform for the term of the Controller's subscription. - **Nature and purpose:** hosting, storing, displaying and transmitting course data; enrolment; progress tracking; assessment; certification; invoicing; AI-assisted content drafting. - **Personal data:** names, email addresses, phone numbers, billing addresses, enrolment and progress records, time-on-task, exam answers and uploaded evidence, marks and feedback, certificates, invoices, signatures on terms. - **Special category data:** not intended. The Controller must not require it unless it has a lawful basis and appropriate safeguards. - **Data subjects:** Students, prospective students who send enquiries, and the Controller's team members.

Schedule 2 — Technical and organisational measures - Encrypted connections (HTTPS/TLS) for all traffic. - Row-level database security restricting each academy to its own data. - Role-based access, with separate roles for platform administrators, academy owners, markers and students. - Private file storage served through time-limited signed links. - Passwords stored in hashed form by the authentication service. - Exam answer keys stored separately from student-visible data. - Append-only audit records for platform changes and marking events. - Server-side checks for payments, certificates and exam results.

Schedule 3 — Subprocessors - **Lovable Cloud** — hosting, database, authentication, file storage. - **Cloudflare** — content delivery and server functions. - **Stripe** — payment processing (for package billing). - **AI model providers via the Lovable AI gateway, including OpenAI and Google** — AI drafting, transcription and narration. - **Lovable email delivery** — account emails.

Processing locations and transfer mechanisms for each subprocessor must be confirmed before this DPA is approved.