Data Processing Agreement

Effective Date: February 15, 2024 · Last Updated: October 14, 2026 · Version: 1.1

Effective Date: February 15, 2024

Last Updated: October 14, 2026

Version: 1.1

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between The Academix (“Processor,” “we,” “us,” or “our”) and the institutional customer (“Controller,” “you,” or “your”) for the provision of learning management system services (“Services”).

This DPA applies where and only to the extent that The Academix processes Personal Data on behalf of the Controller in the course of providing the Services and such processing is subject to Data Protection Laws.

RECITALS

WHEREAS, the Controller has engaged the Processor to provide learning management system services;

WHEREAS, in the course of providing the Services, the Processor may process Personal Data on behalf of the Controller;

WHEREAS, the Parties wish to ensure such processing is conducted in accordance with applicable Data Protection Laws, including the GDPR;

NOW, THEREFORE, in consideration of the mutual covenants and agreements herein contained, the Parties agree as follows:

1. DEFINITIONS

1.1 General Definitions

For the purposes of this DPA:

“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with a Party.
“Controller” means the Institutional Customer who determines the purposes and means of the processing of Personal Data.
“Data Protection Laws” means all applicable laws and regulations relating to the processing of Personal Data, including:
Regulation (EU) 2016/679 (General Data Protection Regulation or “GDPR”)
UK GDPR and Data Protection Act 2018
India Information Technology Act, 2000 and applicable rules
California Consumer Privacy Act (CCPA)
Any other applicable data protection or privacy laws
“Data Subject” means an identified or identifiable natural person whose Personal Data is processed under this DPA.
“EEA” means the European Economic Area.
“Personal Data” means any information relating to an identified or identifiable natural person that is processed by the Processor on behalf of the Controller in the course of providing the Services.
“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.
“Processing” (and its cognates, “process,” “processes,” “processed”) means any operation or set of operations performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, erasure, or destruction.
“Processor” means The Academix, which processes Personal Data on behalf of the Controller.
“Services” means the learning management system platform and related services provided by The Academix as described in the Terms of Service.
“Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the transfer of personal data to third countries approved by the European Commission.
“Sub-processor” means any third party engaged by the Processor to process Personal Data on behalf of the Controller.
“Supervisory Authority” means an independent public authority established by an EEA Member State pursuant to the GDPR.

1.2 GDPR Definitions

Terms used but not defined in this DPA shall have the meanings given to them in the GDPR.

2. SCOPE AND APPLICABILITY

2.1 Scope of Processing

This DPA applies to the processing of Personal Data by the Processor on behalf of the Controller in connection with the Services, including but not limited to:

Student and learner personal data
Staff and tutor personal data
End user account information
Academic records and performance data
Assessment and assignment submissions
Attendance records
Communication data
Any other Personal Data uploaded or created through the Services

2.2 Data Processing Roles

The Parties acknowledge and agree that:

The Controller is the data controller for Personal Data of End Users (students, learners, staff)
The Processor is the data processor acting on behalf of the Controller
The Processor processes Personal Data only on documented instructions from the Controller
This DPA does not apply to Personal Data for which The Academix is an independent controller (e.g., Institutional Customer account data)

2.3 Hierarchy of Agreements

In the event of any conflict or inconsistency between this DPA and the Terms of Service or Privacy Policy:

This DPA shall prevail with respect to the processing of Personal Data
For all other matters, the Terms of Service shall prevail
The Privacy Policy applies to Personal Data for which The Academix is a controller

3. CONTROLLER INSTRUCTIONS

3.1 Processing Instructions

The Processor shall process Personal Data only on documented instructions from the Controller, including:

As necessary to provide the Services as described in the Terms of Service
As documented in Annex A (Details of Processing)
As otherwise documented in writing by the Controller through the Services interface or via email to [email protected]
To comply with applicable laws to which the Processor is subject

3.2 Scope of Instructions

The Controller’s instructions for the processing of Personal Data include:

User management (adding, modifying, deleting user accounts)
Content management (uploading, organizing, sharing educational materials)
Assessment and grading operations
Attendance tracking and reporting
Communication facilitation
Analytics and reporting generation
Data export and backup
Integration with third-party services selected by the Controller

3.3 Unlawful Instructions

If the Processor believes that an instruction from the Controller violates Data Protection Laws, the Processor shall:

Immediately inform the Controller
Be entitled to suspend the instruction until the Controller confirms or modifies the instruction
Not be liable for any failure to comply with an unlawful instruction

3.4 Changes to Instructions

The Controller may modify processing instructions by:

Using the Services interface to change settings and configurations
Providing written instructions via email to [email protected]
Formal written amendment to this DPA (for material changes)

4. PROCESSOR OBLIGATIONS

4.1 Compliance with Data Protection Laws

The Processor shall:

Process Personal Data in accordance with Data Protection Laws
Comply with the Controller’s documented instructions
Implement appropriate technical and organizational measures (Section 6)
Not process Personal Data for any purpose other than as instructed by the Controller
Ensure that persons authorized to process Personal Data are subject to confidentiality obligations

4.2 Confidentiality

The Processor shall:

Ensure that access to Personal Data is limited to personnel who need access to perform the Services
Ensure that all personnel processing Personal Data are subject to appropriate confidentiality obligations
Not disclose Personal Data to any third party except as permitted under this DPA or as instructed by the Controller

4.3 Records of Processing Activities

The Processor shall maintain records of all categories of processing activities carried out on behalf of the Controller, including:

The name and contact details of the Processor and Controller
Categories of processing
Categories of Data Subjects and Personal Data
Categories of recipients of Personal Data
International transfers of Personal Data (if applicable)
Description of technical and organizational security measures

4.4 Cooperation with Controller

The Processor shall:

Provide reasonable assistance to the Controller in responding to Data Subject requests (Section 5)
Assist the Controller in ensuring compliance with Data Protection Laws
Provide information reasonably requested by the Controller to demonstrate compliance with this DPA
Make available to the Controller all information necessary to demonstrate compliance with GDPR Article 28

5. DATA SUBJECT RIGHTS

5.1 Assistance with Data Subject Requests

The Processor shall provide reasonable assistance to the Controller to respond to requests from Data Subjects exercising their rights under Data Protection Laws, including:

Right of access
Right to rectification
Right to erasure (“right to be forgotten”)
Right to restriction of processing
Right to data portability
Right to object
Rights related to automated decision-making and profiling

5.2 Forwarding Data Subject Requests

If the Processor receives a Data Subject request directly:

The Processor shall promptly forward the request to the Controller
The Processor shall not respond to the Data Subject except as instructed by the Controller or as required by law
The Processor shall assist the Controller in responding within applicable timeframes

5.3 Tools for Data Subject Rights

The Processor provides the following tools to facilitate Data Subject rights:

Data export functionality within the Services
User account deletion capabilities
Data correction and updating interfaces
Access controls to restrict processing
Reporting and audit logs

5.4 Fees for Assistance

The Processor’s assistance under this Section 5 is included in the Services fees, except that:

Assistance requiring significant additional effort may be subject to reasonable fees
The Processor shall provide advance notice and fee estimate before incurring such fees

6. SECURITY MEASURES

6.1 Technical and Organizational Measures

The Processor shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

Access Control:

User authentication and authorization mechanisms
Multi-factor authentication for administrative access
Role-based access control (RBAC)
Regular access reviews and deprovisioning
Session management and timeout controls

Data Security:

Encryption of data in transit (TLS/SSL)
Encryption of sensitive data at rest
Secure key management
Regular security updates and patching
Vulnerability scanning and penetration testing

Network Security:

Firewalls and intrusion detection/prevention systems
Network segmentation
DDoS protection
Secure network architecture

Application Security:

Secure coding practices
Input validation and sanitization
CSRF and XSS protection
SQL injection prevention
Regular security code reviews

Infrastructure Security:

Hosting on DigitalOcean, Cloudflare, and Amazon Web Services infrastructure, each of which maintains its own independent security certifications
Encrypted connections between the application and its database
Physical security of data centers
Redundancy and backup systems
Disaster recovery capabilities

Organizational Measures:

Security policies and procedures
Employee security training and awareness
Background checks for personnel with access to Personal Data
Incident response procedures
Regular security audits and assessments

6.2 Security Certifications and Standards

The Processor’s infrastructure providers (DigitalOcean, Cloudflare, and Amazon Web Services) each maintain their own security and compliance programmes and publish their own independent audit reports and certifications. Those certifications belong to the providers; they are not certifications of the Processor.

6.3 Security Updates

The Processor shall:

Regularly review and update security measures
Implement security patches and updates promptly
Conduct periodic security assessments
Notify the Controller of material changes to security measures

6.4 Security Incidents

The Processor shall:

Maintain an incident response plan
Monitor for security incidents and Personal Data Breaches
Respond promptly to security incidents
Comply with Personal Data Breach notification requirements (Section 8)

7. SUB-PROCESSORS

7.1 General Authorization

The Controller provides general authorization for the Processor to engage Sub-processors to process Personal Data, subject to the conditions in this Section 7.

7.2 Current Sub-processors

The Processor currently engages the following Sub-processors:

DigitalOcean, LLC

Service: Application hosting and managed MySQL database
Location: India (Bengaluru)
Processing: All Personal Data processed through the Services
Website: digitalocean.com
Privacy Policy: digitalocean.com/legal/privacy-policy

Cloudflare, Inc.

Service: Storage of uploaded files and videos (Cloudflare R2), content delivery network, and hosting of the institute and student web applications
Location: Cloudflare’s global network; the R2 storage location is selected automatically by Cloudflare and is not restricted to India
Processing: Uploaded files and videos; traffic to our websites and web applications
Website: cloudflare.com
Privacy Policy: cloudflare.com/privacypolicy

Amazon Web Services, Inc. (AWS)

Service: Backup copy of uploaded files (Amazon S3), video processing (AWS Lambda), encryption key management (AWS KMS), and hosting of the parent portal web application (Amazon CloudFront)
Location: United States (US East region), with content delivery through AWS’s global network
Processing: Uploaded files and videos, for backup and video processing
Website: aws.amazon.com
Privacy Policy: aws.amazon.com/privacy

Google LLC

Service: Google Meet and Google Calendar integration for live classes (when connected); Gemini API for AI-assisted features (when used); Firebase Cloud Firestore for in-app chat and discussion messages; Firebase Cloud Messaging for mobile app notifications; Google Drive import (when used)
Location: United States and other countries where Google operates
Processing: Video conference and calendar data when the integration is used; documents, images, and text submitted to AI-assisted features; chat and discussion messages; device notification tokens
Website: google.com
Privacy Policy: policies.google.com/privacy

Brevo (Sendinblue SAS)

Service: Transactional email
Location: European Union
Processing: Recipient names and email addresses, and the content of platform emails
Website: brevo.com
Privacy Policy: brevo.com/legal/privacypolicy

Copyleaks Ltd.

Service: Plagiarism detection
Location: United States, Israel
Processing: Assignment submissions for plagiarism checking
Website: copyleaks.com
Privacy Policy: copyleaks.com/privacy-policy

Razorpay Software Private Limited

Service: Payment processing for subscriptions and, if enabled, student fee collection
Location: India
Processing: Payment transaction data
Website: razorpay.com
Privacy Policy: razorpay.com/privacy

Stripe

Service: Payment processing
Location: United States and other countries where Stripe operates
Processing: Payment transaction data
Website: stripe.com
Privacy Policy: stripe.com/privacy

BigBlueButton (not a Sub-processor)

Institutions that use BigBlueButton for live classes connect their own BigBlueButton server with their own credentials
That server is engaged by the institution, not by the Processor, so it is not a Sub-processor under this DPA

The current list of Sub-processors is maintained in Annex D of this DPA, at www.theacademix.com/data-processing-agreement.

7.3 Sub-processor Obligations

The Processor shall:

Ensure that Sub-processors are bound by data protection obligations no less protective than this DPA
Ensure Sub-processors implement appropriate technical and organizational security measures
Remain fully liable to the Controller for the performance of Sub-processors’ obligations
Conduct due diligence on Sub-processors’ security and privacy practices

7.4 New Sub-processors

Before engaging a new Sub-processor:

The Processor shall notify the Controller of the intended engagement
Notification shall be provided at least 30 days in advance via email or platform notice
The Controller may object to the new Sub-processor on reasonable data protection grounds
Objections must be provided in writing within 14 days of notification

7.5 Objection to Sub-processors

If the Controller objects to a new Sub-processor on reasonable grounds:

The Parties shall discuss in good faith to resolve concerns
If concerns cannot be resolved, the Controller may:
Terminate the affected Services without penalty, OR
Continue using the Services without the functionality requiring the new Sub-processor (if feasible)

8. PERSONAL DATA BREACHES

8.1 Notification to Controller

In the event of a Personal Data Breach, the Processor shall:

Notify the Controller without undue delay and in any event within 72 hours of becoming aware
Provide notification via email to the Controller’s designated contact
Provide sufficient information to allow the Controller to meet GDPR notification obligations

8.2 Breach Notification Content

The notification shall include, to the extent possible:

Description of the nature of the Personal Data Breach
Categories and approximate number of Data Subjects affected
Categories and approximate number of Personal Data records affected
Name and contact details of the Processor’s data protection officer or contact point
Description of likely consequences of the breach
Description of measures taken or proposed to address the breach and mitigate harm

8.3 Cooperation and Investigation

The Processor shall:

Investigate the Personal Data Breach promptly
Take reasonable steps to mitigate and remediate the breach
Preserve evidence relating to the breach
Provide ongoing updates to the Controller as investigation progresses
Cooperate with the Controller in notifying Supervisory Authorities and Data Subjects (if required)

8.4 Controller’s Responsibility

The Controller is responsible for:

Determining whether to notify Supervisory Authorities
Determining whether to notify Data Subjects
Making any required notifications under Data Protection Laws
Responding to inquiries from Supervisory Authorities and Data Subjects

8.5 Documentation

The Processor shall:

Document all Personal Data Breaches
Maintain records of breaches, including facts, effects, and remedial actions
Make such documentation available to the Controller and Supervisory Authorities upon request

9. DATA TRANSFERS

9.1 International Transfers

The Processor may transfer Personal Data to countries outside the EEA in connection with the Services. Such transfers are subject to appropriate safeguards as required by Data Protection Laws.

9.2 Transfer Mechanisms

For transfers of Personal Data from the EEA to countries without an adequacy decision, the Parties rely on:

Standard Contractual Clauses (SCCs) as approved by the European Commission (Annex B)
Sub-processors’ data processing terms and their compliance with international data transfer frameworks
Additional technical and organizational measures to ensure data protection

9.3 Standard Contractual Clauses

Where required by Data Protection Laws:

The Standard Contractual Clauses (SCCs) attached as Annex B are incorporated into this DPA
The SCCs shall apply to transfers of Personal Data from the EEA to countries without adequacy decisions
In case of conflict between the SCCs and this DPA, the SCCs shall prevail

9.4 UK Transfers

For transfers of Personal Data from the UK:

The UK Addendum to the SCCs applies (if applicable)
The Processor complies with UK data protection laws
Appropriate safeguards are in place per UK GDPR requirements

9.5 Data Localization

The Processor processes and stores Personal Data primarily in:

India (Bengaluru): application servers and database, on DigitalOcean
Cloudflare’s global network: uploaded files and videos (Cloudflare R2, at a storage location Cloudflare selects automatically) and their delivery
United States (AWS US East region): a backup copy of uploaded files, video processing, and encryption key management
The countries listed for each Sub-processor in Section 7.2, for the processing that Sub-processor performs
The Controller may request specific data localization requirements (subject to availability and additional fees)

10. AUDITS AND COMPLIANCE

10.1 Audit Rights

The Controller has the right to:

Audit the Processor’s compliance with this DPA
Inspect the Processor’s facilities, systems, and records related to Personal Data processing
Engage a third-party auditor to conduct audits on the Controller’s behalf

10.2 Audit Procedures

Audits shall be conducted:

Upon reasonable advance notice (at least 30 days)
During normal business hours
No more than once per year (except in case of a Personal Data Breach or regulatory requirement)
Subject to reasonable confidentiality obligations
At the Controller’s expense (unless audit reveals material non-compliance)

10.3 Audit Cooperation

The Processor shall:

Cooperate with audits and provide reasonable assistance
Make available personnel, documentation, and systems necessary for the audit
Respond to audit findings within a reasonable timeframe
Implement corrective actions for any identified non-compliance

10.4 Compliance Documentation

The Processor shall provide the Controller:

Annual compliance certifications or attestations
Relevant security audit reports of the Processor’s infrastructure providers, where those providers make them available
Documentation demonstrating compliance with this DPA
Information reasonably necessary for the Controller to demonstrate compliance to Supervisory Authorities

10.5 Infrastructure Provider Audit Reports

As the Processor uses infrastructure from DigitalOcean, Cloudflare, and AWS, those providers’ published audit reports may be provided, where their terms permit, to demonstrate infrastructure security and compliance.

11. DATA PROTECTION IMPACT ASSESSMENT

11.1 Processor Assistance

The Processor shall provide reasonable assistance to the Controller in conducting Data Protection Impact Assessments (DPIAs) where required under Data Protection Laws.

11.2 Information for DPIAs

The Processor shall provide:

Description of processing operations
Purpose of processing
Categories of Personal Data and Data Subjects
Security measures implemented
Information about Sub-processors
Risks associated with processing
Measures to mitigate risks

11.3 Fees for DPIA Assistance

Assistance with DPIAs that require significant Processor effort beyond standard documentation may be subject to reasonable fees with advance notice.

12. DELETION AND RETURN OF PERSONAL DATA

12.1 Upon Termination

Upon termination or expiration of the Services:

The Controller has 30 days to export all Personal Data using the Services’ export functionality
After the 30-day export period, the Processor shall delete or return all Personal Data (at Controller’s choice)
Deletion shall occur within 90 days of the export period end

12.2 Certification of Deletion

Upon request, the Processor shall provide written certification that Personal Data has been deleted in accordance with this DPA.

12.3 Legal Retention

The Processor may retain Personal Data to the extent required by applicable law, including:

Financial records (typically 7 years for tax purposes)
Legal hold or litigation requirements
Regulatory retention obligations

Retained Personal Data shall continue to be subject to this DPA and shall be deleted when no longer required by law.

12.4 Backup Copies

Personal Data in backup systems may persist for up to 90 days after deletion from active systems. Backup data is subject to the same security measures and shall be deleted in the normal course of backup rotation.

13. LIABILITY AND INDEMNIFICATION

13.1 Processor Liability

The Processor’s liability for breaches of this DPA is subject to the limitations of liability in the Terms of Service, except where Data Protection Laws prohibit such limitations.

13.2 GDPR Liability

Under GDPR Article 82:

Each Party may be held liable for damages caused by processing that infringes GDPR
The Processor is liable for damages only where it has not complied with obligations specifically directed at processors or has acted outside or contrary to lawful instructions from the Controller
The Processor is exempt from liability if it proves it is not in any way responsible for the event giving rise to the damage

13.3 Indemnification

The Processor shall indemnify the Controller against:

Claims, fines, or penalties arising from the Processor’s breach of this DPA
Claims arising from the Processor’s failure to comply with Data Protection Laws
Claims arising from unauthorized processing by the Processor or its Sub-processors

This indemnification is subject to:

The Controller promptly notifying the Processor of any claim
The Processor having sole control of the defense and settlement
The Controller providing reasonable cooperation
Limitations of liability in the Terms of Service (where permitted by law)

14. TERM AND TERMINATION

14.1 Term

This DPA shall commence on the Effective Date and remain in effect for as long as the Processor processes Personal Data on behalf of the Controller.

14.2 Termination

This DPA shall terminate:

Upon termination of the Terms of Service
When the Processor ceases all processing of Personal Data on behalf of the Controller
By mutual written agreement of the Parties

14.3 Survival

The following provisions survive termination:

Deletion and return of Personal Data (Section 12)
Audit rights for periods prior to termination (Section 10)
Liability and indemnification (Section 13)
Confidentiality obligations
Any provisions that by their nature should survive

15. GENERAL PROVISIONS

15.1 Entire Agreement

This DPA, together with the Terms of Service and Annexes, constitutes the entire agreement between the Parties regarding the processing of Personal Data.

15.2 Amendments

This DPA may be amended:

By mutual written agreement of the Parties
By the Processor to comply with Data Protection Laws (with notice to the Controller)
By the Processor to reflect changes in Sub-processors or security measures (with notice)

15.3 Severability

If any provision of this DPA is held invalid or unenforceable:

The provision shall be modified to the minimum extent necessary to make it valid
The remaining provisions remain in full force and effect

15.4 Governing Law

This DPA is governed by the same law as the Terms of Service (Laws of India), except where Data Protection Laws require otherwise (e.g., GDPR provisions governed by EU law).

15.5 Dispute Resolution

Disputes arising from this DPA shall be resolved in accordance with the Terms of Service, except that:

Supervisory Authorities have the right to take action under Data Protection Laws
Data Subjects have the rights provided under Data Protection Laws

15.6 Order of Precedence

In case of conflict:

Standard Contractual Clauses (Annex B) - for international transfers
This DPA - for data processing matters
Terms of Service - for all other matters

15.7 Language

This DPA is in English. Any translations are for convenience only. In case of conflict, the English version prevails.

16. CONTACT INFORMATION

For DPA-related inquiries or to exercise rights under this DPA:

Data Controller (Institutional Customer):

As specified in the Services account

Data Processor:

The Academix
67, Ajit Colony
Jodhpur, 342001
Rajasthan, India
Email: [email protected]

DPA Inquiries: [email protected] (Subject: “DPA Inquiry”)

Data Protection Officer (if appointed):

Email: [email protected]

ANNEXES

This DPA includes the following Annexes:

Annex A: Details of Processing
Annex B: Standard Contractual Clauses (SCCs)
Annex C: Security Measures (Detailed)
Annex D: Sub-processor List

ANNEX A: DETAILS OF PROCESSING

1. Subject Matter of Processing

The processing of Personal Data is necessary for the Processor to provide learning management system services to the Controller under the Terms of Service.

2. Duration of Processing

The duration of processing is the term of the Services agreement, plus any period required for data deletion as specified in Section 12.

3. Nature and Purpose of Processing

The Processor processes Personal Data to:

Provide access to the learning management platform
Facilitate course creation and content management
Enable virtual classrooms and online learning
Provide assessment and testing tools
Facilitate communication between tutors and students
Track attendance and learning progress
Generate analytics and reports
Enable certificate issuance
Provide a read-only parent portal (if enabled by the Controller)
Provide AI-assisted features (question generation, content drafting, chatbots) when a user invokes them
Support student fee collection (if enabled)
Provide customer support
Ensure platform security and integrity

4. Categories of Data Subjects

Students and learners
Educational staff and tutors
Institutional administrators
Parents/guardians (if applicable)
Other end users authorized by the Controller

5. Categories of Personal Data

Identity Data: Name, username, student ID, employee ID
Contact Data: Email address, phone number (if provided)
Profile Data: Profile picture, bio, preferences, settings
Account Data: Login credentials, authentication tokens, session information
Academic Data: Course enrollments, grades, assessment results, assignment submissions, attendance records, learning progress, certificates earned
Communication Data: Messages, discussion board posts, comments, chat logs
Technical Data: IP address, browser type, device information, log data, cookies
Parent/Guardian Data (if the parent portal is enabled): Name, mobile number, email address (if provided), link to the student, acceptance of the data notice, callback requests (if enabled)
Payment Data: Transaction records, payment history (not full payment card details)
Usage Data: Platform activity, feature usage, time spent, pages viewed
Special Categories: Only if uploaded by Controller (e.g., health data for accommodations)

6. Processing Operations

Collection
Recording
Organization
Structuring
Storage
Adaptation or alteration
Retrieval
Consultation
Use
Disclosure by transmission
Dissemination or otherwise making available
Alignment or combination
Restriction
Erasure or destruction

7. Technical and Organizational Measures

See Annex C for detailed security measures.

ANNEX B: STANDARD CONTRACTUAL CLAUSES (SCCs)

[NOTE: This section would include the full text of the EU Standard Contractual Clauses for international data transfers. For brevity, the full SCCs are not reproduced here. The applicable SCCs depend on the specific transfer scenario:]

For EEA to Non-EEA Transfers:

EU Standard Contractual Clauses (Module Two: Controller to Processor)
As approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021

For UK Transfers:

UK International Data Transfer Agreement (IDTA), or
UK Addendum to EU SCCs

SCC Details:

Module: Module Two (Controller to Processor)

Controller: The Institutional Customer

Processor: The Academix

Competent Supervisory Authority:

For EEA Controllers: The supervisory authority of the Controller’s establishment
For UK Controllers: The UK Information Commissioner’s Office (ICO)

Governing Law:

For EEA: Law of the EU Member State where the Controller is established
For UK: Law of England and Wales

Docking Clause: [Specify if applicable]

Description of Transfer: As set out in Annex A

The full text of the applicable SCCs is available upon request at [email protected].

ANNEX C: SECURITY MEASURES (DETAILED)

1. Access Control

Physical Access Control:

Data centers operated by the Processor’s hosting providers (DigitalOcean, Cloudflare, AWS) with restricted physical access
Biometric access controls
24/7 security monitoring
Visitor access logs

System Access Control:

Multi-factor authentication for administrators
Role-based access control (RBAC)
Principle of least privilege
Regular access reviews
Automated deprovisioning of terminated users
Session timeout after 30 minutes of inactivity
IP whitelisting available for admin accounts

Data Access Control:

Encryption of data at rest (AES-256)
Encryption of data in transit (TLS 1.2+)
Encrypted backups
Secure API authentication and authorization
Database access controls and monitoring

2. Transmission Control

HTTPS/TLS for all data transmission
Secure file upload/download mechanisms
VPN available for administrative access
Encrypted email communications for sensitive data

3. Input Control

Audit logs of all data entry and modifications
User attribution for all changes
Timestamp recording
Immutable audit trail
Log retention for 90 days minimum

4. Availability Control

99.5% uptime SLA
Managed database service with automated backups
Uploaded files stored on Cloudflare R2 with a backup copy on Amazon S3
Automated backups (daily)
Disaster recovery plan with RTO/RPO defined
DDoS protection via Cloudflare for websites, web applications, and file and video delivery
Regular backup testing

5. Separation Control

Logical data separation per customer
Multi-tenancy with strict isolation
Separate databases per customer tier (for Enterprise customers)
Network segmentation
Environment separation (production, staging, development)

6. Pseudonymization and Encryption

Data encryption at rest (AES-256)
Data encryption in transit (TLS 1.2+)
Passwords never stored in plain text; one-way bcrypt hashing for parent accounts, with other accounts being migrated to bcrypt
Lecture videos streamed as encrypted adaptive (HLS) segments, with the key issued only to signed-in, enrolled users
Option for customer-managed encryption keys (Enterprise plans)
Secure key management using AWS KMS

7. Organizational Measures

Personnel:

Background checks for employees with data access
Confidentiality agreements for all personnel
Security awareness training (annual)
Role-based security training
Clear security policies and procedures

Incident Management:

24/7 security monitoring
Incident response plan
Incident escalation procedures
Post-incident review process
Security incident log

Change Management:

Change approval process
Testing of security changes
Rollback procedures
Change documentation

Vendor Management:

Due diligence on Sub-processors
Contractual data protection obligations
Regular vendor security assessments
Vendor incident notification requirements

8. Testing and Assessment

Annual penetration testing by third parties
Quarterly vulnerability scanning
Regular security code reviews
Bug bounty program
Continuous security monitoring

9. Certifications and Compliance

Independent certifications held by the Processor’s infrastructure providers (DigitalOcean, Cloudflare, AWS); these belong to the providers, not to the Processor
GDPR compliance framework
Regular compliance audits

ANNEX D: SUB-PROCESSOR LIST

Current Sub-processors as of October 14, 2026:

DigitalOcean, LLC — Application hosting and managed MySQL database. Location: India (Bengaluru). Processing: All platform data processing and storage of structured records. Privacy Policy: digitalocean.com/legal/privacy-policy
Cloudflare, Inc. — File and video storage (R2), content delivery, web application hosting. Location: Global (Cloudflare network; R2 location selected automatically by Cloudflare). Processing: Uploaded files and videos; website and web application traffic. Privacy Policy: cloudflare.com/privacypolicy
Amazon Web Services, Inc. — Backup copy of uploaded files, video processing, encryption key management, parent portal hosting. Location: United States (US East region). Processing: Uploaded files and videos (backup and processing). Privacy Policy: aws.amazon.com/privacy
Google LLC — Google Meet and Calendar integration, Gemini API (AI-assisted features), Firebase (chat messages and mobile notifications), Google Drive import. Location: US and other countries where Google operates. Processing: As described in Section 7.2. Privacy Policy: policies.google.com/privacy
Brevo (Sendinblue SAS) — Transactional email. Location: European Union. Processing: Recipient names, email addresses, and email content. Privacy Policy: brevo.com/legal/privacypolicy
Copyleaks Ltd. — Plagiarism detection. Location: US, Israel. Processing: Assignment plagiarism checking. Privacy Policy: copyleaks.com/privacy-policy
Razorpay Software Private Limited — Payment processing. Location: India. Processing: Payment transaction data. Privacy Policy: razorpay.com/privacy
Stripe — Payment processing. Location: US and other countries where Stripe operates. Processing: Payment transaction data. Privacy Policy: stripe.com/privacy

BigBlueButton is not a Sub-processor: institutions that use it connect their own BigBlueButton server, which they engage directly.

Note: The current list is maintained in this Annex at www.theacademix.com/data-processing-agreement and updated as Sub-processors are added or removed.

Sub-processor Change Notification:

Changes to Sub-processors will be notified 30 days in advance via email to the Controller’s registered email address.

EXECUTION

This Data Processing Agreement is effective as of the date the Controller accepts the Terms of Service or executes this DPA, whichever is earlier.

For Data Controller (Institutional Customer):

By using the Services, the Controller agrees to the terms of this DPA.

Explicit acceptance can be provided by:

Clicking “I Accept” during account setup
Signing and returning this DPA to [email protected]
Confirming acceptance via email

For Data Processor (The Academix):

This DPA is pre-signed and effective upon Controller’s acceptance.

The Academix
67, Ajit Colony
Jodhpur, 342001
Rajasthan, India
Email: [email protected]