Data processing agreement

1. Subject matter, nature and purpose

We process personal data only to provide the Service to the Customer: managing accounts and seats, delivering AI literacy training, grading quizzes and assessments, issuing and verifying certificates, sending e-mails, keeping the training evidence and audit trail, and providing reports and exports. Processing consists of collection, storage, organisation, use, transfer to the sub-processors listed below, erasure and the other operations needed for these purposes.

2. Duration

This DPA applies for as long as we process personal data for the Customer: for the term of the subscription and the following period until deletion described in section 11.

3. Data subjects and categories of data

• Data subjects: employees of the Customer to whom a seat is assigned, and the Customer's administrators.
• Identification and contact data: name, e-mail, department, job role and preferred language.
• Account data: password hash (Argon2id), two-step verification data if used, sign-in times and IP addresses.
• Training data: assigned courses, progress and time spent in lessons, quiz and assessment answers, results and attempts, certificates, acknowledgements of the Customer's AI policy.
• Records entered by the Customer: the AI tool inventory and other data entered by administrators.
• Audit log of important actions with time and author.

The Service is not designed for special categories of personal data (Art. 9 GDPR) and the Customer shall not enter them.

4. Instructions of the Customer

We process the data only on the Customer's documented instructions. This DPA, the Terms of Service and the settings and actions of the Customer's administrators in the Service are the Customer's complete instructions. We will inform the Customer if we believe an instruction infringes data protection law, and we may process data otherwise only where Union or Member State law requires it; in that case we will inform the Customer beforehand unless the law prohibits it.

5. Confidentiality

Only persons who need access to operate or support the Service have access to the data, and they are bound by confidentiality.

6. Security measures

• The Service and all data run on a server in a data centre in Germany (EU).
• Encrypted connections (HTTPS); passwords stored only as Argon2id hashes; signed, HTTP-only session cookies.
• Strict separation of customers: every request is checked against the signed-in user and their company.
• Two-step verification for administrators, mandatory for our own support accounts and available to every Customer administrator.
• Rate limiting of sign-in, password reset and certificate verification.
• Stored secrets such as e-mail sender credentials and two-step verification keys are encrypted (AES-256-GCM).
• Quiz answers are graded on the server; correct answers never reach the browser.
• Audit log of important actions and a security event log kept for 30 days.
• Backups with a retention of up to 30 days and a documented procedure for security incidents.

7. Support access

Authorised MadHoney support staff may sign in to the Customer's administrator account to set up the account or resolve a problem at the Customer's request, or where needed to protect the Service. Such access is limited to the administration panel (never lessons, quizzes or certificates on behalf of employees), is limited in time and is recorded in the Customer's audit log.

8. Sub-processors

• Hostinger International Ltd. (Cyprus) - rental of the virtual private server that runs the Service; data centre in Germany (EU).
• ZONER a.s. (Czech Republic) - SMTP server for delivering e-mails (invitations, reminders, notifications); data centres in Brno.

The Customer gives general authorisation to engage sub-processors. We impose on each of them data protection obligations equivalent to this DPA. We will inform the Customer's administrators by e-mail at least 30 days before adding or replacing a sub-processor; the Customer may object for a justified reason and, if we cannot resolve the objection, cancel the subscription before the change takes effect.

Paddle.com Market Ltd processes payment and billing data as an independent controller (Merchant of Record) and receives no data about the Customer's employees.

9. Assistance to the Customer

Administrators can view, correct, export and delete their employees' data directly in the Service. Taking into account the nature of the processing, we will also help the Customer respond to data subject requests and comply with its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessment and prior consultation). Requests from employees that reach us are forwarded to the Customer.

10. Personal data breaches

We will notify the Customer's administrators of a personal data breach without undue delay and no later than 48 hours after becoming aware of it, with the information available under Article 33(3) GDPR, and will supplement it as further facts become known. We will take measures to contain the breach and mitigate its consequences.

11. Deletion and return of data

During the subscription the Customer can export its reports, training evidence and audit trail at any time. After the subscription ends, administrators can still sign in for 90 days, only to export data; then the company and all its data are deleted automatically, unless the Customer asks for earlier deletion. Copies in backups are overwritten within 30 days. Data that we must keep under law (e.g. invoices) is not covered by this section.

12. Audits

We will make available to the Customer the information necessary to demonstrate compliance with this DPA and allow audits, including inspections, by the Customer or an auditor bound by confidentiality. Audits take place on reasonable prior written notice, during business hours, at most once a year (except after a personal data breach) and at the Customer's cost, without disrupting the Service or access to other customers' data.

13. Obligations of the Customer

The Customer is responsible for having a legal basis for the processing, for informing its employees and for the lawfulness of the data and instructions it gives us.

14. Liability and governing law

Liability under this DPA follows the Terms of Service, except where the GDPR provides otherwise. This DPA is governed by the laws of the Czech Republic; disputes arising from it will be resolved by the competent courts of the Czech Republic with local jurisdiction according to our registered office. Contact for data protection matters: sales@guard-ai.eu.