Preamble
This Data Processing Agreement (the “DPA”) is entered into by and between Xeropan International Limited Liability Company (the “Processor” or “Xeropan”) and the institution authorized to use the Platform and Services pursuant to an Institutional Services Agreement (the “ISA”), and documents referenced therein (the “Controller” or “Institution”).
The Parties acknowledge that, in connection with its use of the Platform and the Services, the Institution determines the purposes and means of the processing of Personal Data and therefore acts as a Controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”).
The Parties further acknowledge that, in connection with the operation of the Platform, Xeropan processes Personal Data on behalf of and for the benefit of the Institution and therefore acts as a Processor within the meaning of Article 4(8) of the GDPR.
The purpose of this DPA is to satisfy the requirements set out in Article 28 of the GDPR and to govern the respective data protection rights and obligations of the Parties in relation to the processing of Personal Data under the ISA and the Services and the Platform.
The Parties further acknowledge that Annex 7 to this DPA contains a summary privacy notice intended for Data Subjects using the Platform. Annex 7 is provided for informational purposes only and shall not amend, modify, or supersede the provisions of this DPA or the Institutional Services Agreement.
1. Definitions
For the purposes of this DPA, capitalized terms not otherwise defined herein shall have the meanings assigned to them under the GDPR. In addition, the following terms shall have the meanings set forth below:
“Data Subject” means an identified or identifiable natural person related to the Personal Data.
“Personal Data” means any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the GDPR.
“Processing” means the activity defined in Article 4(1) of the GDPR.
“Subprocessor” means any third party engaged by Xeropan to process Personal Data on behalf of the Controller in connection with the performance of this DPA.
“Security Incident” means an event defined in Article 4(1) of the GDPR.
“Sensitive Data” means Personal Data covered by the definition in Article 9(1) of the GDPR
Unless otherwise set forth herein, capitalized terms shall be interpreted as defined in the ISA.
2. Subject matter and duration of Processing
2.1. Xeropan shall process Personal Data solely for the purposes of providing, operating, supporting, and maintaining the Platform and the Services.
2.2. The duration of the Processing shall correspond to the term of the ISA, together with any applicable deletion and retention periods set out in the ISA and this DPA.
2.3. A detailed description of the Processing, including the categories of Data Subjects, categories of Personal Data, and purposes of Processing, is set out in Annex 1. A summary privacy notice intended for Data Subjects is set out in Annex 7.
3. Instructions of the Controller
3.1. Xeropan shall process Personal Data in line with Section 2.1. above, solely on documented instructions from the Controller, unless otherwise required by European Union or member state law to which Xeropan is subject; in such a case, Xeropan shall inform the Controller of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest.
3.2. The ISA, the configuration of the Platform, administrative settings made by the Institution, and written instructions provided by the Institution shall constitute documented instructions of the Controller.
3.3. If Xeropan believes that an instruction infringes applicable Data Protection Laws, Xeropan shall inform the Controller without undue delay.
3.4. Xeropan may refuse to comply with any instruction where compliance would be unlawful.
4. Obligations of Xeropan
4.1. Xeropan shall treat Personal Data as confidential and shall ensure an appropriate level of protection for such Personal Data.
4.2. Xeropan shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk in accordance with Article 32 of the GDPR.
4.3. Xeropan shall ensure that access to Personal Data is limited to persons who need such access for the performance of their employment, contractual, or service-related duties.
4.4. Xeropan shall ensure that persons authorised to process Personal Data are subject to appropriate confidentiality obligations.
4.5. Xeropan shall assist the Controller in fulfilling its obligations under the GDPR (especially under Articles 32-36. ) in accordance with the provisions of this DPA.
5. Confidentiality
5.1. Xeropan shall ensure that all employees, contractors, agents, and other personnel who have access to Personal Data are subject to appropriate confidentiality obligations.
5.2. Such confidentiality obligations shall continue to apply after the termination of the individual's access rights and, where applicable, after the termination of their employment, engagement, or contractual relationship with Xeropan.
5.3. Xeropan shall maintain appropriate access control procedures designed to ensure that Personal Data is accessible only to individuals who require such access for the performance of their authorised duties.
6. Technical and organisational measures
6.1. Xeropan shall implement and maintain appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access.
6.2. A detailed description of the applicable technical and organisational measures is set out in Annex 2.
6.3. The measures described in Annex 2 include, without limitation, controls relating to:
a) access management;
b) authentication and identity verification;
c) encryption of data;
d) logging and monitoring;
e) backup and recovery procedures;
f) incident management;
g) vulnerability management;
h) penetration testing;
i) supplier and Subprocessor oversight.
6.4. Xeropan may unilaterally, without the amendment or modification of this DAP modify or update its technical and organisational measures from time to time, provided that such modifications do not materially reduce the overall level of protection afforded to Personal Data, which shall not be interpreted as a breach of this DPA.
6.5. In assessing the appropriateness of the technical and organisational measures, the Parties shall take into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of the Processing, and the risks of varying likelihood and severity to the rights and freedoms of natural persons, in accordance with Article 32 of the GDPR. The Controller hereby accepts the technical and organisational measures set forth herein (including Annex 2) as sufficient.
7. Subprocessors
7.1. The Controller hereby grants Xeropan a general authorisation to engage Subprocessors in connection with the performance of this DPA.
7.2. Xeropan shall engage only those Subprocessors that provide sufficient guarantees to implement appropriate technical and organisational measures and to process Personal Data in compliance with the requirements of the GDPR.
7.3. The current list of authorised Subprocessors is set out in Annex 3.
7.4. Xeropan may update Annex 3 from time to time to add, replace, or remove Subprocessors where reasonably necessary for the provision of the Services and the Platform.
7.5. Xeropan shall provide prior notice to the Controller of any material changes to its Subprocessor arrangements.
7.6. Where the Controller raises a reasonable and documented objection on data protection grounds to a proposed Subprocessor, the Parties shall engage in good-faith discussions to seek a mutually acceptable resolution.
7.7. Xeropan shall remain fully liable for the performance of its Subprocessors' data processing obligations to the same extent as if the relevant Processing Activities were performed directly by Xeropan.
7.8. The Processor shall provide at least thirty (30) days prior notice before appointing a new Subprocessor.
7.9. Where the Controller raises reasonable objections and the Parties cannot resolve such objections in good faith, the Controller may terminate the Agreement without penalty.
8. International data transfers
8.1. Xeropan shall primarily process Personal Data within the European Economic Area ("EEA").
8.2. Where any Processing Activity involves the transfer of Personal Data outside the EEA or access to Personal Data from a jurisdiction outside the EEA, Xeropan shall ensure that such transfer or access is carried out only in accordance with Chapter V of the GDPR and subject to an adequacy decision adopted by the European Commission pursuant to Article 45 of the GDPR and/or appropriate safeguards.
8.3. Such safeguards may include, without limitation:
a) the Standard Contractual Clauses adopted by the European Commission pursuant to Article 46 of the GDPR;
b) any other transfer mechanism expressly permitted under Chapter V. of the GDPR.
8.4. Details of applicable international transfers and transfer safeguards are set out in Annex 4.
9. Assistance with data subject rights requests
9.1. Taking into account the nature of the Processing, Xeropan shall assist the Controller through appropriate technical and organisational measures in fulfilling its obligations to respond to requests from Data Subjects exercising their rights under the GDPR.
9.2. Where Xeropan receives a request directly from a Data Subject relating to the exercise of rights under the GDPR, Xeropan shall promptly forward such request to the Controller without undue delay.
9.3. Unless required by applicable law or expressly instructed in writing by the Controller, Xeropan shall not respond directly to any Data Subject request.
9.4. For the purposes of this Section, Data Subject rights include, without limitation:
a) the right of access;
b) the right to rectification;
c) the right to erasure;
d) the right to restriction of processing;
e) the right to data portability (if applicable); and
f) the right to object.
9.5. The Controller may use Annex 7 as the basis for providing privacy information to Data Subjects, provided that such use is appropriate for the relevant Processing and complies with applicable legal requirements.
10. Communication Preferences
10.1. Where instructed by the Controller, Xeropan may collect, store and maintain records of optional communication preferences expressed by Data Subjects.
10.2. Xeropan shall process such communication preference records solely on behalf of the Controller and only for the purposes specified by the Controller.
10.3. Xeropan shall not use communication preferences for its own independent marketing purposes.
10.4. The Controller remains solely responsible for determining:
a) whether consent is required;
b) the legal basis for communication;
c) which categories of Data Subjects are eligible to provide consent;
d) the wording of any consent request.[1] [2]
11. Data Protection impact assessments and regulatory cooperation
11.1. Taking into account the nature of the Processing and the information available to it, Xeropan shall provide reasonable assistance to the Controller in connection with the preparation and completion of any Data Protection Impact Assessment ("DPIA") required under the GDPR.
11.2. Upon request, Xeropan shall make available to the Controller such information as is reasonably necessary for the performance of a DPIA and is available to Xeropan.
11.3. If a supervisory authority requests information from Xeropan in relation to Processing carried out through or in connection with the Platform and Services, Xeropan shall inform the Controller without undue delay, unless prohibited from doing so by applicable law.
11.4. The Parties shall cooperate in good faith with one another in connection with investigations, inquiries, audits, or other proceedings conducted by competent supervisory authorities relating to the Processing of Personal Data under this DPA.
11.5. Xeropan shall provide the appropriate and necessary support and information to the Controller for the purpose of mandatory prior consultation (as set forth in in Article 36 of the GDPR), upon written request of the Institution, within reasonable time.
12. Security incidents
12.1. Xeropan shall maintain and operate appropriate incident management procedures designed to identify, investigate, respond to, and remediate Security Incidents.
12.2. In the event that Xeropan becomes aware of a Security Incident affecting Personal Data processed under this DPA, Xeropan shall notify the Controller without undue delay.
12.3. Processor shall notify Controller without undue delay and in any event within forty-eight (48) hours after becoming aware of a Security Incident.
12.4. To the extent information is available at the time of notification, such notice shall include:
a) a description of the nature of the Security Incident;
b) the categories of Personal Data affected;
c) the categories or approximate number of affected Data Subjects, where known;
d) the likely consequences of the Security Incident; and
e) the measures taken or proposed to address and mitigate the Security Incident.
12.5. Where all relevant information cannot reasonably be provided at the same time, Xeropan may provide such information in phases as it becomes available.
12.6. Xeropan shall provide reasonable cooperation and assistance to enable the Controller to comply with its obligations under Articles 33 and 34 of the GDPR.
13. AI-related Processing provisions
13.1. Certain features of the Platform and Services operate through the use of Artificial Intelligence ("AI") technologies.
13.2. Any Processing required for the operation of such AI-enabled features shall be carried out by Xeropan solely on behalf of and in accordance with the documented instructions of the Controller.
13.3. The categories of Personal Data processed in connection with AI-enabled features and the corresponding purposes of Processing are set out in Annex 5.
13.4. Unless otherwise expressly provided in this DPA, Xeropan shall not use Personal Data made available by the Controller for the training, development, or fine-tuning of Xeropan's own AI models.
13.5. Xeropan shall ensure that all AI-related Processing are carried out in accordance with this DPA, Annex 5, and all applicable Data Protection Laws.
13.6. Xeropan seeks to operate AI-enabled functionalities in accordance with applicable provisions of the European Union Artificial Intelligence Act and related transparency obligations.
13.7. The Platform’s AI-based features are not intended for users to provide Sensitive Data or other sensitive information.
13.8. The Controller is required to inform users that, when using AI features, they should avoid providing Sensitive Data whenever possible, including, in particular, health data, biometric data, and information regarding religious or philosophical beliefs, political opinions, or trade union membership.
13.9. If a user does provide such data while using AI features, it will be processed only to the extent necessary to handle the specific interaction, in accordance with the provisions of this DPA.
13.10. Xeropan does not use the personal data provided during such interactions to develop or fine-tune its own AI models.
14. Audit rights and demonstration of compliance
14.1. Upon reasonable request, Xeropan shall make available to the Controller such information as is reasonably necessary to demonstrate compliance with the obligations set out in Article 28 of the GDPR.
14.2. As the primary means of demonstrating compliance, Xeropan shall provide a documentation-based audit process, which may include, without limitation:
a) evidence of compliance with the provisions of this DPA;
b) descriptions of applicable technical and organisational measures;
c) security and compliance attestations;
d) relevant compliance reports and supporting documentation.
14.3. The Controller shall bear the costs of any audit unless the audit identifies a material breach of this DPA or a significant data protection deficiency attributable to Xeropan.
15. Return and deletion of personal data
15.1. Upon termination or expiration of this DPA or the ISA, Xeropan shall, at the Controller's election:
a) return the Personal Data to the Controller; or
b) delete the Personal Data.
15.2. The Controller may request the export of Personal Data by providing written notice within thirty (30) days following termination or expiration of the applicable agreement.
15.3. If the Controller does not provide instructions within the above period, Xeropan shall act in accordance with this DPA and the retention and deletion provisions set out in Annex 6.
15.4. Where technically feasible and reasonably practicable, Xeropan shall provide exportable Personal Data in a commonly used and machine-readable format.
15.5. Detailed retention, deletion, and backup procedures are set out in Annex 6.
15.6. Notwithstanding the foregoing, Xeropan may retain Personal Data to the extent required by applicable law, regulatory obligations, or legitimate backup and disaster recovery processes, provided that such retained data remains subject to the confidentiality and security obligations set out in this DPA.
16. Data retention
16.1. The retention periods applicable to Personal Data shall be determined by the Controller's instructions, the ISA, this DPA, and the provisions set out in Annex 6.
16.2. Xeropan shall not retain Personal Data for longer than is necessary to provide the Services and make the Platform available under this DPA, comply with documented instructions from the Controller, or satisfy applicable legal or regulatory obligations.
16.3. Detailed retention and deletion requirements are set out in Annex 6.
16.4. Following the expiry of the 30-day export period, Personal Data shall be permanently deleted within a maximum of 90 days, except where retention is required by applicable law.
16.5. Backup copies shall be deleted or overwritten in the ordinary backup cycle and no later than 360 days following deletion from production systems.
17. Liability
17.1. Liability arising from any breach of this DPA shall be governed by the GDPR, applicable Data Protection Laws, and the liability provisions set out in the ISA. To the extent not contrary to the GDPR or other, applicable and binding law, the liability of Xeropan under this DPA shall be limited in accordance with the ISA.
17.2. The Parties acknowledge that this DPA does not create a liability regime that departs from or limits any mandatory liability provisions imposed by the GDPR.
17.3. In the event of any inconsistency between the liability provisions of this DPA and those contained in the ISA, the mandatory provisions of the GDPR shall prevail with respect to matters relating to the Processing of Personal Data.
17.4. Nothing in this DPA shall be construed as excluding or limiting any liability that cannot be excluded or limited under applicable law.
18. Order of Precedence
18.1. In the event of any conflict between this DPA and any other agreement of the Parties, this DPA shall prevail with regards to Processing of Personal Data. In the event of any conflict between this DPA and any Annex, the provisions of this DPA shall prevail unless the relevant Annex expressly states that it is intended to supersede a specific provision of this DPA.
19. Final provisions
19.1. This DPA forms an integral part of the ISA.
19.2. This DPA shall automatically terminate upon the termination or expiration of the ISA, except for those provisions which, by their nature, are intended to survive termination, including but not limited to confidentiality, liability, audit, retention, deletion, and cooperation obligations.
19.3. No amendment or modification of this DPA shall be valid unless made in writing and agreed by the Parties.
19.4. This DPA shall be governed by and construed in accordance with the GDPR, and the laws of Hungary.
Annex 1. - Description of processing activities
1. Subject matter of the processing
In connection with the provision and operation of the Platform and Services, Xeropan processes Personal Data on behalf of the Institution.
The purpose of the Processing is to provide digital language learning services, support the learning process, facilitate institutional administration, and maintain the operation, security, and functionality of the Platform and the Services.
2. Categories of data subjects
2.1. The following categories of Data Subjects may be subject to Processing under this DPA.
2.2. Learners - Individuals designated by the Institution to access and use the Platform for educational purposes.
2.3. Teachers - Teachers, mentors, trainers, or other educational personnel designated by the Institution to support, monitor, or administer learning activities through the Platform.
2.4. Institutional administrators - Individuals authorised by the Institution to administer, configure, manage, or oversee the Institution's use of the Platform.
3. Minor users
3.1. The Platform may be used by Learners who are minors under applicable law, the Data Controller is responsible for ensuring that the legal basis, information, and—where applicable—the consent of their parents or legal guardians required for the use of the Platform and the related processing of personal data are in place.
3.2. Xeropan processes the personal data of minor Learners exclusively in accordance with the Data Controller’s documented instructions, for educational purposes, and in compliance with the data minimization, security, and confidentiality requirements set forth in this DPA.
3.3. As the Institution has the sole right and responsibility to assign User accounts and User rights to the Users, Xeropan does not conduct its own age verification and does not independently determine the legal basis for the processing of data pertaining to minor Learners.
4. Categories of personal data and purposes of processing
4.1. Learners
Category of Personal Data | Purpose of Processing |
Name | Identification |
Username | Account management |
Email address | Provision of access |
Institutional identifier | Institutional administration |
Group or class identifier | Educational organisation and management |
Language proficiency level | Learning support |
Learning progress data | Educational reporting and analytics |
Learning results and achievements | Educational assessment and reporting |
XP points | Tracking learning performance and engagement |
AI interactions | Provision of AI-enabled learning features |
Technical log data | Security, troubleshooting, and operation of the Platform |
IP address | Security, fraud prevention, and incident investigation |
Device information | Platform operation and technical support |
Communication consent status | Recording and management of communication preferences where instructed by the Controller |
Age category (18+/ under 18) or eligibility indicator provided by the institution | Determining eligibility for optional communication consent collection |
4.2. Teachers
Category of Personal Data | Purpose of Processing |
Name | Identification |
Email address | Provision of access |
Institutional identifier | Role and permission management |
Assigned classes or learner groups | Educational administration |
Reporting and analytics requests | Educational support and administration |
Login and access logs | Security and audit purposes |
Technical data | Operation and support of the Platform |
Communication consent status | Recording and management of communication preferences where instructed by the Controller |
4.3. Institutional Administrators
Category of Personal Data | Purpose of Processing |
Name | Identification |
Email address | Provision of access |
Permission level | Administration and access control |
Licence management data | Institutional administration and service management |
Reporting and analytics requests | Administrative oversight |
Audit and activity logs | Security and compliance |
Technical data | Platform operation and support |
5. Sensitive Data
5.1. The intended use of the Platform does not require the Processing of Sensitive Data.
5.2. Xeropan does not request, require, or intentionally collect such data as part of the ordinary operation of the Platform.
5.3. If Sensitive Data are uploaded, submitted, or otherwise made available through the Platform by the Institution or any User, the Controller shall remain primarily responsible for ensuring the lawfulness, necessity, and appropriate legal basis for such Processing.
5.4. Any such data shall be processed by Xeropan solely in accordance with the Controller's documented instructions and the terms of this DPA.
6. Purposes of processing
6.1. Personal data may be processed for the following purposes:
a) provision and operation of the Platform;
b) support of the learning process;
c) institutional administration;
d) user and permission management;
e) technical support and customer assistance;
f) information security and fraud prevention;
g) reporting and analytics;
h) operation of AI-enabled learning features; and
i) compliance with applicable legal and regulatory obligations.
j) management and recording of optional marketing communication preferences where the Controller has instructed Xeropan to collect such preferences;
k) enabling or disabling institution-approved communication workflows based on recorded communication preferences.[7] [8]
7. Communication preference records
7.1. Where the Controller instructs Xeropan to collect and manage communication preferences through the Platform, Xeropan shall maintain records of such communication preferences solely on behalf of the Controller.
7.2. To the extent technically feasible, each communication preference record shall include:
a) User identifier;
b) Institution identifier;
c) Date and time of the consent action;
d) Consent status (accepted, declined, or withdrawn);
e) Version of the communication preference text presented to the User;
f) Source of collection (e.g. Teacher Portal, Learner Portal, or other Institution-approved interface); and
g) Date and time of any subsequent withdrawal or modification of the communication;
7.3. Communication preference records shall be maintained solely for the purpose of demonstrating compliance with the Controller's documented instructions and applicable data protection laws.[9] [10]
Annex 2. - Technical and Organisational Measures (TOMs)
1. General principles
Xeropan implements and maintains appropriate technical and organisational measures designed to ensure the confidentiality, integrity, availability, and resilience of Personal Data and the systems used to process such data.
Such measures are regularly reviewed and updated, taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of the Processing, and the risks posed to the rights and freedoms of natural persons.
2. Access management
2.1. Access to Personal Data is granted on a need-to-know basis and is restricted to authorised personnel whose access is required for the performance of their duties.
2.2. Access rights are assigned and maintained in accordance with the principles of least privilege and functional necessity.
2.3. Xeropan applies Role-Based Access Control (RBAC) mechanisms to manage access permissions across its systems and services.
2.4. Access rights are reviewed periodically and updated when personnel responsibilities change or access is no longer required.
3. Authentication
3.1. The Platform and related systems implement authentication mechanisms designed to prevent unauthorised access.
3.2. User authentication processes are conducted through secure communication channels and are supported by industry-standard security controls.
3.3. Authentication credentials are managed in accordance with applicable security policies and best practices.
4. Encryption
4.1. Data transmitted between users, the Platform, and related services is protected using Transport Layer Security (TLS) encryption or equivalent secure communication protocols.
4.2. To protect Personal Data at rest, Xeropan implements appropriate storage-level encryption mechanisms and related safeguards designed to reduce the risk of unauthorised access to stored information.
5. Logging and monitoring
5.1. Xeropan maintains logs of relevant security, operational, and administrative events for security, troubleshooting, compliance, and operational purposes.
5.2. Access to log data is restricted to authorised personnel with a legitimate business need.
5.3. Logging and monitoring processes are designed to support incident detection, investigation, and response activities.
6. Backup and recovery
6.1. Xeropan performs regular backups of systems and data necessary to support business continuity and service recovery.
6.2. Backup procedures are designed to ensure the recoverability of critical systems and information in the event of accidental loss, corruption, or system failure.
6.3. Backup retention, storage, and deletion are managed in accordance with the retention requirements set out in Annex 6.
7. Incident management
7.1. Xeropan maintains a documented incident management process for the identification, assessment, containment, remediation, and resolution of Security Incidents.
7.2. Security events are investigated and managed in accordance with documented procedures designed to minimise the impact on Personal Data and service availability.
7.3. Incident response activities include escalation, documentation, corrective actions, and post-incident review where appropriate.
8. Vulnerability management
8.1. Xeropan performs periodic security assessments and vulnerability scanning activities designed to identify potential weaknesses in systems and applications.
8.2. Identified vulnerabilities are evaluated and prioritised based on risk, severity, exploitability, and potential impact.
8.3. Remediation activities are performed in accordance with internal risk management processes.
9. Penetration Testing
9.1. Xeropan conducts external security testing and technical security assessments designed to evaluate the security posture of the Platform.
9.2. In addition, Xeropan commissions independent external penetration testing at least annually to assess critical systems and identify material security weaknesses.
9.3. Findings from penetration testing activities are evaluated and addressed in accordance with Xeropan's risk management and remediation procedures.
10. Supplier and subprocessor controls
10.1. When selecting suppliers and Subprocessors, Xeropan considers the provider's data protection, information security, operational reliability, and compliance capabilities.
10.2. Subprocessors are subject to contractual obligations requiring the implementation of appropriate technical and organisational measures designed to protect Personal Data.
11. Review and improvement
11.1. Xeropan periodically reviews the effectiveness of its technical and organisational measures and may update, replace, or enhance such measures as necessary to address evolving security risks, regulatory requirements, technological developments, or operational needs.
11.2. Any such modifications shall not materially reduce the overall level of protection afforded to Personal Data.
Annex 3. - Authorised subprocessor
The Controller hereby authorises Xeropan to engage the following Subprocessors in connection with the provision of the Services and the Processing Activities described in this DPA.
Subprocessor | Location | Services Provided | Third-country Transfer Mechanism |
CodeYard Ltd. | Hungary | Software development and support services | No international transfer (EU) |
VENGIT Ltd. | Hungary | Server administration and IT consulting services | No international transfer (EU) |
Functional Software, Inc. (Sentry) | United States | Error monitoring and logging services | EU–US Data Privacy Framework (DPF) and, where required, SCC |
Hetzner Online GmbH | Germany | Hosting services | No international transfer (EU) |
Amazon Web Services EMEA SARL | Luxembourg | Cloud hosting and infrastructure services | No international transfer (EU-hosted services); SCC and/or DPF where applicable |
Digital Data Solutions B.V. (CookieFirst) | Netherlands | Cookie consent management services | No international transfer (EU) |
OpenAI Ireland Ltd. | Ireland | Artificial intelligence service provider | SCC and other safeguards as set out in OpenAI's Data Processing Addendum; DPF where applicable |
Ybug s.r.o. | Czech Republic | User issue reporting and bug reporting services | No international transfer (EU) |
Branch Metrics, Inc. | United States | Deep linking services | EU–US Data Privacy Framework (DPF) and, where required, SCC |
AssemblyAI, Inc. | United States | Speech recognition AI services | EU–US Data Privacy Framework (DPF) and, where required, SCC |
Google Cloud Platform (BigQuery) | EU (or configured Google Cloud region) | Cloud data warehouse and analytics platform | EU-U.S. Data Privacy Framework and/or SCCs, where applicable |
Google Cloud Platform (BigQuery) is used solely for the storage and analysis of operational, educational and institutional reporting data in accordance with the Controller's documented instructions. Personal Data processed through BigQuery shall not be used for advertising, behavioural profiling, remarketing, or any independent marketing purposes of Xeropan.
International transfer safeguards
For any transfer of personal data where the recipient is located outside the European Economic Area or where personal data may be accessed from there, Xeropan relies on the European Commission’s adequacy decisions, the EU–US Data Privacy Framework, Standard Contractual Clauses (SCCs) adopted by the European Commission, or other appropriate safeguards under Chapter V of the GDPR. If a particular data transfer mechanism ceases to be applicable, Xeropan will implement appropriate alternative safeguards to ensure the lawfulness of the data transfer.
Changes to Subprocessors
Xeropan may update this Annex from time to time to add, replace, or remove Subprocessors in accordance with the procedure set out in Section 7 (Subprocessors) of this DPA.
Annex 4. - International data transfers
1. General principles
Xeropan primarily uses infrastructure located within the European Union for the operation of the Platform.
Where the provision of the Services involves the transfer of Personal Data outside the European Economic Area ("EEA"), or access to Personal Data from outside the EEA, Xeropan shall ensure that appropriate safeguards are implemented in accordance with Chapter V of the GDPR.
2. Transfer mechanisms
2.1. Xeropan may rely on one or more of the following transfer mechanisms.
2.2. An adequacy decision adopted by the European Commission.
2.3. The Standard Contractual Clauses ("SCCs") approved by the European Commission.
2.4. Any other transfer mechanism expressly permitted under the GDPR.
2.5. Where a transfer mechanism becomes invalid or unavailable, the Parties agree that the applicable Standard Contractual Clauses shall apply automatically to the extent required.
2.6. If the European Commission’s adequacy decision does not apply to a particular recipient, Xeropan ensures the lawfulness of the data transfer by using the Standard Contractual Clauses (SCC) adopted by the European Commission or another data transfer mechanism that complies with Chapter V of the GDPR.
3. Documentation
3.1. Upon reasonable request, Xeropan shall provide information regarding the categories of transfer safeguards applied to Personal Data processed under this DPA.
4. Subprocessors
4.1. Details regarding international transfers may be included in the documentation relating to the Subprocessors identified in Annex 3., including applicable data processing agreements, transfer mechanisms, or other relevant compliance documentation.
Annex 5. - AI processing schedule
1. Purpose
This Annex governs the Processing Activities related to the Artificial Intelligence ("AI") features of the Platform.
2. AI features
2.1. The Platform may use AI technologies in connection with:
a) language speaking practice;
b) communication skills development;
c) feedback generation; and
d) interactive language learning activities.
3. Categories of personal data processed
The following categories of Personal Data may be processed in connection with AI-enabled features:
3.1. Learners:
a) text inputs;
b) speech-based interactions;
c) language responses; and
d) learning-context data.
3.2. Teachers:
a) inputs submitted through AI-enabled features; and
b) educational-context data.
Users shall not submit special category personal data when using AI-powered features.
Xeropan implements reasonable technical and organizational measures designed to reduce the likelihood of special category data being intentionally collected.
If such data is submitted by a user, the Controller remains responsible for determining the legal basis for such processing.
4. Purpose of processing
4.1. Personal Data processed through AI-enabled features is used solely for:
e) supporting the learning experience;
f) providing language-related feedback;
g) developing communication skills; and
h) supporting educational activities.
5. Automated decision-making
5.1. The Platform's AI-enabled features are not used as the sole basis for automated decision-making within the meaning of Article 22 of the GDPR.
5.2. AI-generated outputs do not constitute official grades, academic assessments, examination results, or educational certifications.
6. Minor users
6.1. The Platform may be used by Learners who are minors under applicable law.
6.2. AI-enabled features are designed to support language learning, communication skills development, and educational activities and are not intended to replace the supervision, guidance, or professional judgment of Teachers, educational staff, parents, or legal guardians.
6.3. AI-generated outputs should be reviewed in the educational context and may contain inaccuracies, incomplete information, or inappropriate responses despite implemented safeguards.
6.4. The Controller remains responsible for determining whether the use of AI-enabled features is appropriate for its Learners and for providing any required information, supervision, parental notices, or consents required under applicable law.
7. AI Model development
7.1. Unless otherwise expressly agreed, Xeropan shall not use Personal Data made available by the Controller for the training, development, or fine-tuning of its own AI models.
7.2. Where Xeropan uses third-party AI services, such services shall be used solely for the provision of AI-enabled Platform features.
7.3. Users shall not submit Sensitive Data or other sensitive information when using AI-enabled features (or otherwise).
7.4. Personal Data Processed through OpenAI-powered features is not used for the development or training of AI models owned by Xeropan.
7.5. Xeropan uses OpenAI services only to the extent necessary to provide AI-enabled educational features.
7.6. The processing of Personal Data by OpenAI is governed by OpenAI's Data Processing Addendum and related privacy documentation.
8. Third-party AI providers
8.1. Xeropan may engage third-party AI service providers in connection with the operation of the Platform.
8.2. Such providers shall be treated as Subprocessors and shall be subject to the applicable provisions of this DPA.
Annex 6. - Data retention schedule
1. General principles
Xeropan shall retain Personal Data only for as long as necessary to provide the Services or to comply with applicable legal and regulatory obligations.
2. Active subscription period
During the term of the applicable subscription or service agreement, Personal Data shall be processed and retained to the extent necessary for the operation of the Platform and the provision of the Services.
3. Termination of the agreement
3.1. Following termination or expiration of the ISA, the Institution may request the export of Personal Data.
3.2. Unless otherwise agreed by the Parties, the standard export period shall be thirty (30) days following termination.
4. Deletion
4.1. Following the expiration of the export period, Xeropan shall delete the relevant Personal Data within sixty (90) days, unless retention is required by applicable law or this DPA.
5. Backups
5.1. Personal Data contained in backup systems shall be overwritten or deleted in accordance with normal backup retention cycles.
5.2. Backup processing is maintained solely for business continuity, disaster recovery, and service restoration purposes.
5.3. Backup retention periods may extend for up to three hundred sixty (360) days.
6. Legal retention requirements
6.1. Notwithstanding the foregoing, Xeropan may retain Personal Data where and to the extent required by applicable law, regulatory requirements, or governmental authority.
Annex 7. - Student privacy statement
1. Purpose of this notice
1.1. This Annex contains only a summary of the general privacy notice related to the use of the Platform and Service of Xeropan. This Annex 7 is for informational purposes only and shall be adjusted to the specific context of the Personal data Processing.
1.2. The Institution, as the Controller, is responsible for ensuring that data subjects have access to the comprehensive privacy notice required by Articles 13 and 14 of the GDPR.
1.3. The Institution may use the content of this Annex when preparing or supplementing its own privacy notice; however, it is required to supplement it as necessary in accordance with the specific characteristics of the relevant data processing activity.
1.4. This Privacy Summary does not replace any privacy notice provided by the Institution and should be read together with the Institution's own privacy information.
1.5. This Privacy Summary is intended as a template and supplementary information only. The Institution, acting as Controller, remains responsible for providing all information required under Articles 13 and 14 GDPR, including legal basis, retention periods, and transfer information.
1.6. The purpose of this Student Privacy Summary is to explain the key principles governing the Processing of Personal Data in connection with the Institution's use of the Xeropan Platform.
2. Who processes the data?
2.1. For institutional use of the Platform, the Institution acts as the Controller, as it determines the purposes and means of the Processing of Personal Data.
2.2. Xeropan acts as the Processor and operates the Platform on behalf of the Institution.
3. What data do we process?
3.1. The categories of Personal Data outlined in Annex 1 may be processed through the Platform.
4. Why do we process personal data?
4.1. Personal Data may be processed for the following purposes: providing access to and operation of the Platform; supporting the learning process; monitoring learning progress and outcomes; managing user accounts; maintaining system security; providing technical support; and operating AI-enabled educational features.
4.2. Where instructed by the Institution, the Platform may also record a learner's or teacher's communication preferences for optional informational or educational communications.[12] [13]
5. Who can access personal data?
5.1. Additional information regarding such providers and applicable transfer safeguards is available in Annexes 3–5 of this Agreement.
5.2. Personal Data is accessible only to individuals who require such access for legitimate educational, administrative, technical, or operational purposes.
5.3. Such persons may include: authorised Teachers designated by the Institution; Institutional Administrators; authorised Xeropan personnel; and approved Subprocessors engaged by Xeropan.
6. Do we use AI?
6.1. Yes.
6.2. AI-enabled features may be used to support: language practice; communication skills development; and learning feedback.
6.3. Please note that: AI does not replace Teachers or educational staff; AI-generated responses may be inaccurate or incomplete; and AI-generated outputs do not constitute official grades, academic assessments, or examination results.
7. International Transfers and AI Services
7.1. Certain features may involve processing by third-party service providers acting as subprocessors of Xeropan. Additional information regarding such providers and applicable transfer safeguards is available in Annexes 3–5 of this Agreement.
8. What rights do data subjects have?
8.1. Subject to applicable law, Data Subjects have the right to: right to information and access to the Personal Data processed, right to rectify data, right to data erasure, right to restriction of processing, right to data retention, right to object, right to object automated decision-making in individual cases, including profiling, right to withdraw consent.
8.2. As the Institution acts as the Controller, requests relating to Data Subject rights should generally be submitted to the Institution in the first instance.
8.3. Where communication preferences are processed on the basis of consent, Data Subjects may withdraw such consent at any time through the mechanisms made available by the Institution or Xeropan.[14] [15]
9. Contact information
9.1. Questions relating to this Privacy Summary or the Processing of Personal Data may be directed to the Institution or Xeropan's privacy contact.
9.2. Contact: info.en@xeropan.com