Legal

Data Processing Addendum

A DPA only becomes relevant if organisations, such as an employer or a settlement agency, enrol candidates with Français Prep and remain the controller of their personal data. For individual learners buying a course directly, the Privacy Policy is the operative document.

Points this must cover

• -Whether a DPA is needed at all, which depends on organisations enrolling candidates on their behalf
• -Who is controller and who is processor for each category of data
• -The subject matter, duration, nature and purpose of the processing
• -Sub-processors, and how changes to that list are notified
• -Security measures, and the breach-notification timeline
• -Transfer mechanism and standard contractual clauses where applicable
• -Audit rights, and deletion or return of data at the end of the engagement

TODO_ADELE: registered business name, postal address, governing jurisdiction, and contact details.