Data Processing Addendum (DPA)

Last Updated: January 2025

This Data Processing Addendum ("DPA") supplements the Terms of Service between Eduhub Solutions LLC ("Processor") and Customer ("Controller").

1. Definitions

• Personal Data: Any information relating to an identified or identifiable natural person

• Processing: Any operation performed on Personal Data

• Sub-processor: Any third party engaged by Processor to process Personal Data

2. Processing of Personal Data

• Processor shall process Personal Data only on documented instructions from Controller

• Processor shall ensure persons authorized to process Personal Data are bound by confidentiality

• Processor shall implement appropriate technical and organizational security measures

3. Sub-processors

Current sub-processors include:

• Stripe: Payment processing (USA)

• Amazon Web Services: Cloud hosting (Global)

• Google Analytics: Usage analytics (USA)

• Cloudflare: CDN and security (Global)

• SendGrid: Transactional email (USA)

Controller consents to these sub-processors. Processor shall notify Controller of any changes to sub-processors.

4. Security Measures

Processor implements industry-standard security including:

• Encryption in transit (TLS 1.2+)

• Encryption at rest (AES-256)

• Access controls and authentication

• Regular security audits

• Incident response procedures

5. Data Subject Rights

Processor shall assist Controller in responding to data subject requests including:

• Access to personal data

• Rectification or erasure

• Data portability

• Objection to processing

6. International Transfers

Where Personal Data is transferred outside the EEA, Processor shall ensure appropriate safeguards through:

• Standard Contractual Clauses

• Adequacy decisions

• Other approved mechanisms

7. Audit Rights

Controller may audit Processor's compliance with this DPA upon reasonable notice, not more than once per year.

8. Data Breach Notification

Processor shall notify Controller without undue delay upon becoming aware of a personal data breach.

9. Deletion and Return

Upon termination, Processor shall delete or return all Personal Data as instructed by Controller.

10. Liability

Liability shall be governed by the Terms of Service limitation of liability provisions.

11. Contact

For DPA inquiries: privacy@eduhubsolutions.io