Data Processing Addendum

This addendum applies when AdaptLearn processes personal data on behalf of a school, team, or other organisation (the “customer”) that uses AdaptLearn for its learners or staff. For that customer data, the customer is the controller and AdaptLearn is the processor.

When an individual creates an account, joins a public community, or uses AdaptLearn outside a customer’s instructions, AdaptLearn is the controller for that processing, and our Privacy Policy applies. Customers must not direct learners to share sensitive or regulated information in a general community unless we have agreed that use in writing.

AdaptLearn processes customer personal data only to provide the service the customer has subscribed to, to support its learners and staff, to keep the platform secure, and to follow the customer’s documented instructions. We do not sell customer personal data or use it for advertising. If the law requires us to process customer data in any other way, we tell the customer before doing so unless the law prohibits it.

The personal data we process for customers covers account details, profile preferences, learning records, tutor conversations, assessment results, support records, billing and subscription records, seat assignments, community memberships and roles, messages and reactions, join requests, invite email addresses, read status, blocks, bans, reports, and moderation records.

The people this data relates to are learners, parents and guardians, teachers and staff, community members and moderators, administrators, invitees, people who make or are named in reports, and billing contacts. AdaptLearn never stores full payment card numbers or card security codes.

AdaptLearn maintains technical and organisational measures appropriate to the risk of the processing, including:

• encryption of data in transit and at rest;
• role based access control, with access limited to people who need it to run the service;
• mandatory two factor authentication for administrators;
• audit logging and continuous security monitoring;
• confidentiality obligations for everyone with access;
• verified payment processing and abuse controls; and
• backup and recovery procedures.

More detail is on our Security page.

AdaptLearn uses carefully selected subprocessors for cloud hosting, databases, learning content generation, payments, email delivery, analytics, realtime messaging, and support. Each subprocessor is bound by written terms that require confidentiality, security, and lawful handling at least as protective as this addendum, and we remain responsible for their performance.

Payments are handled by our payment provider inside its own certified card environment. AdaptLearn receives only the payment and subscription details needed for billing, fraud prevention, support, and audit. The current list of subprocessors is available on request from privacy@atadaptlearn.co, and we give customers notice before adding or replacing a subprocessor so they can raise any objection.

Some subprocessors process data outside the country where it was collected, including outside Nigeria. We make these transfers only where the Nigeria Data Protection Act 2023 and other applicable laws allow them: to countries with adequate protection, or under appropriate safeguards such as binding contractual terms with each subprocessor.

AdaptLearn helps customers respond to requests from the people their data relates to, including access, correction, export, and deletion requests, and gives customers the information they reasonably need to show compliance with their own obligations.

If we become aware of a personal data breach affecting customer data, we notify the customer without undue delay, describe what happened and what data is involved, and work with the customer on containment and any notices the law requires.

Community messages are kept for up to 180 days. When an owner deletes a community, it stays available for a 72 hour grace period and is then removed with its associated records. Safety reports, ban records, security logs, and transaction history are kept for longer where the law, fraud and abuse prevention, or dispute resolution requires it. At the end of the service, we return or delete customer personal data as the customer chooses, except where the law requires us to keep it.

This addendum forms part of the AdaptLearn Terms and Conditions and applies automatically to every customer, with no separate signature needed. If a customer has signed a separate data processing agreement with AdaptLearn, that agreement takes precedence where the two differ.

Customers who need a countersigned copy of this addendum, or who want to discuss their own data processing terms, can contact privacy@atadaptlearn.co.