Data processing agreement (DPA)

Last updated: 2026-09-03.

1. Parties and subject

Controller: the customer (academy or company) identified in its subscription. Processor: Codelabs Studio, S.L. (Tax ID B88708797), Málaga, España. [email protected]. https://learnsuite.pro. This agreement under article 28 GDPR governs the processing the processor performs on behalf of the controller to provide the training platform.

2. Nature and purpose

Hosting and publishing courses, learner account management, progress and assessment, certificate issuance, zone-based billing and territorial licence enforcement, conversational tutor, transactional communications.

3. Data and categories

The controller's learners and instructors: identification and contact, credentials, progress, payment data (processed by Stripe), territorial licence signals (IP, country, device, phone), identity verification result where applicable, instructor voice and likeness with consent.

4. Processor obligations

Process only on documented instructions; ensure staff confidentiality; apply technical and organisational measures (encryption in transit and at rest, role-based access control, access logging, daily backups, EU hosting); assist the controller with data subject rights and impact assessments; notify security breaches within 48 hours; delete or return the data at the end of the service (30 days) and erase copies unless legally required.

5. Sub-processors

The controller authorises the sub-processors listed on the Sub-processors page. The processor gives 30 days' notice of any change and the controller may object.

6. International transfers

Only under the European Commission's standard contractual clauses or an adequacy decision, with the necessary supplementary measures.

7. Audit

Once a year the controller may request the information needed to demonstrate compliance and conduct audits with reasonable notice.

8. Duration

That of the service contract. Confidentiality obligations survive termination.