Data Processing Agreement

The processor is Paul Danci, trading as ISO 26262 Academy, Am Feger 3, 71063 Sindelfingen, Germany (“Academy” or “Processor”). The controller is the organisation identified in the execution copy or order (“Customer” or “Controller”).

This agreement governs personal data processed by the Academy on the Customer's behalf in a team workspace. The Academy remains an independent controller for its own billing, legal, security and direct customer-relationship records, as explained in the Privacy Policy.

It takes effect when signed by both parties or when an order expressly incorporates the execution copy, and continues while the Academy processes personal data on the Customer's behalf.

Subject matter and purpose. Providing and supporting the online training platform, including accounts, learning records, assessments, certificates, workspace administration, reporting, security and customer-configured integrations.

Nature. Collection, recording, organisation, storage, retrieval, consultation, use, transmission to authorised providers or Customer-selected systems, restriction, export and deletion.

Duration. The subscription term plus the deletion, return and retention periods described below.

The Processor will process personal data only on documented instructions from the Controller, including for transfers to a third country, unless Union or Member State law requires otherwise. Where legally permitted, the Processor will inform the Controller of that requirement before processing.

This agreement, the order, the Customer's workspace settings and written directions from authorised Customer contacts form the documented instructions. The Processor will inform the Controller if it believes an instruction infringes applicable data protection law.

The Controller grants general written authorisation for the subprocessors listed in the schedule supplied before execution. The schedule identifies each provider, location, function, relevant data and transfer basis. It is available to current and prospective customers on request.

The Processor will give at least 30 days' prior notice of an intended addition or replacement. The Controller may object on reasonable data-protection grounds during that period. If the parties cannot resolve the objection, the Controller may terminate the affected service and receive a pro-rata refund of prepaid fees for the unused period.

Each subprocessor is bound by data-protection obligations no less protective than those applicable to the relevant processing under this agreement. The Processor remains responsible for its subprocessors' performance as required by Article 28.

The primary service infrastructure is located in the European Union. Some specialised subprocessors may process limited personal data outside the EEA.

A restricted transfer will take place only on documented instructions and under an applicable adequacy decision, the EU-US Data Privacy Framework for a participating provider, or Standard Contractual Clauses with any necessary supplementary measures. Provider-specific information is in the execution schedule.

At the end of the service, the Processor will, at the Controller's choice, return or delete personal data and delete existing copies unless applicable law requires retention. Data may remain in protected backups until overwritten in the ordinary backup cycle; restored data remains subject to the deletion instruction.

• Account data: while the account is active and thereafter only as needed for closure, disputes or legal obligations
• Learning records and certificates: for the subscription term and generally up to three years afterwards for continuity and verification
• Billing and tax records: for the statutory retention period, which may be up to ten years
• Support and business communications: generally up to three years
• Short-lived interaction diagnostics: up to 30 days
• Operational error and security records: generally up to 90 days, unless an incident requires longer preservation
• Backups: until overwritten in the ordinary backup cycle

The Processor will make available information reasonably necessary to demonstrate compliance with Article 28 and will allow for and contribute to audits by the Controller or its mandated independent auditor.

Unless a supervisory authority or a breach requires otherwise, audits require reasonable advance notice, must protect other customers' data and confidential information, occur during normal business hours and avoid unreasonable disruption. The parties may agree to satisfy a request first through documentation, a security questionnaire and a remote review.

This agreement ends when the Processor no longer processes personal data on the Controller's behalf. If it conflicts with another agreement between the parties on data-protection matters, this agreement prevails.

It is governed by German law. For business customers, the competent courts agreed in the applicable order or Terms of Service have jurisdiction, subject to mandatory law.