Data processing agreement (DPA)

The Customer is the controller of the personal data of the people it enrols and of the progress reports it receives. OryGent Academy processes that data only on the Customer's documented instructions, which are these Terms, this agreement and the settings the Customer chooses in the platform.

For learners who buy a program themselves, OryGent Academy is the controller (see the Privacy policy).

Subject matter: delivering online AI programs, assessing evidence and issuing verifiable credentials to the Customer's learners.

Nature: hosting, storage, AI-assisted assessment and tutoring, credential signing, support.

Duration: for as long as the Customer has active enrolments, then until deletion or return under section 8.

Data subjects: the Customer's employees, students, members and administrators.

Categories: identification and contact data (name, email), account and access logs, enrolment and progress data, evidence files and statements, viva answers, deployment links, messages with AI tutors and mentors, credential records.

No special categories of data are required. The Customer instructs learners not to upload them in evidence.

Process personal data only on documented instructions, and inform the Customer if an instruction appears to breach data protection law.

Ensure that everyone authorised to process the data is bound by confidentiality.

Apply the security measures in section 5 and keep them up to date.

Assist the Customer with data subject requests, impact assessments and consultations with supervisory authorities, taking into account the nature of the processing.

Encryption in transit (TLS, HSTS) and at rest by our hosting providers.

Row-level access control in the database: each learner sees only their own records; organisation administrators see only their organisation's.

Least-privilege service keys held on the server only; no secrets in the browser.

Evidence files fingerprinted (SHA-256) on upload; credentials digitally signed and sealed with VeriChain.

Audit logs for assessments, AI replies that were blocked by the integrity check, reviews and administrative actions.

Rate limits on public and AI endpoints; payment data handled only by Stripe.

The Customer authorises the sub-processors listed in the Privacy policy: Supabase (database, authentication and storage, EU region), Vercel (hosting), Stripe (payments), Resend (email), Railway (AI gateway hosting), and OpenAI, Anthropic and Google (AI models).

We give at least 30 days' notice by email to the Customer's administrator before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds by writing to info@orygent.net; if we cannot address the objection, the Customer may terminate the affected enrolments and receive a pro-rata refund.

Transfers outside the European Economic Area rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

We notify the Customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting its data, with the information available at the time and updates as we learn more.

When the Customer's enrolments end, we delete or return the Customer's personal data within 30 days, at its choice, unless the law requires us to keep it. Credential records remain available for verification, as they belong to the credential holder.

The Customer may request the information needed to demonstrate compliance with this agreement, and may carry out an audit once a year with 30 days' written notice to info@orygent.net, at its own cost and without access to other customers' data.

This agreement is governed by Spanish law and the GDPR. Where it conflicts with the Terms on data protection, this agreement prevails.