This Data Processing Agreement ("DPA") forms part of the agreement between Hamilton Consulting LLC("Processor" or "we") and the entity or individual agreeing to these terms ("Controller" or "you"), governing the processing of personal data in connection with the Edura platform (https://www.getedura.com).

This DPA is designed to comply with Article 28 of the General Data Protection Regulation (GDPR) (EU) 2016/679 and applies when Edura processes personal data on behalf of organizations (e.g., educational institutions, employers) that use our platform for their members or students.

Self-serve DPA request

Organizations that need a signed DPA can prepare a request packet here. The form opens a pre-filled email to our team with the details needed for review, signature routing, and any security questionnaire follow-up.

Loading DPA request form...

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person as defined under GDPR.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
• "Data Subject" means the individual whose Personal Data is being processed.
• "Sub-processor" means a third party engaged by Edura to process Personal Data on behalf of the Controller.

2. Roles and Responsibilities

2.1 Controller

The Controller determines the purposes and means of processing Personal Data. When an organization uses Edura for its members or students, the organization acts as the Controller.

2.2 Processor

Hamilton Consulting LLC acts as the Processor, processing Personal Data only on documented instructions from the Controller, unless required to do so by applicable law.

3. Data Processing Details

3.1 Types of Personal Data

• Account information (name, email, profile image)
• Educational profile data (school, grade, interests)
• User-generated content (comments, reviews, blog posts)
• AI conversation history
• Usage and interaction data
• Payment data (processed by Stripe)

3.2 Categories of Data Subjects

• Students (aged 16+)
• Educators and administrators
• Parents and guardians
• Professionals

3.3 Purpose of Processing

Personal Data is processed to provide the Edura platform services, including account management, personalized recommendations, AI-powered assistance, and communication.

4. Sub-processors

The Controller authorizes Edura to engage the subprocessors listed in our public Subprocessors register. The current list is summarized below.

We will notify the Controller before adding or replacing sub-processors. The Controller may object to a new sub-processor within 30 days of notification. If the objection is not resolved, either party may terminate the agreement.

5. Data Security

We implement appropriate technical and organizational measures to protect Personal Data, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Row-level security (RLS) policies on our database to ensure data isolation
• Authentication and access controls via Supabase
• Regular security reviews and monitoring
• Employee access limited to need-to-know basis
• Sentry session replay data with sensitive fields masked

6. Data Breach Notification

In the event of a Personal Data breach, we will:

• Notify the Controller without undue delay, and in any event within 72 hours of becoming aware of the breach
• Provide all information reasonably necessary for the Controller to fulfill its breach notification obligations under GDPR Article 33
• Take immediate steps to contain and remediate the breach
• Document the breach, its effects, and remedial actions taken

7. Data Subject Rights

We will assist the Controller in responding to Data Subject requests to exercise their rights under GDPR, including:

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)

We will respond to Controller requests regarding Data Subject rights within 10 business days.

8. Data Deletion and Return

Upon termination of the agreement or upon the Controller's request:

• We will delete or return all Personal Data within 30 days
• We will delete all existing copies unless retention is required by applicable law
• We will provide written confirmation of deletion upon request

9. International Data Transfers

Edura and its sub-processors primarily process data in the United States. For transfers of Personal Data from the EU/EEA to the United States, we rely on:

• Standard Contractual Clauses (SCCs) as adopted by the European Commission
• Sub-processor certifications under applicable data transfer frameworks

We will ensure that any transfer of Personal Data to a third country is subject to appropriate safeguards as required by GDPR Chapter V.

10. Audits

We will make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller. Audit requests must be submitted with at least 30 days' notice.

11. Duration and Termination

This DPA remains in effect for the duration of the Controller's use of Edura. Obligations regarding data deletion, confidentiality, and compliance survive termination.

12. Related Documents

• Privacy Policy
• Terms of Service

13. Contact Us

For questions about this DPA or to exercise data protection rights, contact us:

• Email: support@getedura.com
• Mail: Adam Hamilton