Data Processing Agreement (DPA)

1. Parties and acceptance

This agreement is entered into between the academy that creates an account on Acatudy (“the Academy”, the controller) and Fragua Labs LLC, with its address at 30 N Gould St Ste N, Sheridan, WY 82801, USA (“Acatudy”, the processor).

It is part of the Terms and Conditions and is accepted when the academy is created, in the same checkbox as the terms. If the Academy needs a signed copy, it can request one at legal@acatudy.com.

2. Subject matter and details of processing

• Subject matter and purpose: providing the Academy with the Acatudy platform (courses, exams, assignments, messages, public website, charges to students and AI assistants) and related support.
• Duration: for as long as the Academy uses the service and until the data is deleted under section 9.
• Nature of processing: hosting, storage, organization, retrieval, sending of communications, backup and deletion.
• Data subjects: students and, if they are minors, their parents or guardians; the Academy's teachers and staff; visitors to and contacts of its website.
• Types of data: identification and contact details; academic data (enrollments, progress, grades, submissions, certificates); messages; access logs and IP; data on charges to students (handled by Stripe) and any other data the Academy chooses to upload. The service is not designed for special categories of data: the Academy must not upload them unless it has a legal basis to do so.

3. The Academy's instructions

Acatudy processes the data only on the documented instructions of the Academy, which are this agreement, the terms and the settings the Academy configures on the platform, including with regard to international transfers, unless applicable law requires otherwise; in that case it will inform the Academy beforehand, if the law allows. If it believes an instruction infringes the law, it will notify the Academy.

4. Confidentiality and security

Acatudy personnel authorized to process the data are bound by confidentiality. Acatudy applies the technical and organizational measures in the security annex, appropriate to the risk under Article 32 GDPR, and may update them provided they do not reduce the level of protection.

5. Subprocessors

The Academy grants Acatudy general authorization to engage the subprocessors listed in this document. Acatudy will give at least 30 days' notice of any addition or replacement (by email to the owner or in the dashboard), and the Academy may object on reasonable data protection grounds; if no solution is found, it may cancel the subscription without penalty. Acatudy imposes on each subprocessor data protection obligations equivalent to those of this agreement and remains liable for their compliance.

6. Data subject rights and assistance

The platform allows the Academy to access, correct, export and delete its students' data. If a data subject contacts Acatudy directly, we will refer them to the Academy or forward their request without answering it ourselves. Acatudy will reasonably assist the Academy in meeting its obligations on security, impact assessments and prior consultations (Articles 32 to 36 GDPR).

7. Security breaches

Acatudy will notify the Academy, without undue delay and no later than 48 hours after becoming aware of it, of any security breach affecting its data, with the information available so that the Academy can notify the authority and the data subjects where required.

8. International transfers

Acatudy is established in the US. To the extent processing involves transfers of personal data subject to the GDPR from the European Economic Area to a country without an adequacy decision, the parties incorporate by reference the standard contractual clauses of Commission Implementing Decision (EU) 2021/914: Module 2 (controller to processor) between the Academy and Acatudy and Module 3 (processor to processor) with subprocessors, with the Clause 7 docking clause, Option 2 of Clause 9 (general authorization), without the optional Clause 11, and with the law and courts of Ireland for Clauses 17 and 18. For the United Kingdom the ICO International Data Transfer Addendum applies and, for Switzerland, the same clauses with the adaptations its law requires. With subprocessors certified under the EU-US Data Privacy Framework, that mechanism may also be used. In case of conflict, the standard contractual clauses prevail.

9. End of the agreement: return and deletion

While the account is open, the Academy can export its data from the dashboard. When the academy is closed, Acatudy deletes its personal data; backups and the file trash are overwritten within 31 days at most. Only what a law requires to be kept is retained, together with the minimal record of issued certificates described in the privacy policy.

Invoices: if the academy is not closed by its owner from the dashboard (for example, if it is closed for inactivity, non-payment or a breach), Acatudy keeps, for 7 years from the date of each invoice, the data of its invoices to the Academy and of the Academy’s charges to its students (amounts, taxes, dates, description and Stripe references, without the students’ names or emails), in a separate archive that only Acatudy can access, and then deletes it. If the owner closes it from the dashboard, this data is deleted too; Stripe keeps its own copy.

10. Information and audits

Acatudy will make available to the Academy the information needed to demonstrate compliance with this agreement and will allow reasonable audits, carried out by the Academy or by an independent auditor bound by confidentiality, with 30 days' notice, at most once a year except in case of a breach or a request from an authority, and without access to other customers' data. The parties will first try to resolve the matter with the documentation and questionnaires Acatudy provides.

11. The Academy's obligations

The Academy warrants that it has a legal basis for the data it uploads, that it informs its students through its own privacy policy and that, when it enrolls minors, it obtains the consent of their parent or guardian where the law requires it (for example, COPPA for children under 13 in the US).

12. US privacy laws

For data subject to the CCPA/CPRA and similar state laws, Acatudy acts as a “service provider” or “processor”: it does not sell or share that data, does not retain, use or disclose it outside the direct relationship with the Academy or for purposes other than providing the service, and does not combine it with data from other sources except as the law allows. If the Academy is subject to FERPA, Acatudy acts as a “school official” with a legitimate educational interest, under its direct control. Acatudy will notify the Academy if it can no longer meet these obligations.

13. Liability and precedence

Each party's liability is governed by the terms, without prejudice to any mandatory provisions of the applicable data protection law. As regards personal data, this agreement prevails over the terms.

Annex: security measures

• Encryption of communications (HTTPS/TLS) and passwords; files in encrypted storage, served through signed, time-limited links.
• Logical separation of each academy's data and role-based access controls.
• Acatudy team access limited to what is necessary, with mandatory two-step verification and logging of their activity.
• Daily off-server backups and tested restore procedures.
• Perimeter protection (WAF and bot verification), rate limits and regular security updates.

Annex: subprocessors

Contact

Questions about this agreement and data protection: legal@acatudy.com

Privacy Policy · Terms and Conditions