Lernoa Business Data Processing Addendum

1. About this addendum

1.1 This Data Processing Addendum ("DPA") forms part of the Lernoa Business Terms of Service (the "Terms") between Corvidae Limited, Auckland, New Zealand ("Lernoa", "we", "us") and the organisation that uses Lernoa Business ("you", "the customer"). It sets out how we process personal information for you when you use a workspace.

1.2 It applies to every customer automatically, from the moment you accept the Terms, a trial included. You do not need to sign or return anything: checkout says "By paying you accept the Lernoa Business Terms of Service and Data Processing Addendum", and signing up or starting a trial accepts them in the same way. If you want a countersigned copy for your records, email [email protected] and we will send one.

1.3 It covers the personal information in your content that we process on your behalf ("Customer Personal Data"). It does not cover personal information for which we are responsible ourselves, such as the contact and billing details of your administrators, enquiries and trial sign-ups, and how our website and service are used. Our Privacy Policy covers those.

1.4 It applies alongside the data protection law that applies to the processing: the New Zealand Privacy Act 2020 and, where they apply, the EU General Data Protection Regulation (Regulation (EU) 2016/679), the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection. If the law that applies to you needs a term this DPA does not contain, tell us.

1.5 If the Terms, this DPA and the standard contractual clauses conflict about personal data, the standard contractual clauses prevail over this DPA, and this DPA prevails over the Terms. A data processing agreement signed by both of us prevails over this DPA where it says so, except that the standard contractual clauses still prevail over both. Nothing in this DPA reduces a protection the Terms give you.

2. Words we use

• Applicable data protection law: the laws named in clause 1.4 that apply to Customer Personal Data.
• GDPR: the EU GDPR and the UK GDPR, and, where the context needs it, the Swiss Federal Act on Data Protection.
• Controller, processor, data subject, personal data breach, process and supervisory authority have the meanings they have in the GDPR. We use "personal information" and "personal data" to mean the same thing.
• Sub-processor: a third party we use that processes Customer Personal Data for us.
• SCCs: the standard contractual clauses in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
• UK Addendum: the International Data Transfer Addendum to the EU Standard Contractual Clauses, issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (version B1.0, in force from 21 March 2022, as revised).
• Restricted transfer: a transfer of Customer Personal Data that is subject to the GDPR to a country or recipient that the GDPR does not already treat as adequate.

Other words, such as "workspace", "administrators", "your content" and "service", mean what they mean in the Terms.

3. Roles and responsibilities

3.1 For Customer Personal Data you are the controller and we are your processor. If you process it for another organisation as that organisation's processor (for example, for a group company or a client), you are a processor and we are your sub-processor, and you confirm that the controller has authorised your instructions to us and our use of the sub-processors in clause 7.

3.2 You are responsible for: (a) having a lawful basis to put Customer Personal Data into the service; (b) telling your people how it is used, including that their employer sees their training status, scores, sign-offs and, if you turn personal focus on, their focus areas; (c) any consultation with your people or their representatives that the law requires; (d) deciding whether to turn personal focus on, and any impact assessment that decision needs; (e) not putting more personal information into the service than the training needs; and (f) the roles and permissions you give. Sections 14 and 18.2 of the Terms say the same.

3.3 Each of us will comply with the data protection law that applies to it in its role.

4. Instructions

4.1 We process Customer Personal Data only to provide, secure and support the service for you, on your documented instructions, and as the law requires. Your documented instructions are the Terms, this DPA, and the way you use the service and its settings (for example, uploading documents, assigning training, importing or removing people, exporting records and turning personal focus on or off). Your instructions include the transfers described in clause 8 and the use of the sub-processors in clause 7. If the law requires us to process it in another way, we tell you first unless the law forbids it.

4.2 Any other instruction needs both of us to agree in writing. If we think an instruction breaches data protection law, we tell you immediately, and we do not have to follow it until you confirm or change it.

4.3 We do not sell Customer Personal Data, we do not use it for advertising and we do not use it for our own purposes. We may make aggregated statistics about how the service is used and performs, as section 18.5 of the Terms says; they do not identify you or any person.

5. Confidentiality

Only named Lernoa staff can open a workspace, and only for the reasons in section 4.5 of the Terms. Everyone with access to Customer Personal Data is bound by confidentiality, and we do not give access to anyone who does not need it to provide or support the service.

6. Security

6.1 We use the technical and organisational measures in Annex II to protect Customer Personal Data.

6.2 We may change the measures as the service develops, as long as the overall level of protection does not fall.

6.3 You are responsible for security on your side, as section 19.2 of the Terms says. Single sign-on through your own identity provider (SAML) is not available yet.

7. Sub-processors

7.1 You give us general written authorisation to use the sub-processors on the list at /subprocessors/, which Annex III repeats.

7.2 At least 30 days before we add a sub-processor or replace one, we update that list and email the Owner of every workspace, saying who it is, what it will do and where it will run. If we have to replace one sooner than that, because it has become a security risk or has stopped providing the service, we tell you as soon as we can, and clause 7.3 applies from then.

7.3 You may object, on reasonable data protection grounds, by writing to us within those 30 days. We will work with you in good faith to resolve it. If we cannot, you may end the licence for the affected workspace by written notice, and we will refund the fees you paid in advance for the period after it ends, pro rata, and end any remaining instalments.

7.4 We have a written contract with each sub-processor that puts equivalent data protection obligations on it for the processing it does. We remain responsible to you for what our sub-processors do.

8. International transfers

8.1 Your content is stored in Auckland, New Zealand. Some processing happens elsewhere, as the sub-processor list shows.

8.2 Transfers to us in New Zealand. New Zealand has an adequacy decision from the European Commission (Decision 2013/65/EU) and is recognised by the United Kingdom and Switzerland. Where Customer Personal Data that is subject to the GDPR is transferred to us in New Zealand, we both rely on that.

8.3 Onward transfers. Our transfers to sub-processors rely on the safeguards the sub-processor list gives for each one: the EU-US Data Privacy Framework (and its UK Extension and the Swiss-US framework) where the provider is certified, and the provider's data processing terms, which incorporate the SCCs and the UK Addendum. For Amazon SES in Sydney, Australia, and for Zoho Mail in Australia, the provider's data processing terms with the SCCs are the safeguard.

8.4 The SCCs as a fallback. If an adequacy decision, regulation or recognition that covers New Zealand stops applying, is suspended or is found invalid, or does not cover a transfer, the SCCs apply to that transfer automatically, with nothing further for either of us to do, and are completed as follows (in this list, "Clause" with a capital C means a clause of the SCCs):

• Module Two (controller to processor) applies where you are a controller. Module Three (processor to processor) applies where you are a processor.
• Clause 7 (docking clause) is included.
• Clause 9(a): Option 2 (general written authorisation) applies, and the time period is 30 days, as in clause 7.
• Clause 11(a): the optional wording is not used.
• Clause 13(a): the competent supervisory authority is the one named in Annex I.C. If you are established in an EU member state, it is the authority of that state. If you are not established in the EU but the GDPR applies to you and you have appointed a representative, it is the authority of the member state where your representative is established. If you have not appointed one, it is the authority of a member state where the people whose data is transferred are located, which you tell us.
• Clause 17: Option 1 applies, and the SCCs are governed by the law of Ireland. Clause 18(b): the courts of Ireland.
• Annexes I, II and III of the SCCs are Annexes I, II and III of this DPA. The audits in Clause 8.9 are carried out as clause 12 describes, and the return or deletion in Clause 8.5 as clause 11 describes.

8.5 United Kingdom. For a transfer that is subject to the UK GDPR, the SCCs, completed as in clause 8.4, apply as amended by the UK Addendum, which is incorporated into this DPA and starts when you accept the Terms. In the UK Addendum, Table 1 (parties and start date) is as in Annex I and this clause, Table 2 (selected SCCs, modules and clauses) is as in clause 8.4, Table 3 (appendix information) is as in the Annexes, and in Table 4 neither party may end the UK Addendum when the approved addendum changes. For those transfers the Addendum's mandatory clauses apply: the Information Commissioner's Office is the competent supervisory authority, and the law and the courts of England and Wales replace those of Ireland in Clauses 17 and 18.

8.6 Switzerland. For a transfer that is subject to the Swiss Federal Act on Data Protection, the SCCs, completed as in clause 8.4, apply as adapted for Switzerland: references to the GDPR are to that Act; the competent supervisory authority is the Federal Data Protection and Information Commissioner where the transfer is subject only to that Act, and, where it is subject to both that Act and the GDPR, the Commissioner as to that Act and the authority under Clause 13 as to the GDPR; and the words "member state" are not read to stop data subjects in Switzerland from bringing a claim in their place of habitual residence, Switzerland.

8.7 Each of us is treated as having signed the SCCs and the UK Addendum when you accept the Terms. We will send a countersigned copy if you ask.

8.8 If a public authority asks us for Customer Personal Data, we handle the request as Clause 15 of the SCCs requires, whether or not the SCCs apply to the transfer: we tell you where we are allowed to, and we challenge a request where there are reasonable grounds to. Where the SCCs apply, we also keep the assessment of the laws that apply to us that Clause 14 requires, and give you a copy of it if you ask.

9. Helping you

9.1 People's requests. The service lets administrators export a person's records as a CSV file or a PDF, correct a person's details, mark people as having left and erase a person's personal data, so you can answer requests yourself. Training records belong to the workspace and stay when a person leaves (section 20.1 of the Terms). When an administrator chooses "Erase personal data" for a person, the person's name is replaced with a placeholder, and their contact details, notes, highlights, focus areas, questions, the text, images and IP addresses of their signatures, and their certificates are deleted. Anonymous completion figures stay, so the workspace's counts still add up. Erasure cannot be undone in the service, and it is for you, as controller, to check that no duty to keep the records applies before you use it. You do not need to ask us. If a person contacts us about Customer Personal Data, we tell them to contact you and let you know without undue delay. We do not respond to the request ourselves except to refer them, unless you tell us to or the law requires it.

9.2 Further help. Taking into account the nature of the processing and the information we hold, we help you with a person's request that you cannot answer using the service, with security, with breach notification, with data protection impact assessments and with prior consultation of a supervisory authority. Our UK and EU page sets out facts for an impact assessment. As section 18.3 of the Terms says, we do this within reason, and at your cost where the effort is significant.

9.3 If a supervisory authority contacts us about Customer Personal Data, we tell you unless we are not allowed to, and we cooperate with you and the authority as the law requires.

10. Personal data breaches

10.1 We tell you about a personal data breach affecting Customer Personal Data without undue delay, and within 48 hours of becoming aware of it. We email the workspace's Owner and billing contact.

10.2 The notice says what we know at that time: what happened, the kinds of Customer Personal Data and the approximate number of people and records affected where we know them, the likely consequences, and what we have done and will do about it, and who to contact for more information ([email protected]). We send updates as we learn more, and take reasonable steps to contain and fix the problem.

10.3 You decide whether to tell a supervisory authority or the people affected. We do not tell them ourselves unless the law requires it or you ask us to. A notice is not an admission of fault.

11. Return and deletion

11.1 While your workspace is open you can export your records as CSV files or per-person PDFs at any time, and an administrator can erase a person's personal data as clause 9.1 says. When the agreement ends you choose whether we return your data (you export it) or delete it. If you do not choose, we delete it as clauses 11.2 and 11.3 say.

11.2 When a licence ends, the workspace's records stay read-only and exportable for 12 months, and we email your administrators 30, 7 and 1 days before anything is deleted. A records plan, if you buy one, keeps certificates, acknowledgements and exports available for its term. You can ask us to delete your workspace sooner. A trial workspace's content is deleted 30 days after the trial ends, unless you buy a licence or ask us for an export first. These are the periods in sections 5.2 and 20 of the Terms.

11.3 After those periods a closed workspace is deleted automatically, on its deletion date, and sooner if you ask us to delete it: we delete Customer Personal Data from the live service, and the uploaded files from storage, with the workspace. Lernoa staff can also delete a Business account, or an enquiry you sent us through our website, on request. The Lernoa Business database is backed up once a day. Each backup is kept for 7 days on the server in Auckland and a copy for 14 days in Amazon S3 in Auckland, and the server's disks are also copied once a day, each copy kept for 7 days in Auckland. Restoring from a backup has been tested. Uploaded files are stored in Amazon S3 in Auckland and are not part of the database backups. Personal data we delete from the live service is gone from the backups within about 15 days, and until then we do not use the backups except to restore the service.

11.4 We may keep Customer Personal Data that the law requires us to keep, and only for as long as it requires. This DPA still protects it, and we do not process it for any other purpose.

11.5 If you ask, we certify in writing that we have deleted it.

12. Audits and information

12.1 We give you the information you reasonably need to check that we meet this DPA: this DPA, our Security page, the sub-processor list, written answers to your questions and answers to your security questionnaire.

12.2 We allow an on-site or third-party audit only where a supervisory authority requires it, or after a personal data breach that affected your Customer Personal Data. It is at your cost, at most once in any 12 months, on 30 days' written notice, with a scope we agree, and under confidentiality. It does not cover other customers' information, and it must not weaken the service's security.

12.3 This clause is how the audits in Clause 8.9 of the SCCs are carried out. Where the SCCs apply and Clause 8.9 gives you a right that clause 12.2 would limit, Clause 8.9 prevails, as clause 1.5 says.

13. AI features

13.1 We do not use Customer Personal Data to train AI models, and we do not let anyone else do so. Amazon Bedrock does not use the content sent through it to train models. For Amazon Polly, which receives chapter text only when an administrator turns narration on, we have opted out of AWS using content processed by its AI services to improve those services.

13.2 AI providers receive the text a task needs: document content, training text and, for Ask, the question a person types (we never tell the AI who asked). For personal focus, who receives a focus section is decided by a fixed rule on final assessment answers, not by AI, and no person's name or results are sent to AI.

13.3 AI drafts reach your people only after one of your administrators has reviewed and published them, as section 12.3 of the Terms says.

14. Liability, changes and general

14.1 Liability. Section 26 of the Terms applies to this DPA to the extent the law allows. It does not limit the rights data subjects have under data protection law or the SCCs, or any liability that cannot lawfully be limited.

14.2 Changes. Section 30 of the Terms applies to this DPA. A change that only adds to your protections applies from its effective date. We will not change this DPA or Annex II in a way that materially reduces the protection of Customer Personal Data during a licence term already started, except as section 30.2 of the Terms allows. We cannot change the SCCs or the UK Addendum; if the authorities issue new approved versions, the law decides how they apply.

14.3 How long it lasts. This DPA lasts as long as we process Customer Personal Data for you, including during the read-only period in clause 11.2. Clauses 11, 12 and 14 survive until the data is deleted.

14.4 Law. This DPA is governed by the law that governs the Terms, except that the SCCs, the UK Addendum and the Swiss adaptation are governed as clause 8 says.

14.5 Contact and representatives. Questions about this DPA: [email protected], Corvidae Limited, Auckland, New Zealand.

We are appointing representatives in the European Union and the United Kingdom. Until their details are listed here, contact us at [email protected].

14.6 This is version DPA 1.0 of this DPA, effective 16 October 2026.

Annex I: parties and processing

A. Parties

Data exporter

The customer: the organisation named in the workspace or order. Contact: the workspace's Owner and billing contact, at the email addresses held in the workspace. Activities relevant to the transfer: using Lernoa Business to train its people and keep records. Role: controller, or processor where clause 3.1 says so.

Data importer

Corvidae Limited, Auckland, New Zealand. Contact: the person responsible for privacy at Corvidae Limited, [email protected]. Activities relevant to the transfer: providing Lernoa Business to the customer. Role: processor, or sub-processor where clause 3.1 says so.

Signature and date

Each of us is treated as having signed on the date you accept the Terms (clause 8.7).

B. Description of the processing

Whose personal data

• The customer's employees, contractors and other people it invites to its workspace.
• The customer's administrators (the people with the Owner, Admin or Manager role, or any role that can manage people, training, settings, documents, records or billing).

What personal data

• People. Names, work email addresses, role, team, location, language and any custom fields the customer adds.
• Sign-in details. The email address and a password hash, or the Google or Microsoft identity, a person signs in with; when they first signed in and were last seen; the time, IP address and browser of each sign-in (kept 12 months); and, only for a person who turns on two-step sign-in, their encrypted authenticator secret, the hashes of their recovery codes and, if they choose text-message codes, their mobile number.
• Documents and media. The documents the customer uploads, and the pictures and videos in lessons. They may contain personal data.
• Training activity. Assignments, due dates, progress, answers and scores, and certificates.
• Feedback. The ratings and comments people leave on training.
• Sign-offs. Acknowledgements and signatures, with their wording, the time and the IP address they came from.
• Questions and reminders. Questions sent through "I have a question", and the reminders the service sends.
• Administrators. The audit log: administrators' changes, downloads of people's records, and the sign-ins of the people who help run the workspace, each with the IP address and browser it came from (removed after 12 months).
• Personal focus. Strengths and focus areas, worked out from final assessment answers. Held only when the workspace has personal focus turned on.
• A person's own study data. A person's own notes, highlights, Ask chat and study time. They are visible to that person only and never to the employer.

Special categories of personal data. Not intended. The service is not designed to hold special categories of personal data, and the customer should not upload them unless the training genuinely needs them. No restrictions or safeguards apply beyond the measures in Annex II.

Nature of the processing

Hosting and backup, AI drafting of training from documents, audio narration where an administrator turns it on, delivery of training, records, and reminders.

Purpose of the transfer and further processing

To provide, secure and support Lernoa Business for the customer, as the Terms and this DPA describe.

Frequency of the transfer

Continuous, for as long as the workspace is open.

How long it is kept

The length of the agreement, plus the retention periods in clause 11 (including the backup period in clause 11.3).

Transfers to sub-processors

The subject matter, nature and duration are as above, limited to what each sub-processor does for the service, as the sub-processor list describes.

C. Competent supervisory authority

For a transfer subject to the EU GDPR, the supervisory authority under Clause 13(a) of the SCCs, as clause 8.4 sets it out: the authority of the member state where the customer is established; if it is not established in the EU, the authority of the member state where its representative is established; and if it has no representative, the authority of a member state where the people whose data is transferred are located, which the customer tells us. For a transfer subject to the UK GDPR, the Information Commissioner's Office. For a transfer subject to the Swiss Federal Act on Data Protection, the Federal Data Protection and Information Commissioner (and, if the GDPR also applies, the authority above for that part).

Annex II: security measures

The technical and organisational measures that protect Customer Personal Data:

• Encryption in transit: traffic between a person and the service uses TLS.
• Tenant isolation: the server checks every request against the signed-in person's membership, role and permissions in the workspace it names.
• Roles and permissions: Owner, Admin, Manager and Learner decide who can see and change what.
• Two-step sign-in: every account can turn on a second step at sign-in, a code from an authenticator app or a code sent by text message, with single-use recovery codes. The authenticator secret is stored encrypted and recovery codes only as hashes. It is each person's choice.
• Audit log: every change by an administrator, every download of people's records, and the sign-ins and two-step sign-in changes of the people who help run the workspace are written to a log the workspace's administrators can read and download. Each line records the IP address and browser it came from. Nobody can edit the log; IP addresses and browsers are removed from it after 12 months.
• Uploaded files: checked by their content rather than their name, stored under random names, and served only to signed-in members of that workspace. Nothing is public.
• Passwords: stored as salted hashes (ASP.NET Core Identity).
• Abuse protection: rate limits and bot checks on sign-up and forms.
• Reading a company website: protection against server-side request forgery, so the reader fetches only public addresses.
• Staff access: Lernoa staff access is limited to named staff, who are bound by confidentiality.
• Separation from personal Lernoa: Lernoa Business has its own database and its own accounts, separate from personal Lernoa.
• AI providers: they receive only the text a task needs (document content, training text, or the question a person types into Ask). Personal focus sends no person's name or results to AI. Amazon Bedrock does not use content to train models, and we have opted out of AWS using content processed by its AI services, such as Amazon Polly, to improve those services.
• Data minimisation: personal focus is off by default for workspaces in the UK, the EU/EEA and Switzerland, and nothing is recorded while it is off.
• Resilience and restore: The Lernoa Business database is backed up once a day. Each backup is kept for 7 days on the server in Auckland and a copy for 14 days in Amazon S3 in Auckland, and the server's disks are also copied once a day, each copy kept for 7 days in Auckland. Restoring from a backup has been tested. Uploaded files are stored in Amazon S3 in Auckland and are not part of the database backups.
• Export and deletion: administrators can export records as CSV files or per-person PDFs at any time and can erase a person's personal data themselves ("Erase personal data"). A closed workspace is deleted automatically on its deletion date, uploaded files included, and Lernoa staff delete an enquiry or a Business account on request.
• Sub-processors: each is bound by a written contract with data protection obligations equivalent to the ones in this DPA.
• Breach handling: we follow a written procedure for containing, assessing and reporting a personal data breach, so customers hear from us within the time the DPA sets.
• Physical security of the data centres: provided by AWS.

Single sign-on through your own identity provider (SAML) is not available yet. The Security page describes the same measures.

Annex III: sub-processors

This is the list at the date above. The current list is always at /subprocessors/, and clause 7 says how we tell you about a change. The authorisation is general (Clause 9(a), Option 2), so this list is for information.