UK and EU customers | Lernoa Business

1. The DPA and how it applies

Every Lernoa Business customer is covered by our Data Processing Addendum. It is part of the Terms of Service, applies automatically, and needs no signature. For workspace content you are the controller and we, Corvidae Limited of Auckland, New Zealand, are your processor. In short:

we process your people's information only on your documented instructions, which are the Terms, the DPA and how you use the service and its settings;
our sub-processors are listed at /subprocessors/; we give at least 30 days' notice by email to each workspace Owner before adding or replacing one, and you can object and, if we cannot resolve it, end the affected licence with a pro-rata refund of fees paid in advance;
we notify you of a personal data breach without undue delay and within 48 hours of becoming aware;
the EU Standard Contractual Clauses and the UK Addendum are built into the DPA, and apply automatically if an adequacy decision covering New Zealand stops applying; the Swiss adaptation is included;
we never use your content to train AI models, Amazon Bedrock does not use it to train models, and we have opted out of AWS using content processed by its AI services, such as Amazon Polly, to improve those services;
you can answer your people's requests yourself: an administrator can export a person's records, correct their details and erase their personal data in the app, and if a person writes to us we pass the request to you without undue delay;
a closed workspace is deleted automatically, uploaded files included, as the Terms describe, and we give you written answers and security questionnaires to show we meet the DPA.

If you want a countersigned copy, email [email protected]. The Security page and Annex II of the DPA describe the security measures.

2. Where your data is

Your documents, training and records are stored in Amazon Web Services in Auckland, New Zealand, in a database that is separate from personal Lernoa. New Zealand has an adequacy decision from the European Commission (Decision 2013/65/EU) and is recognised by the United Kingdom and Switzerland, so transfers of your data to us rely on that. Some processing happens elsewhere. The safeguard we rely on for each provider is below, and the full list with what each provider handles is at /subprocessors/.

The Lernoa Business database is backed up once a day. Each backup is kept for 7 days on the server in Auckland and a copy for 14 days in Amazon S3 in Auckland, and the server's disks are also copied once a day, each copy kept for 7 days in Auckland. Restoring from a backup has been tested. Uploaded files are stored in Amazon S3 in Auckland and are not part of the database backups. Personal data we delete from the live service is gone from the backups within about 15 days, and until then we do not use the backups except to restore the service.

Where Lernoa Business processing runs and the transfer safeguard for each provider
Provider	Where it runs	Transfer safeguard
Amazon Web Services Documents, training and records	Auckland, New Zealand	The data stays in New Zealand, so there is no onward transfer. Transfers of UK, EU and Swiss personal data to us in New Zealand rely on New Zealand's adequacy status.
Amazon Bedrock, running models from Anthropic, Amazon and OpenAI AI course drafting and Ask	AWS regions worldwide: a request can be processed in any AWS commercial region, including the United States	AWS's data processing terms, which incorporate the EU Standard Contractual Clauses and the UK Addendum, and, for processing in the United States, the EU-US Data Privacy Framework (with its UK Extension and the Swiss-US framework) where the provider is certified.
Amazon Polly Audio narration	United States (AWS)	AWS's data processing terms, which incorporate the EU Standard Contractual Clauses and the UK Addendum, and the EU-US Data Privacy Framework (with its UK Extension and the Swiss-US framework) where the provider is certified.
Amazon SES Email	Sydney, Australia (AWS)	AWS's data processing terms, which incorporate the EU Standard Contractual Clauses and the UK Addendum. Those clauses are the safeguard for this transfer.
Zoho Mail Support email	Australia: mail is held in the Australian data centre of Zoho Corporation Pty Ltd	Zoho's data processing terms, which incorporate the EU Standard Contractual Clauses and the UK Addendum. Those clauses are the safeguard for this transfer.
Twilio Sign-in codes by text message	United States: only for a person who chooses to get two-step sign-in codes by text message	The provider's data processing terms, which incorporate the EU Standard Contractual Clauses and the UK Addendum, and the EU-US Data Privacy Framework (with its UK Extension and the Swiss-US framework) where the provider is certified.
Stripe Billing and invoices	Global	The provider's data processing terms, which incorporate the EU Standard Contractual Clauses and the UK Addendum, and the EU-US Data Privacy Framework (with its UK Extension and the Swiss-US framework) where the provider is certified.
Cloudflare Web traffic and bot protection on forms	Global edge network	The provider's data processing terms, which incorporate the EU Standard Contractual Clauses and the UK Addendum, and the EU-US Data Privacy Framework (with its UK Extension and the Swiss-US framework) where the provider is certified.
Google, Microsoft Sign-in with Google or Microsoft	Global, only when you choose them	The provider's data processing terms, which incorporate the EU Standard Contractual Clauses and the UK Addendum, and the EU-US Data Privacy Framework (with its UK Extension and the Swiss-US framework) where the provider is certified.

3. Representatives

The GDPR and the UK GDPR can require an organisation outside the EU or the UK to appoint a representative there.

We are appointing representatives in the European Union and the United Kingdom. Until their details are listed here, contact us at [email protected].

4. VAT

Prices exclude tax. A business in the United Kingdom, the European Union or the European Economic Area, or Switzerland, must give us a valid VAT number at checkout, and accounts for VAT itself under the reverse charge. See section 7.2 of the Terms and the pricing page. Our invoices to you carry a reverse-charge note.

5. Personal focus

Personal focus records each person's strengths and focus areas from their final assessment answers, shows them to that person and to people with permission to see scores, and adds a reviewed practice section to their next course. It is a fixed rule on those answers, not an AI judgement, and no person's name or results are sent to AI.

It is a workspace setting. An administrator can turn it on or off at any time. It is off by default for workspaces in the United Kingdom, the EU/EEA and Switzerland, and on by default elsewhere. Turning it off deletes the strengths and focus areas already recorded. The default is set once, when the workspace is created, from the country chosen then; changing the country later does not change it, so check the setting after you create the workspace.

Before you turn it on, consider:

Telling your people. Give them a privacy notice that says it is on, what it records and who sees it. The template below has a paragraph for it.
Consulting where the law requires it. In some countries, introducing a system that processes employees' information in this way must be discussed with a works council or with employee representatives first. Check whether that applies to you.
Your impact assessment. Decide whether you need a data protection impact assessment. The facts below are there to help.
How the information may be used. The Terms say focus areas are learning aids, not a measure of performance, and that you must not make an employment decision on that information alone.

6. Employee privacy notice template

Your people should be told how their information is used. Copy this notice, replace the parts in [square brackets], delete what does not apply, and give it to them before you put them in a workspace. It is a starting point, and you remain responsible for its accuracy.

How [Company name] uses Lernoa Business for training and records

Who is responsible

[Company name] ("we") is responsible for your personal information in our training system. You can contact us at [name, role and email]. [If you have a data protection officer: their name and email.]

What we use it for

We use Lernoa Business, a service provided by Corvidae Limited of Auckland, New Zealand, to give you training on [our policies and procedures], to remind you when it is due, and to keep a record that you have done it.

What information it holds about you

Your name and work email address; your role, team and location [and any other details we add]; the training assigned to you and its due dates; your progress, answers and scores; what you acknowledge or sign, with the wording, the time and the network address you used; your certificates; the questions you send through "I have a question"; and the reminders we send you. [If personal focus is on: your strengths and focus areas, worked out from your final assessment answers.]

Why, and our legal basis

[Choose and complete: to meet our legal duty to train you and keep records of that training; to perform our contract with you; or our legitimate interests in making sure our people are trained and that we can show it.]

Who can see what

We, and the people we give access to [for example, administrators and your manager], can see your training status and due dates, your scores and when you achieved them, which questions you answered wrongly, what you acknowledged and when, your certificates, and the questions you send us.

Your reader notes, highlights and bookmarks, your Ask chat history, your study time and reading position and your practice-quiz answers are visible only to you. Nothing in a personal Lernoa account of your own is visible to us.

How AI is used

Lernoa Business uses AI to draft training from our documents. An administrator at [Company name] reviews each draft before you see it. Your name and results are not sent to AI.

[If personal focus is on:] Lernoa Business works out your strengths and focus areas from your answers to final assessments, using a fixed rule rather than AI, and adds a short practice section on those topics to your next course. Everyone takes the same final assessment, and a focus area clears when you get the topic right. [We do not make decisions about your employment, pay or progression using focus areas alone.]

Who else handles it, and where

Corvidae Limited handles your information for us under a data processing agreement. It stores it in Auckland, New Zealand, which [the European Commission / the UK government / the Swiss Federal Council] recognises as providing adequate protection, and uses service providers, some outside the [UK / EU], which are listed at business.lernoa.com/subprocessors/. Transfers to them are protected by the safeguards listed there.

How long we keep it

[Say how long you keep training records, for example for the time you work for us plus a set period, or as long as the law requires.]

Your rights

Where the law gives you the right, you can ask us for a copy of your information, to correct it, to delete it, to restrict how we use it, to give it to you in a portable form, or to object to how we use it. Contact us at [contact].

[If we delete your information:] Lernoa Business can erase it from our training system. Your name is replaced with a placeholder, and your contact details, notes, highlights, focus areas, questions, the text, images and IP addresses of your signatures, and your certificates are deleted. Anonymous completion figures stay, so our counts still add up. [We may have to keep some records because the law requires it. We will tell you if so.]

You can also complain to the data protection authority [in the UK, the Information Commissioner's Office at ico.org.uk; in the EU, the authority in the country where you live or work; in Switzerland, the Federal Data Protection and Information Commissioner].

Changes

We will tell you if we change this notice in a way that matters to you.

7. Facts for your impact assessment

If you carry out a data protection impact assessment, these are the facts about Lernoa Business to put in it. They are facts, not a legal assessment, and the assessment is yours.

The processing

Purpose

To draft, deliver and keep records of staff training, with reminders, sign-offs and certificates.

Whose information

The customer's employees, contractors and other people it invites to its workspace.
The customer's administrators (the people with the Owner, Admin or Manager role, or any role that can manage people, training, settings, documents, records or billing).

What information

People. Names, work email addresses, role, team, location, language and any custom fields the customer adds.
Sign-in details. The email address and a password hash, or the Google or Microsoft identity, a person signs in with; when they first signed in and were last seen; the time, IP address and browser of each sign-in (kept 12 months); and, only for a person who turns on two-step sign-in, their encrypted authenticator secret, the hashes of their recovery codes and, if they choose text-message codes, their mobile number.
Documents and media. The documents the customer uploads, and the pictures and videos in lessons. They may contain personal data.
Training activity. Assignments, due dates, progress, answers and scores, and certificates.
Feedback. The ratings and comments people leave on training.
Sign-offs. Acknowledgements and signatures, with their wording, the time and the IP address they came from.
Questions and reminders. Questions sent through "I have a question", and the reminders the service sends.
Administrators. The audit log: administrators' changes, downloads of people's records, and the sign-ins of the people who help run the workspace, each with the IP address and browser it came from (removed after 12 months).
Personal focus. Strengths and focus areas, worked out from final assessment answers. Held only when the workspace has personal focus turned on.
A person's own study data. A person's own notes, highlights, Ask chat and study time. They are visible to that person only and never to the employer.

Special categories

Not intended. The customer should not upload them unless the training genuinely needs them.

Who receives it

Your administrators and managers, within the permissions you give them, and the providers in the table above.

Where it is stored

AWS, Auckland, New Zealand, including the backup copies of the database (see section 2).

How the information moves

An administrator uploads a document, or starts from a topic or a starter course. The document is stored in Auckland.
Our own service reads the text out of the document in Auckland, and that text goes to Amazon Bedrock to draft a course, with quiz questions and page references. No person's name or results are sent.
An administrator reviews, edits and publishes the draft. Nothing reaches your people before then.
Your people are invited by email through Amazon SES. They take the training in the app. If an administrator turns narration on, the chapter text goes to Amazon Polly to be read aloud.
The service records progress, answers, scores, acknowledgements, signatures and certificates in the workspace, and sends reminders.
Administrators export records as CSV files or per-person PDFs when they need to, and can erase a person's personal data.
When a licence ends, records stay read-only and exportable for 12 months, and the closed workspace is then deleted automatically, uploaded files included, as the Terms describe. Backup copies of the database are gone within about 15 days after that.

Answering your people's requests

A person can ask you for a copy of their information, to correct it or to erase it. You can answer from the app without contacting us:

A copy. Export the person's records as a PDF, or the workspace's records as CSV files.
Correction. Edit the person's details in People.
Restriction. Mark the person as having left, which stops sign-in and reminders and keeps their records.
Erasure. Choose "Erase personal data" for the person. In the service, the person's name is replaced with a placeholder, and their contact details, notes, highlights, focus areas, questions, the text, images and IP addresses of their signatures, and their certificates are deleted. Anonymous completion figures stay, so the workspace's counts still add up. It cannot be undone in the service, so check first that no duty to keep the records applies.

If a person writes to us instead, we tell them to contact you and let you know without undue delay. We do not answer the request ourselves unless you tell us to or the law requires it.

Risks and what reduces them

Someone sees training information they should not. In the service: Roles (Owner, Admin, Manager, Learner) decide who can see and change what. The server checks every request against the signed-in person's membership, role and permissions in the workspace it names. Every change by an administrator, every download of people's records and the sign-ins of the people who help run the workspace are written to an audit log with the IP address and browser each came from. Your part: Give roles with care, and remove people who should no longer have access.
An uploaded document, picture or video reaches someone outside the workspace. In the service: Files are checked by their content, stored under random names and served only to signed-in members of that workspace. Nothing is public. A video you link from another site is shown from that site under its own terms. Your part: Upload only the personal information the training needs.
An account is taken over. In the service: Passwords are stored as salted hashes, and sign-up and forms have rate limits and bot checks. People can sign in with Google or Microsoft instead of a password, and every account can turn on two-step sign-in with an authenticator app or text-message codes. Single sign-on is not available yet. Your part: Ask everyone who helps run your workspace to turn on two-step sign-in, and remove access when people leave.
The employer sees more about a person than they expect. In the service: The employer never sees a person's reader notes, highlights or bookmarks, Ask chat history, study time and reading position, or practice-quiz answers. A person's personal Lernoa account is separate and never visible to an employer. Each person sees their own strengths and focus areas. Your part: Tell your people what you can see, using the notice template on this page.
Focus areas or scores are used to make decisions about a person. In the service: Personal focus is a learning aid, not a measurement. It is off by default for workspaces in the UK, the EU/EEA and Switzerland, uses only final assessment answers, and a focus area clears when the person gets it right. The Terms say you must not make an employment, disciplinary, pay or promotion decision on that information alone. Your part: Decide whether to turn it on, and set your own rules for how the information may be used.
An AI draft is wrong. In the service: Nothing the AI writes reaches your people until an administrator has reviewed and published it. Drafts carry page references so a reviewer can check every line against the source. Your part: Review each draft before you publish it.
Personal data leaves the UK or the EU. In the service: Storage is in Auckland, New Zealand. The table above lists every other place information can go and the safeguard we rely on. If the adequacy position for New Zealand changes, the standard contractual clauses in the DPA apply. Your part: Record the transfers in your own records of processing.
Records are kept longer than needed. In the service: Training records belong to the workspace and stay when a person leaves. Administrators can export a person's records as a CSV file or a PDF, correct a person's details, mark people as having left, and erase a person's personal data. When a licence ends, records stay read-only and exportable for 12 months, with emails 30, 7 and 1 days before anything is deleted, and the closed workspace is then deleted automatically, uploaded files included. You can ask us to delete a workspace sooner. Personal data we delete from the live service is gone from the backups within about 15 days, and until then we do not use the backups except to restore the service. Your part: Decide how long you need records, and export and delete accordingly.
A certificate's verification link shows a person's details. In the service: Each certificate carries a verification link. Anyone who has the link can see whether it is valid, expired or revoked, the holder's name, the training and the dates. You can revoke a certificate. Your part: Tell your people about the link before you issue certificates.
A personal data breach at us or at a provider. In the service: We notify you without undue delay and within 48 hours of becoming aware, with what we know and updates after. Sub-processors are bound by equivalent data protection obligations. Your part: Have your own process for deciding whether to notify a regulator or the people affected.

The security measures in full are in Annex II of the DPA:

Encryption in transit: traffic between a person and the service uses TLS.
Tenant isolation: the server checks every request against the signed-in person's membership, role and permissions in the workspace it names.
Roles and permissions: Owner, Admin, Manager and Learner decide who can see and change what.
Two-step sign-in: every account can turn on a second step at sign-in, a code from an authenticator app or a code sent by text message, with single-use recovery codes. The authenticator secret is stored encrypted and recovery codes only as hashes. It is each person's choice.
Audit log: every change by an administrator, every download of people's records, and the sign-ins and two-step sign-in changes of the people who help run the workspace are written to a log the workspace's administrators can read and download. Each line records the IP address and browser it came from. Nobody can edit the log; IP addresses and browsers are removed from it after 12 months.
Uploaded files: checked by their content rather than their name, stored under random names, and served only to signed-in members of that workspace. Nothing is public.
Passwords: stored as salted hashes (ASP.NET Core Identity).
Abuse protection: rate limits and bot checks on sign-up and forms.
Reading a company website: protection against server-side request forgery, so the reader fetches only public addresses.
Staff access: Lernoa staff access is limited to named staff, who are bound by confidentiality.
Separation from personal Lernoa: Lernoa Business has its own database and its own accounts, separate from personal Lernoa.
AI providers: they receive only the text a task needs (document content, training text, or the question a person types into Ask). Personal focus sends no person's name or results to AI. Amazon Bedrock does not use content to train models, and we have opted out of AWS using content processed by its AI services, such as Amazon Polly, to improve those services.
Data minimisation: personal focus is off by default for workspaces in the UK, the EU/EEA and Switzerland, and nothing is recorded while it is off.
Resilience and restore: The Lernoa Business database is backed up once a day. Each backup is kept for 7 days on the server in Auckland and a copy for 14 days in Amazon S3 in Auckland, and the server's disks are also copied once a day, each copy kept for 7 days in Auckland. Restoring from a backup has been tested. Uploaded files are stored in Amazon S3 in Auckland and are not part of the database backups.
Export and deletion: administrators can export records as CSV files or per-person PDFs at any time and can erase a person's personal data themselves ("Erase personal data"). A closed workspace is deleted automatically on its deletion date, uploaded files included, and Lernoa staff delete an enquiry or a Business account on request.
Sub-processors: each is bound by a written contract with data protection obligations equivalent to the ones in this DPA.
Breach handling: we follow a written procedure for containing, assessing and reporting a personal data breach, so customers hear from us within the time the DPA sets.
Physical security of the data centres: provided by AWS.

Single sign-on through your own identity provider (SAML) is not available yet.

Facts about AI in the service

AI drafts courses, quiz questions, translations and answers to Ask, from the text you provide.
Administrators review and publish a draft before it reaches your people.
Ask answers come from the training text only, with the chapter and page, and say so when the answer is not there.
Personal focus is a fixed rule on final assessment answers, not an AI judgement. No person's name or results are sent to AI.
We do not use your content to train AI models, and Amazon Bedrock does not use it to train models. We have opted out of AWS using content processed by its AI services, such as Amazon Polly, to improve those services.
Our own service reads the text out of PDF and Word files. Amazon Polly receives chapter text only when an administrator turns narration on.

8. Contact

Questions, a countersigned DPA, or a security questionnaire: [email protected], Corvidae Limited, Auckland, New Zealand. We reply within one working day.

Lernoa Business for UK and EU customers