B2B Data Processing Agreement

1. Parties

This Data Processing Agreement (DPA) is between LangaPress (the "Processor") and the business customer (the "Controller"), as identified in the B2B Agreement.

2. Roles

The Customer is the controller of learner personal data. LangaPress is the processor, acting on the documented instructions of the Customer.

3. Subject Matter

This DPA governs the processing of personal data of learners who are given access to LangaPress products through the Customer's B2B subscription.

4. Duration

This DPA applies for the duration of the B2B Agreement and thereafter until all personal data has been deleted or returned in accordance with this DPA.

5. Nature of Processing

LangaPress processes learner personal data to provide access to the digital language-learning library, manage seat assignments, and deliver the service described in the B2B Agreement.

6. Purposes

Processing purposes include: account creation, access provisioning, library access, download management, and service support.

7. Data-Subject Categories

The data subjects are the learners designated by the Customer to receive access to LangaPress products.

8. Personal-Data Categories

Personal data processed includes: learner name, email address, account status, seat assignment, and access/download logs.

9. Documented Instructions

LangaPress processes learner personal data only on the documented instructions of the Customer, as set out in this DPA and the B2B Agreement. The Customer warrants that its instructions are lawful and that it has the necessary rights to provide the data to LangaPress.

10. Confidentiality

LangaPress ensures that personnel authorised to process personal data are bound by confidentiality obligations.

11. Security

LangaPress implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including encryption, access controls, and regular security review.

12. Subprocessors

LangaPress may engage subprocessors to support the provision of the service. LangaPress remains responsible for the acts and omissions of its subprocessors to the same extent as for its own. The subprocessor register is derived from our internal vendor register and is subject to ongoing review.

We do not fabricate signed subprocessor agreements, DPA completion status, or SCC completion status. Unresolved vendor items are flagged internally for follow-up.

13. International Transfers

Where personal data is transferred outside the EEA, appropriate safeguards are relied upon where available, such as Standard Contractual Clauses. We do not claim adequacy status for every vendor unless our vendor register confirms it.

14. Data-Subject Assistance

LangaPress assists the Customer in responding to data-subject requests, to the extent LangaPress holds the relevant data. The Customer remains responsible for managing data-subject relationships.

15. Personal-Data Breaches

LangaPress notifies the Customer of a personal data breach without undue delay after becoming aware of it. LangaPress provides the Customer with information reasonably necessary to comply with the Customer's own breach notification obligations.

16. DPIA and Cooperation

LangaPress cooperates with the Customer in data protection impact assessments where required, to the extent the processing is within LangaPress's scope.

17. Deletion and Return

Upon termination of the B2B Agreement, LangaPress deletes or returns learner personal data at the Customer's choice, subject to legal retention obligations. Deletion is completed within a reasonable period after termination.

18. Audit and Compliance Information

LangaPress provides the Customer with information reasonably necessary to demonstrate compliance with this DPA. The Customer may audit LangaPress's compliance subject to reasonable notice and confidentiality arrangements.

19. Customer Obligations

The Customer is responsible for: providing accurate learner data, managing learner invitations, ensuring lawful basis for providing learner data to LangaPress, and informing learners through the Learner Privacy Notice.

20. Priority

Where this DPA conflicts with the B2B Agreement, this DPA prevails on data protection matters.

21. Governing Law

This DPA is governed by the laws of the Netherlands.

Documented Instructions and Article 28

LangaPress processes personal data only on documented instructions from the Customer, including for transfers, unless EU or Member State law requires otherwise. If legally permitted, LangaPress will inform the Customer of such a requirement before processing.

Subprocessor Changes

LangaPress will maintain a current subprocessor record and provide reasonable notice of intended material additions or replacements, allowing the Customer to raise substantiated data-protection objections.

International Transfers

Restricted transfers will use an applicable transfer mechanism and supplementary measures where required. No specific adequacy decision or contractual safeguard is claimed unless documented in the vendor register.