Data Processing Agreement

"GDPR" means Regulation (EU) 2016/679; "UK GDPR" means the GDPR as it applies in the United Kingdom; "Data Protection Law" means the GDPR, the UK GDPR and any other data protection law that applies to the processing. "Personal data", "controller", "processor", "processing", "data subject" and "personal data breach" have the meaning the GDPR gives them.

darji processes personal data on the company's behalf to provide the seats it buys: inviting the people the company chooses, giving each of them darji Pro for the time of their seat, and reporting their progress to the company on its team page, in its CSV report and in a monthly progress report. For this processing, the company is the controller and darji is its processor (Article 28 GDPR).

Each invited person also has their own darji account, which darji provides to them under its Terms of Service and Privacy Policy. What that account holds beyond the data in section 4, such as their answers, their recordings and what they write to Wissal, darji processes as controller, for that person, and the company doesn't see it.

This DPA applies from the company's first order for as long as darji processes personal data for the company, until the deletion described in section 10.

People concerned: the people the company invites (its staff, members of their families, people it relocates or sends to study) and the company's admins.

Personal data:

• the name and e-mail address each person is invited with;
• once they join, the name and e-mail address of the darji account they join with, which can differ from the invited address;
• the state of their invitation and seat: invited, joined or removed, and since when;
• their learning data shown to the company: when they were last active, the lessons done, the stage reached, the words kept and the certificates earned;
• for the company's admins: their name, their e-mail address and what they do on the team page.

No special category of personal data (Article 9 GDPR) is processed for the company.

Nature and purpose: storing this data, showing it to the company's admins and sending it in their reports, to provide the seats and report on them. Frequency: continuous, for as long as an order lasts.

darji:

• processes the personal data only on the company's documented instructions: these terms, each order, and what the company's admins do on the team page, unless a law darji is subject to requires otherwise, in which case darji tells the company first, unless that law forbids it;
• tells the company at once if it thinks an instruction breaks Data Protection Law;
• ensures that everyone who can access the data is bound by confidentiality;
• protects the data with the measures described on its Security page, which it may improve but not weaken;
• helps the company, as far as the processing allows, to answer people who exercise their rights: access, correction, deletion, restriction, portability and objection;
• helps the company meet its obligations on security, personal data breaches, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR);
• tells the company without undue delay after becoming aware of a personal data breach affecting its data, with the information Article 33(3) GDPR lists, as it becomes known;
• never sells the data and never uses it for advertising;
• makes available to the company the information needed to show that these obligations are met, and allows audits as section 11 sets out.

• The company has a lawful basis to give darji the name and e-mail address of each person it invites, and to receive their progress.
• Before inviting someone, it tells them what it will see (section 4).
• Its instructions comply with Data Protection Law.

The company authorises darji to use these sub-processors:

• Vercel hosts the site, runs its server code in London (United Kingdom) and stores its audio files.
• Neon hosts the database, in London (United Kingdom).
• Resend sends darji's e-mails, invitations included.
• PostHog measures how darji is used (analytics), hosted in the European Union.
• Sentry receives error reports, so that we can fix what breaks.

Paddle sells the seats as seller of record and receives the company's billing details; it doesn't receive the invited people's learning data.

darji binds each sub-processor by contract to data protection obligations that protect the data at least as well as this DPA, and remains responsible to the company for their work.

Before adding or replacing a sub-processor, darji tells the company's admin by e-mail and updates its Security page, early enough for the company to object on reasonable data protection grounds. If the parties can't settle the objection, the company may end the orders concerned.

darji's operator is established in the United Arab Emirates, which has no adequacy decision from the European Commission. The data is hosted in London, United Kingdom, and darji accesses it from where it works. So:

• For personal data the company transfers from the European Economic Area, the parties agree to the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), which are incorporated in this DPA by reference. The company is the data exporter and darji the data importer. Clause 7 (docking clause) applies. Clause 9: option 2, general written authorisation, with the notice of section 7 of this DPA. Clause 11: the optional wording doesn't apply. Clause 13: the competent supervisory authority is the one Clause 13(a) designates for the company's situation; where the company is established in an EU Member State, that Member State's. Clause 17: option 2, the law of the EU Member State where the company is established, or, where that law doesn't allow third-party beneficiary rights, Irish law. Clause 18: the courts of that EU Member State. Annex I is completed by sections 2 to 4 and 7 of this DPA, Annex II by the measures on our Security page, and Annex III by the list in section 7.
• For personal data transferred from the United Kingdom, the parties also agree to the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (the UK Addendum), completed with the details above.
• Where a sub-processor processes the data outside the United Kingdom and the European Economic Area, darji relies on a transfer mechanism that Data Protection Law recognises, such as an adequacy decision, the EU-US Data Privacy Framework or Standard Contractual Clauses.

darji applies the technical and organisational measures described on its Security page. They form Annex II of the Standard Contractual Clauses.

When the company's last order ends, darji stops processing for it.

If the company asks before the end, darji first sends it a last CSV report of its team: that is the return of its data.

Then darji deletes, without undue delay, the personal data it processed for the company: its team, its admins' access, its seats and invitations, and the link between each invited person and the company. It keeps only what a law requires it to keep, such as the records of payments, for as long as accounting and tax rules require.

Each invited person keeps their own darji account, without the seat's Pro, unless they delete it, which they can do at any time in the app.

darji makes available the information needed to show that it complies with this DPA. The company audits it by sending a written questionnaire, which darji answers within a reasonable time.

If a supervisory authority requires more, or if the answers don't show compliance, the parties agree on another form of audit: with reasonable notice, at the company's cost, and without access to other customers' data.

Each party's liability under this DPA is subject to the limits in the Business terms, except where Data Protection Law or the Standard Contractual Clauses don't allow it.

If this DPA conflicts with the Business terms, this DPA prevails for the protection of personal data. If it conflicts with the Standard Contractual Clauses, the Clauses prevail.

Apart from the Clauses, which are governed as section 8 says, this DPA is governed by the same law as the Business terms.

Questions, a request for a signed copy, or a data protection request? Write to hello@darji.ma.