This Data Processing Agreement ("DPA") supplements the Syllabi Terms of Service between Syllabi, Inc. ("Syllabi" or "Processor") and the organization executing this agreement ("Controller" or "Customer"), and forms part of the overall agreement between the parties. This DPA governs the processing of personal data that Syllabi performs on behalf of the Controller in connection with Syllabi's learning management services.
This DPA is entered into pursuant to Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "General Data Protection Regulation" or "GDPR") and any equivalent national implementing laws.
Capitalized terms used but not defined in this DPA have the meanings given in the GDPR. In addition:
"Processor" means Syllabi, Inc., which processes personal data on behalf of the Controller in connection with providing the Syllabi platform and related services.
"Controller" means the organization (identified during the signature process) that determines the purposes and means of the processing of personal data and that has engaged Syllabi to provide learning management services.
"Data Subjects" means the Controller's employees, contractors, learners, or other individuals whose personal data is processed through the Syllabi platform on behalf of the Controller.
"Personal Data" has the meaning given in GDPR Art. 4(1): any information relating to an identified or identifiable natural person.
"Processing" has the meaning given in GDPR Art. 4(2) and includes collection, storage, retrieval, use, disclosure, and erasure of personal data.
Syllabi processes personal data on behalf of the Controller for the purpose of providing its AI-powered learning management platform, including:
This DPA applies for the duration of the services agreement between the Controller and Syllabi. Upon termination, Section 10 (Data Deletion and Return) governs the disposition of personal data.
Syllabi does not intentionally process special categories of personal data (GDPR Art. 9) such as health data, racial or ethnic origin, or political opinions. The Controller is responsible for ensuring that no special category data is uploaded to Syllabi unless appropriate safeguards are in place and an appropriate legal basis exists. Controllers using Syllabi for HIPAA-covered healthcare training should also execute a Business Associate Agreement (available here).
Syllabi shall process personal data only on documented instructions from the Controller, including the instructions set out in the services agreement and this DPA, unless processing is required by applicable law. If Syllabi becomes aware that a processing instruction infringes the GDPR, Syllabi will inform the Controller.
Syllabi ensures that persons authorized to process personal data are bound by appropriate confidentiality obligations. Syllabi's staff who access personal data are subject to employment agreements with confidentiality obligations. Syllabi does not disclose personal data to third parties except as authorized under this DPA or required by law.
Syllabi processes personal data solely for the purposes set out in Section 2 and does not process personal data for its own commercial purposes unrelated to the service. In particular:
Pursuant to GDPR Art. 28(3)(c) and Art. 32, Syllabi implements and maintains the following technical and organizational measures:
Syllabi maintains append-only audit logs of security-relevant events including: user logins and failures, member additions/removals, role changes, data exports, and course/content operations. Audit logs are retained for a minimum of 2 years (standard) or 6 years for organizations using HIPAA Mode.
The Controller provides general authorization for Syllabi to engage the following sub-processors. Syllabi is responsible for ensuring each sub-processor provides at least equivalent data protection guarantees.
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Render, Inc. | Cloud hosting and compute | All application data (in-memory processing) | United States |
| Neon, Inc. | Managed PostgreSQL database | All persisted personal data | United States |
| Anthropic, PBC | AI course generation (Claude) | Document text, generation prompts | United States |
| OpenAI, LLC | AI course generation (GPT) | Document text, generation prompts | United States |
| Stripe, Inc. | Payment processing | Email, billing name, payment tokens | United States |
| Postmark (ActiveCampaign) | Transactional email delivery | Email address, email content | United States |
| Cloudflare, Inc. | CDN, DDoS protection, DNS | IP addresses, request metadata | US / Global |
Syllabi will provide the Controller with at least 30 days' advance notice before adding or replacing a sub-processor. This notice will be provided via email to the organization's primary administrator. The Controller may object to such changes on reasonable data protection grounds within the 30-day notice period. If Syllabi and the Controller cannot resolve the objection, either party may terminate the services agreement on written notice.
In the event of a personal data breach as defined in GDPR Art. 4(12), Syllabi will notify the Controller without undue delay and within 72 hours of becoming aware of the breach, in accordance with GDPR Art. 33. This timeline is consistent with the Controller's notification obligations to supervisory authorities.
Syllabi's breach notification will include, to the extent available at the time of notification:
Where not all information is available at the time of initial notification, Syllabi will provide additional information as it becomes available.
Breach notifications will be sent to the primary administrator email address registered to the Controller's organization. The Controller is responsible for maintaining current contact information in organization settings.
Syllabi will cooperate with the Controller and provide all information reasonably necessary to enable the Controller to fulfill its own breach notification obligations under GDPR Art. 33 and Art. 34.
Syllabi will assist the Controller in fulfilling its obligations to respond to Data Subject requests under GDPR Chapter III (Arts. 15–22). Specifically:
The Controller is responsible for managing Data Subject requests. Syllabi will not respond directly to Data Subjects without the Controller's authorization unless required by applicable law.
If Syllabi receives a request directly from a Data Subject relating to the Controller's data, Syllabi will notify the Controller promptly and direct the Data Subject to the Controller, unless prohibited by law.
The Controller agrees to:
All personal data processed under this DPA is transferred to and processed in the United States. Syllabi relies on the following legal mechanisms for such transfers from the EEA, UK, and Switzerland:
For transfers from the EEA, Syllabi relies on the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (Module Two: Controller to Processor), which are incorporated by reference into this DPA and available upon request.
For transfers from the United Kingdom, Syllabi relies on the International Data Transfer Addendum (IDTA) issued by the UK ICO, or UK addenda to EU SCCs as applicable.
For transfers from Switzerland, Syllabi relies on the standard data protection clauses issued by the Federal Data Protection and Information Commissioner (FDPIC).
Each sub-processor listed in Section 5 processes data in the United States under its own transfer mechanism (SCCs, adequacy decision, or equivalent). Details are available in each sub-processor's DPA documentation. Syllabi will provide this information upon request.
Upon termination or expiration of the services agreement for any reason, Syllabi will, at the Controller's election made within 30 days of termination:
Encrypted backup data may persist for up to 60 days beyond the deletion confirmation date due to backup rotation schedules. Syllabi will not restore this data for any purpose after the deletion instruction is received.
Notwithstanding the above, Syllabi may retain data where required by applicable law (e.g., financial transaction records required by law for 7 years), provided such retained data is minimized and isolated from active processing.
During the term of the services agreement, Syllabi retains personal data in accordance with the retention periods in Syllabi's Privacy Policy (Section 6), unless the Controller specifies shorter retention in writing.
The Controller may audit Syllabi's data processing activities to verify compliance with this DPA. Syllabi will:
The Controller may conduct audits no more than once per calendar year, except where a data breach or regulatory requirement necessitates more frequent review. The Controller is responsible for the costs of any audit (including any third-party auditor engaged by the Controller), except where the audit reveals a material breach by Syllabi.
In lieu of an on-site audit, Syllabi may provide relevant third-party audit reports, certifications (SOC 2, ISO 27001), or security assessments to satisfy audit obligations, to the extent these address the Controller's audit scope.
Each party's liability under this DPA is subject to the liability limitations set out in the applicable services agreement. Nothing in this DPA limits either party's liability to Data Subjects or to supervisory authorities under applicable data protection law. Each party will indemnify the other for regulatory fines, damages, and costs arising from that party's breach of GDPR obligations that are solely attributable to the breaching party.
In the event of a conflict between this DPA and the services agreement, this DPA shall prevail with respect to data protection matters. In the event of a conflict between this DPA and the Standard Contractual Clauses, the SCCs shall prevail.
Syllabi may update this DPA by providing 30 days' written notice to the Controller's primary administrator. The Controller may reject updates that materially reduce data protection standards within the notice period. Continued use of the service after the notice period constitutes acceptance.
If any provision of this DPA is found to be invalid or unenforceable, the remaining provisions remain in full force and effect.
This DPA is governed by the laws of the State of Delaware, except where the GDPR, UK GDPR, or Standard Contractual Clauses require the application of EU or UK law.
For GDPR-related inquiries, data subject requests, or questions about this DPA:
Data Protection Contact, Syllabi, Inc.
Email: privacy@syllabi-hsek.polsia.app
Subject line: DPA Inquiry — [Organization Name]