This Data Processing Addendum (“DPA”) forms part of the Terms of Service or other written agreement (“Agreement”) between Scolah, Inc. (“Scolah”, “Processor”) and the organisation using Scolah Compass Platform (“Customer”, “Controller”). It applies automatically when the Customer accepts the Agreement. A countersigned copy is available on request at legal@scolah.com.
For Scolah Compass and Scolah Care deployments hosted by Scolah, the same terms apply, with the description of processing agreed in the relevant order form.
1. Definitions
- Data Protection Law means all laws on personal data that apply to the processing under this DPA. This includes the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and other national laws where the Customer operates.
- Customer Personal Data means personal data that Scolah processes on the Customer’s behalf in providing the Platform, as described in Annex 1.
- Your Infrastructure has the meaning given in the Terms: the servers and clusters the Customer controls.
- “Controller”, “processor”, “data subject”, “personal data breach”, “processing” and “supervisory authority” have the meanings given in the GDPR.
2. What This DPA Covers — and What It Does Not
The Platform is built so that Scolah does not process the data held in the Customer’s applications. Those applications, their databases and their files run on Your Infrastructure, which Scolah cannot access.
This DPA therefore covers:
- Personal data in Scolah’s control plane: portal users, the activity log, server and installation records, and installation credentials
- The content of AI requests, when the Customer enables the Scolah-managed AI option
- Any personal data the Customer chooses to share with Scolah for support, such as logs, screenshots or screen-sharing sessions
- Recipients and content of the notifications Scolah delivers for the Customer’s applications
It does not cover data that stays on Your Infrastructure, or data the Customer sends to services it contracts directly, such as its own mail server. For that data the Customer is the controller, and Scolah is neither controller nor processor.
Scolah is an independent controller for the limited data it needs to manage its business relationship with the Customer, such as billing contacts and invoices. Our Privacy Policy covers that data.
3. Processing on Instructions
3.1 Scolah will process Customer Personal Data only on the Customer’s documented instructions, including with regard to international transfers, unless Union or Member State law (or other applicable law) requires otherwise. In that case Scolah will tell the Customer before processing, unless the law prohibits it.
3.2 The Agreement, this DPA, and the Customer’s configuration and use of the Platform are the Customer’s complete instructions. Additional instructions must be agreed in writing.
3.3 Scolah will tell the Customer promptly if, in its opinion, an instruction breaks Data Protection Law.
3.4 Scolah will not sell Customer Personal Data, or use it to train AI models, for advertising, or for any purpose of its own.
4. Confidentiality
Scolah will ensure that everyone it authorises to process Customer Personal Data is bound by confidentiality obligations. Access will be limited to those who need it to provide, support or secure the Platform.
5. Security
5.1 Scolah will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data, as described in Annex 2.
5.2 Scolah may update these measures, provided the overall level of protection is not reduced.
5.3 The Customer is responsible for the security of Your Infrastructure, for the configuration it chooses, and for protecting its account credentials. See the Terms.
6. Subprocessors
6.1 The Customer gives general authorisation for Scolah to engage subprocessors. The categories of subprocessors are published at legal.scolah.com/subprocessors. The named list is set out in Annex 3.
6.2 Scolah will give at least 30 days’ notice of a new subprocessor by updating Annex 3 and notifying subscribed Customers.
6.3 The Customer may object on reasonable data-protection grounds within that period. The parties will then discuss it in good faith. If no resolution is reached, the Customer may terminate the affected part of the service, and Scolah will refund prepaid fees for the remaining period.
6.4 Scolah will impose data protection obligations on each subprocessor that are no less protective than this DPA. Scolah remains liable to the Customer for each subprocessor’s performance.
7. Assisting the Customer
7.1 Data subject requests. If Scolah receives a request from a data subject about Customer Personal Data, it will pass it to the Customer without undue delay and will not respond itself, except to confirm the redirection. Scolah will help the Customer respond, taking into account the nature of the processing. Most data covered by this DPA can be accessed, corrected or deleted directly by the Customer’s organisation admins in the portal.
7.2 Impact assessments and consultations. Scolah will give reasonable help with data protection impact assessments and prior consultations with supervisory authorities, in relation to the processing under this DPA. The Trust Centre is intended to support this.
8. Personal Data Breaches
8.1 Scolah will notify the Customer without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
8.2 The notice will describe, as far as then known: the nature of the breach, the categories and approximate number of data subjects and records concerned, likely consequences, and the measures taken or proposed. Information may be provided in phases.
8.3 Scolah will take reasonable steps to contain and remedy the breach, and will cooperate with the Customer’s investigation. Our process is described under Incident Response.
8.4 Notifying Customers of a breach is not an admission of fault or liability.
9. Return and Deletion
9.1 During the subscription, organisation admins can export or delete Customer Personal Data in the portal, or ask Scolah to do so.
9.2 When the subscription ends, the portal stays readable for 30 days. Scolah then deletes Customer Personal Data from active systems within a further 30 days. Encrypted database backups expire within 30 days after that.
9.3 Scolah may keep data that the law requires it to retain, such as invoices. That data stays protected under this DPA for as long as it is kept.
9.4 Data on Your Infrastructure is not affected. Installation credentials held by the Platform are deleted with the rest of the Customer’s data. We recommend the Customer rotates them.
10. Audits
10.1 Scolah will make available the information reasonably necessary to demonstrate compliance with this DPA. This includes the Trust Centre, completed security questionnaires (once a year), and summaries of any independent assessments.
10.2 If that information is not enough to demonstrate compliance, or a supervisory authority requires it, the Customer may carry out an audit, or have an independent auditor do so. The conditions are:
- At least 30 days’ written notice
- No more than once in any 12 months, unless following a personal data breach
- During business hours, without unreasonable disruption, and subject to confidentiality
- At the Customer’s cost, unless the audit reveals a material breach by Scolah
11. International Transfers
11.1 Scolah processes Customer Personal Data in the hosting region recorded for the Customer in Annex 3, and its subprocessors process it in the locations listed there. Scolah will notify the Customer before moving its Customer Personal Data to a different hosting region, in the same way as a new subprocessor under Section 6.2.
11.2 Where Customer Personal Data subject to the GDPR is transferred to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 apply and are incorporated by reference. Module Two (controller to processor) applies, or Module Three where the Customer is itself a processor. They apply with these selections:
- Clause 7 (docking clause) applies
- Clause 9: option 2, general written authorisation, with the notice period in Section 6
- Clause 11: the optional language does not apply
- Clauses 17 and 18: the law and courts of Ireland
- Annexes I and II: Annex 1 and Annex 2 of this DPA; Annex III: Annex 3 of this DPA
11.3 For transfers subject to UK data protection law, the UK International Data Transfer Addendum to the EU SCCs (version B1.0) applies. For transfers subject to Swiss law, the SCCs apply with the references to the GDPR read as references to the Swiss FADP, and the FDPIC as the competent supervisory authority.
11.4 Where other national law restricts transfers, the parties will cooperate to put in place the mechanism that law requires.
11.5 The Scolah-managed AI option is off unless the Customer chooses it. If keeping data in a particular country is a legal requirement for the Customer, the Customer should not choose it. Its application data then stays on Your Infrastructure, in the country of its choice.
12. Government Access Requests
If a public authority asks Scolah to disclose Customer Personal Data, Scolah will:
- Notify the Customer, unless the law prohibits it
- Ask the authority to approach the Customer directly
- Challenge requests it considers unlawful, and disclose only the minimum required
Scolah has no access to data on Your Infrastructure and cannot disclose it.
13. Liability and Precedence
13.1 Each party’s liability under this DPA is subject to the limitations in the Agreement, including Section 9.8 of the Terms. Nothing limits a data subject’s rights under the SCCs.
13.2 If this DPA and the Agreement conflict, this DPA prevails on data protection matters. If the SCCs conflict with this DPA, the SCCs prevail.
13.3 This DPA is governed by the law that governs the Agreement, except where the SCCs or Data Protection Law require otherwise.
Annex 1 — Description of Processing
| Data subjects | The Customer’s portal users (staff and contractors); people whose information appears in AI requests when Scolah-managed AI is enabled; people whose information the Customer shares in support requests |
| Categories of personal data | Names, email addresses, roles, authentication data and activity log entries for portal users. The text of AI requests and responses. Any personal data contained in support material the Customer chooses to share. |
| Special categories | Not intended. AI requests and support material may contain special category data (for example health data) where the Customer chooses to include it. The Customer is responsible for having a lawful basis for that, and for minimising it. |
| Nature of processing | Hosting, storage, transmission, display, processing of AI requests on Scolah-hosted models, deletion |
| Purpose | Providing, supporting and securing the Platform under the Agreement |
| Frequency | Continuous, for the duration of the Agreement |
| Duration and retention | For the term of the Agreement, then as described in Section 9. Activity log entries are kept 365 days. |
| Subprocessors | As listed in Annex 3 |
Annex 2 — Security Measures
The technical and organisational measures are described on our Security Practices page, which forms part of this Annex. In summary:
- Encryption in transit (TLS) and at rest (AES-256-GCM for installation credentials)
- Secrets sealed to individual servers, whose private keys never leave them
- Ed25519-signed software, verified on the customer’s server before anything runs
- No remote access path from Scolah into customer infrastructure
- Role-based access control for customer users and Scolah staff, with audit logging retained for 365 days
- Multi-factor authentication available for all portal users
- Replicated database with 30 days of backups
- Documented incident response with 48-hour breach notification
- Vulnerability disclosure programme with safe harbour
Annex 3 — Subprocessors
Scolah keeps a register of its subprocessors that gives, for each one, its name and address, the processing it carries out, the categories of personal data, the location of processing and the transfer safeguard. That register is this Annex. The categories it covers are published on the Subprocessors page.
Scolah provides the current register to the Customer on request, and with any countersigned copy of this DPA. Requests go to privacy@scolah.com.
To request a countersigned DPA or ask a question: legal@scolah.com · Privacy: privacy@scolah.com