Data Processing Agreement

This DPA applies whenever personal data belonging to a Customer’s invited staff/employees (course progress, question responses, certificates, and account details) is processed through the Service. It does not cover a Customer’s own manager/account data, for which Coaching Explained acts as an independent controller under our Privacy Policy.

For staff/employee personal data, the Customer organization is the data controller (or “business” under the CCPA) — it’s the Customer’s employment relationship with its own staff, and the Customer who decides which staff are invited and what training they’re assigned. Coaching Explained is the data processor (or “service provider”) — we process that data only to provide the Service, and only on the Customer’s documented instructions as expressed through their account configuration and our Terms of Service.

• Subject matter: provision of a staff training platform — course delivery, progress tracking, quiz responses, and certificate issuance.
• Nature & purpose: receiving, storing, and displaying staff course progress and question responses, generating certificates, and (where the Customer uses AI tools) processing video transcripts or instructions to generate lesson content for that Customer’s own courses.
• Categories of data subjects: the Customer’s own invited staff/employees.
• Categories of personal data: name and email address, video watch progress, quiz/question responses, course completion status, and certificates earned.
• Duration: for as long as the Customer’s account is active and retains the data, per our retention terms.

The Customer generally authorizes Coaching Explained’s use of sub-processors to provide the Service, listed in full in our Privacy Policy (currently: Anthropic, OpenAI, AssemblyAI, Neon, Vercel, Cloudflare, Stripe, Resend, Upstash, and Sentry). We’ll update that list if it changes and, on request, notify a Customer who has asked to be informed of new sub-processors.

Coaching Explained maintains technical and organizational measures appropriate to the risk, including encryption in transit (TLS), hashed passwords, access controls restricting production data access to personnel who need it, and rate-limiting against abusive traffic. See our Privacy Policy for more detail.

Where staff/employee personal data originating in the EEA, UK, or Switzerland is transferred to the United States (where Coaching Explained and most of its sub-processors operate), that transfer is made subject to Standard Contractual Clauses and/or a relevant Data Privacy Framework certification, as described in our Privacy Policy.

Coaching Explained will notify affected Customers without undue delay after becoming aware of a confirmed security incident affecting their staff’s personal data, and will provide reasonably requested information and cooperation to help the Customer meet its own notification obligations to regulators or data subjects.

This page is a summary of our standard DPA terms. If your organization requires a formally executed copy, a specific SCC module annex, or has questions about a particular sub-processor, email legal@coachingexplained.com and we’ll follow up.