Data Processing Addendum
Effective June 2026 · Working draft pending legal review · Governing law: the State of Minnesota, United States
1Definitions
"Personal Data", "Controller", "Processor", "Processing", "Data Subject", and "Supervisory Authority" have the meanings given in applicable data-protection law (including the GDPR/UK GDPR). "Applicable Law" means the data-protection laws applicable to the Customer's use of Jade OS Labs.
2Roles & scope
The Customer is the Controller and JadeOS is the Processor. JadeOS processes Personal Data only on the documented instructions of the Customer, including as set out in this DPA and the Privacy Policy, and as needed to provide the labs. If JadeOS believes an instruction breaches Applicable Law, it will inform the Customer.
3Subject matter, duration, nature & purpose
| Subject matter | Provision of the Jade OS Labs learning platform. |
| Duration | For the term of the Customer's subscription, plus the retention periods in §8. |
| Nature & purpose | Hosting, storing and processing learner data to deliver labs, save progress, issue certificates, and support instructors. |
| Categories of data subjects | Students/learners, instructors, and administrators authorised by the Customer. |
| Types of personal data | Name, email, hashed credentials, learning progress, quiz/mastery scores, certificates, AI-tutor messages, order status. No special-category data is required. |
4Processor obligations
- Process Personal Data only on the Customer's documented instructions.
- Ensure personnel authorised to process data are bound by confidentiality.
- Implement the technical and organisational measures in Annex A.
- Not sell Personal Data and not use it for advertising.
- Assist the Customer, where reasonable, with data-protection impact assessments and prior consultations.
5Subprocessors
The Customer authorises JadeOS to engage the subprocessors listed below. JadeOS imposes data-protection obligations on each subprocessor no less protective than this DPA and remains responsible for their performance. JadeOS will give notice of intended changes, allowing the Customer to object on reasonable data-protection grounds.
| Subprocessor | Purpose |
|---|---|
| MongoDB (managed hosting) | Encrypted database storage |
| Stripe | Payment processing (status/amount only) |
| Anthropic / OpenAI / Google | In-lab AI instructor responses |
| Resend | Transactional email |
| Emergent object storage | Durable media assets (where used) |
6Data-subject requests
Taking into account the nature of the processing, JadeOS will assist the Customer by appropriate technical and organisational measures, insofar as possible, to respond to requests to exercise data-subject rights (access, rectification, erasure, restriction, portability, objection). If JadeOS receives a request directly, it will refer the data subject to the Customer unless legally required otherwise.
7Personal-data breaches
JadeOS will notify the Customer without undue delay after becoming aware of a Personal Data breach affecting the Customer's data, and provide information reasonably available to help the Customer meet its notification obligations.
8Return & deletion
On termination, and at the Customer's choice, JadeOS will delete or return the Personal Data and delete existing copies, except where retention is required by law (e.g. payment records). Default retention periods are set out in the Privacy Policy.
9Audits
JadeOS will make available information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, subject to reasonable confidentiality and scheduling terms.
10International transfers
Where Personal Data is transferred outside the Customer's jurisdiction, the parties will rely on a valid transfer mechanism (such as Standard Contractual Clauses) where required by Applicable Law. [Specific mechanism and any UK/EU addenda to be completed by counsel.]
11Compliance status (honest disclosure)
To avoid misleading Customers: JadeOS operates in a FERPA-aligned manner as a processor and offers this signed DPA. JadeOS is not currently SOC 2, ISO 27001, or independently WCAG-audit certified, and does not claim such certifications. We publish our accessibility audit openly (see the Accessibility Report) and our current data-practices statement on request.
AAnnex A · Technical & organisational measures
- Encryption in transit (HTTPS/TLS) and encryption at rest for the database.
- Passwords stored only as salted hashes; no plaintext credentials.
- Role-based access control; server-side authorisation so learners cannot access other learners' data.
- Brute-force protection and session-token expiry.
- Access and security logging with limited retention.
- Least-privilege administrative access and confidentiality obligations for personnel.
© JadeOS · Jade OS Labs, operated by Oliver T. Cummins, sole proprietor doing business as (d/b/a) JADEOS. This Addendum is a working draft prepared for legal review and is not legal advice. Have counsel finalise the international-transfer mechanism (§10) and liability terms before execution.