This Data Processing Agreement ("DPA") forms part of the Terms of Service between Edushade ("we", the processor) and the organization that runs a learning platform on Edushade ("you", the controller). It applies whenever we process personal data of your learners, staff or visitors on your behalf. You accept it when you accept the Terms of Service.

1. What we process, and why

Purpose: providing the Edushade platform to you: hosting your site and learning content, accounts and sign-in, enrollments and progress, assessments, payments, messages and notifications, and the reports you see.
People: your learners, instructors, admins and site visitors.
Data: names and contact details, sign-in details, learning progress and grades, quiz answers and assignments, payment records, messages and posts, device and usage information, and anything else you or they put on the platform.
Duration: for as long as you use Edushade, then as set out in section 9.

We process this data only on your documented instructions, which are these terms and the settings you choose in your admin panel. If we think an instruction breaks data protection law, we tell you.

2. Confidentiality

Everyone at Edushade who can access your data is bound to keep it confidential and accesses it only to run, support or secure the platform. Support staff access is recorded in your audit log.

3. Security

We protect the data with measures suited to the risk, including: encrypted connections (TLS) for all traffic; encryption of stored secrets such as payment and sign-in credentials; per-organization separation of data; access control by role, with two-factor sign-in available for every account; audit and activity logs; regular backups; and prompt security updates.

4. Sub-processors

You authorize the sub-processors listed on our Sub-processors page. We tell you before adding or replacing one, so you can object; if we cannot reasonably meet your objection, you may end the service. Each sub-processor is bound by data protection terms at least as protective as these, and we remain responsible for them.

5. Helping you answer people's requests

The platform lets you answer data subject requests yourself: a learner can download a copy of their data and delete their account from their settings, and your admins can do both on a learner's behalf (Users › Personal Data). Where you need more, we help within a reasonable time.

6. Breaches

If we become aware of a breach affecting your data, we tell you without undue delay, and within 48 hours, with what we know and what we are doing about it, so you can meet your own reporting duties.

7. Impact assessments

We give you the information you reasonably need for a data protection impact assessment or consultation with a regulator about the platform.

8. International transfers

Your data is stored on servers in Bangladesh. Where a sub-processor processes it elsewhere, the transfer is covered by appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

9. When the service ends

When you stop using Edushade, you can export your data first. We then delete your organization's personal data within 90 days, except where the law requires us to keep something (for example billing records), which we keep only as long as required.

10. Audits

We make available the information needed to show we meet this DPA. You may audit us, or have an independent auditor do so, once a year with 30 days' notice, at your cost, without disrupting other customers.

11. Contact

Questions about this DPA: [email protected].

Last updated: 3 October 2026.