Data Processing Agreement

1. Parties, scope and acceptance

1.1 This Data Processing Agreement (DPA) is between uLearnBox Joint Stock Company (ULEARNBOX JOINT STOCK COMPANY, tax code 0110659109), 15th Floor, Viet A Building, 9 Duy Tan Street, Cau Giay Ward, Hanoi, Vietnam (We, Us, uLearnBox) and the Center that uses the Service (the Center).

1.2 This DPA forms part of the Terms of Service (the Terms). The person who accepts the Terms on behalf of a Center, when creating the Center or buying a Plan for it, also accepts this DPA on the Center's behalf. A Center may ask for a copy signed by both parties; the signed copy has the same content.

1.3 This DPA applies only to Center Personal Data (clause 2). Where this DPA and the Terms conflict about Center Personal Data, this DPA prevails. Words with a capital letter that this DPA does not define have the meaning given in the Terms.

2. Definitions

• Data Protection Law: the laws on personal data protection that apply to the processing, including Vietnam's Law on Personal Data Protection (No. 91/2025/QH15) and its implementing decrees, and, where they apply, the EU General Data Protection Regulation (GDPR) and the UK GDPR.
• Center Personal Data: personal data about the Center's Members, invitees and other people that the Center or its Members place in the Service, or that the Service creates while they use it, as described in Annex 1.
• Data Subject: the person that Center Personal Data is about.
• Sub-processor: a third party that uLearnBox engages to process Center Personal Data.
• Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Center Personal Data processed by uLearnBox or its Sub-processors. Unsuccessful attempts that do not compromise Center Personal Data, such as blocked sign-in attempts or port scans, are not Personal Data Breaches.

3. Roles

3.1 For Center Personal Data, the Center is the controller and uLearnBox is the processor.

3.2 uLearnBox is the controller, not the processor, of the personal data the Privacy Policy describes as its own: Center Administrators acting for their Center, billing and invoices, the security of the Service, support requests, Website visits and uLearnBox's own communications, and Accounts that do not belong to a Center. This DPA does not apply to that data.

4. The Center's obligations

4.1 The Center is responsible for:

• having a lawful basis for the processing and giving Data Subjects the notices the law requires;
• obtaining, before adding a child, the consent of the child and of a parent or guardian where the law requires it, including under Vietnamese law for children aged 7 and over;
• placing in the Service only the personal data it needs, and no sensitive personal data (such as health, religion or biometric data) unless the law allows it and the Center has assessed it;
• making sure its instructions comply with Data Protection Law;
• keeping its Administrators' credentials secure and deciding who may access Center Personal Data through the roles it assigns;
• answering Data Subjects' requests about Center Personal Data (clause 10).

5. Instructions

5.1 uLearnBox processes Center Personal Data only on the Center's documented instructions. The Center's complete instructions are: the Terms and this DPA; the Center's use and configuration of the Service, including actions its Administrators take in it (for example inviting, importing or deleting Members, changing retention settings or exporting reports); and other written instructions from the Center's Owner that uLearnBox accepts and that are consistent with the Terms.

5.2 uLearnBox does not use Center Personal Data for its own purposes. In particular, it does not sell it, use it for advertising, or use Center Content, Learner Content or Learning Records to train artificial intelligence models.

5.3 uLearnBox tells the Center if, in its opinion, an instruction infringes Data Protection Law, and need not follow that instruction.

5.4 If the law requires uLearnBox to process or disclose Center Personal Data, for example on a request from a competent authority, uLearnBox tells the Center before doing so, unless the law forbids it.

6. Personnel

6.1 uLearnBox gives access to Center Personal Data only to personnel who need it to provide, secure or support the Service, who are bound by written confidentiality obligations that continue after their engagement ends, and who are trained in handling personal data.

6.2 uLearnBox staff do not use the Center's workspace in the Service: a uLearnBox System Admin session cannot use a Center's application interfaces, and the Service has no feature to sign in as a Member. Operating actions, such as provisioning or suspending a Center or recovering its Owner, are recorded in an audit log. Direct access to the database or to backups is limited to the few operators who run the Service, and only to operate, secure or restore it.

7. Security

7.1 uLearnBox implements the technical and organizational measures in Annex 2, appropriate to the risk of the processing, and keeps them under review. It will not materially reduce the overall security of the Service during the Center's use of it.

8. Sub-processors

8.1 The Center authorizes uLearnBox to engage the Sub-processors listed in Annex 3. uLearnBox publishes the current list at ulearnbox.com/support/subprocessors.

8.2 uLearnBox imposes on each Sub-processor, in a written contract, data protection obligations no less protective than this DPA, and is liable for its Sub-processors as for its own acts.

8.3 uLearnBox tells the Center's Owner by email at least 30 days before a new Sub-processor starts processing Center Personal Data. The Center may object in writing on reasonable data protection grounds within 10 business days of the notice. The parties will then try in good faith to find a solution, for example a change in configuration. If they cannot within 30 days, the Center may end its use of the Service, and uLearnBox refunds the prepaid fees for the period after the end date.

8.4 In an emergency, for example to replace a Sub-processor that has failed or become insecure, uLearnBox may engage a new Sub-processor with shorter notice and tells the Center as soon as possible; the objection right in 8.3 still applies.

9. International transfers

9.1 The servers, database and file storage of the Service are located in Singapore. Some Sub-processors process Center Personal Data in other countries, as Annex 3 shows. uLearnBox transfers Center Personal Data abroad only in accordance with Data Protection Law. Under Vietnamese law, it prepares and keeps its own cross-border transfer impact assessment and provides the Center with the information it reasonably needs for the Center's own assessment.

9.2 Where the GDPR or the UK GDPR applies to a transfer, the parties rely on an adequacy decision or, failing one, on the standard contractual clauses adopted for that purpose, which uLearnBox will sign on the Center's request.

10. Data Subject requests

10.1 The Service gives the Center tools to answer Data Subjects' requests itself, including: viewing and correcting Member profiles; exporting reports and gradebooks; exporting a full copy of the Center's data (clause 13.1); suspending a Member; deleting a Member (clause 13.2); and receiving the account deletion requests that Members send from Account settings on the Website or in the mobile apps.

10.2 If uLearnBox receives a request from a Data Subject about Center Personal Data, it forwards it to the Center within 5 business days and tells the Data Subject it has done so. uLearnBox does not otherwise answer the request unless the Center instructs it to.

10.3 Where the Center cannot answer a request with the tools in the Service, uLearnBox provides reasonable assistance on the Center's request. The Center bears uLearnBox's reasonable costs of assistance beyond the tools in the Service.

11. Personal Data Breaches

11.1 uLearnBox notifies the Center's Owner by email without undue delay after becoming aware of a Personal Data Breach affecting the Center.

11.2 The notice describes, as far as then known: the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. uLearnBox gives further information as it becomes available.

11.3 uLearnBox takes reasonable steps to contain the breach and limit its effects, and helps the Center meet its own obligations to notify the competent authority, which under Vietnamese law must be done within 72 hours in the cases the law sets, and the Data Subjects.

11.4 Notifying a Personal Data Breach is not an admission of fault.

12. Impact assessments and authorities

12.1 uLearnBox provides the Center with the information about the Service that the Center reasonably needs for its personal data processing impact assessment and for consulting the competent authority. Under Vietnamese law, uLearnBox prepares and keeps its own processing impact assessment as a processor.

12.2 uLearnBox cooperates with the competent authority as Data Protection Law requires.

13. Deletion and return

13.1 While the Center uses the Service, the Center decides what is deleted, and deletes it with the tools in the Service. At any time, including before the Center is deleted, the Owner can export a full copy of the Center's data in a machine-readable format from the Center settings: one ZIP archive with a CSV file per data set and a description of the files, plus uploaded files such as certificates and assignment submissions up to a size limit (files beyond it are listed but not included).

13.2 Deleting a Member. When the Center deletes a Member, the Member's access ends at once and the Member's personal data in the Center is deleted by automatic cleanup. Results already recorded by the Center are kept only as anonymous statistics (scores and completion totals) that no longer identify the Member. An Account that belongs to the Center is deleted with it.

13.3 Deleting the Center. The Owner may ask uLearnBox to delete the Center and its data. If the Owner asks for time to export data, uLearnBox allows 30 days first. uLearnBox then ends all access to the Center at once, and its data, including its Accounts and anonymous statistics, is deleted by automatic cleanup. A Plan that expires without renewal does not delete anything (see the Terms).

13.4 What is kept. uLearnBox keeps invoices and payment records as tax and accounting law requires, and other data only where the law requires it; it keeps such data confidential and processes it only for that purpose.

13.5 Backups. Deleted data may remain in uLearnBox's encrypted backups for up to 35 days, after which those backups are deleted automatically. Backups are used only to restore the Service after an incident. A restored copy is kept isolated, and before it is put back into service uLearnBox takes reasonable steps to delete from it again the data that was deleted after the backup was made.

13.6 On request, uLearnBox confirms the deletion in writing within 15 business days.

14. Information and audits

14.1 uLearnBox makes available to the Center the information reasonably necessary to demonstrate compliance with this DPA, including this DPA's annexes and answers to a reasonable written security questionnaire, no more than once a year unless a Personal Data Breach or a competent authority requires more.

14.2 Where the information under 14.1 is not enough, or a competent authority requires it, the Center may have an audit carried out by itself or an independent auditor bound by confidentiality, on at least 30 days' written notice, during business hours, limited to the processing of the Center's data and without access to other customers' data. The Center bears its own costs and uLearnBox's reasonable costs, unless the audit finds a material breach of this DPA by uLearnBox.

14.3 uLearnBox keeps a record of the processing it carries out for Centers as Data Protection Law requires.

15. Liability

15.1 Each party's liability under this DPA is subject to the limitations of liability in the Terms, except where the law does not allow them to be limited.

16. Term and changes

16.1 This DPA applies for as long as uLearnBox processes Center Personal Data, including after the Center stops using the Service and until the data is deleted under clause 13.

16.2 uLearnBox may update this DPA as it updates the Terms, with the same notice. An update may not reduce the protection of Center Personal Data unless the law requires it.

17. Governing law

17.1 This DPA is governed by the laws of Vietnam, and disputes are resolved as the Terms provide, unless Data Protection Law or standard contractual clauses signed under clause 9.2 require otherwise.

Annex 1: Details of the processing

• Subject matter: Providing the Service to the Center under the Terms.
• Duration: While the Center uses the Service, and until deletion under clause 13.
• Nature and purpose: Hosting, storing, organizing, displaying and transmitting Center Personal Data; running courses, classes, learning paths, lessons (including SCORM and xAPI), assignments and grading, calendars, reports, certificates and notifications; authenticating Members and securing the Service; providing support.
• Data Subjects: The Center's Members (learners, teachers and other staff), people the Center invites or imports, and people named in content the Center places in the Service. Members may include children.
• Personal data: Identity and contact data (name, email, username, profile picture, interface language, internal codes the Center assigns); Account and security data (password hash, connected Google account identifier, login sessions with hashed IP address and browser, audit log entries with IP address and browser); membership data (Departments, groups, roles, invitation and membership status); Learning Records (enrollments, progress, attempts, scores, grades, completion, SCORM and xAPI data, attendance, certificates); Learner Content (assignment submissions and files, questions and answers); notification data (web notifications, email delivery records, push notification device tokens).
• Sensitive data: Not intended. The Center must not place sensitive personal data in the Service unless clause 4.1 allows it.

Annex 2: Technical and organizational measures

1. Encryption in transit. All traffic to the Service uses HTTPS.
2. Passwords. Passwords are stored only as Argon2id hashes; temporary passwords set by Administrators are encrypted.
3. Separation of Centers. Every Center's data is separated in the database by row-level security, which fails closed: an application request can read and write only the rows of its own Center.
4. Access control. Access inside a Center follows the roles and scopes the Center assigns. Sessions use secure, HTTP-only cookies with protection against cross-site request forgery; administrator sessions expire sooner than learner sessions; sensitive actions require recent sign-in.
5. Abuse protection. Sign-in and other sensitive endpoints are rate limited.
6. Uploaded files. Uploaded files are scanned for malware before use, and lesson packages run on an isolated origin separate from the application.
7. Logging. Security-relevant actions inside a Center are recorded in an audit log that the Center's authorized Administrators can view and export; uLearnBox operating actions are recorded too. Audit log entries are deleted automatically after 12 months, except the history of attendance corrections, which the Class attendance history needs and whose IP address and browser are removed at 12 months instead. Sign-in sessions are deleted 30 days after they expire or are revoked.
8. Backups. The database is backed up daily. Backups are encrypted with public-key encryption before leaving the server; the key that decrypts them is kept off the server. They are kept for at most 35 days. The hosting provider's backups of the encrypted server disk are overwritten automatically within about 14 days.
9. Staff access. uLearnBox staff access Center Personal Data only under clause 6.
10. Incident response. uLearnBox monitors the Service and handles incidents under clause 11.

Annex 3: Sub-processors

The Sub-processors that uLearnBox engages, the service each provides, the Center Personal Data it processes and its location are listed at ulearnbox.com/support/subprocessors. That list, in the version in effect, forms part of this Annex.

The following are not Sub-processors, because uLearnBox does not use them to process Center Personal Data on the Center's behalf: payment providers (SePay, FastSpring), which process billing data for uLearnBox as controller; MailerLite, which receives only the addresses of people who agreed to uLearnBox's marketing emails; and Google sign-in, which a Member uses with their own Google account.