Data Processing and Sharing Agreement

Version 2026.2 (23 October 2026)

This Data Processing and Sharing Agreement (“DPA”) is between Clavia Ltd (company number 09537694, registered in England and Wales), trading as Clavia Group, of George Court, Bartholomew’s Walk, Ely, Cambridgeshire, CB7 4JW (“Clavia”), and the Customer (defined in clause 1). It forms part of the Agreement and is accepted when the Order Form is signed. Clavia’s ICO registration number is C1958948.

1. Definitions

“Customer” means the organisation named as the customer in the Order Form, acting through the people it authorises on the Platform (its administrators and the signatory named in the Order Form).
“Order Form” means the order form for the Customer’s Academy, prepared by Clavia and signed electronically on the Platform by the Customer’s named signatory, including its special conditions.
“Agreement” means the agreement between Clavia and the Customer: the Order Form, Clavia’s Terms of Use (Part 1 and Part 2) as at the version named in the Order Form, and this DPA.
“controller”, “processor”, “data subject”, “personal data”, “personal data breach”, “processing” and “supervisory authority” have the meanings given in the UK GDPR.
“Data Protection Law” means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 and, where they apply to a party’s processing, the EU GDPR and the privacy laws of any US state.
“Platform” means Clavia; “Academy” the Customer’s academy on it; “Learner” anybody with a Clavia account who trains on it; “Customer Content” what the Customer adds to its Academy.
“Processor Data” means personal data Clavia processes on the Customer’s behalf (clause 2 and Annex A).
“Shared Data” means personal data about Learners that the Customer receives through the Platform once a Learner is in its Academy (clause 7 and Annex A).
“Sub-processor” means a third party engaged by Clavia to process Processor Data.
“Transfer Mechanism” means the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, the UK Extension to the EU-US Data Privacy Framework, UK adequacy regulations, or any other mechanism lawful under Article 45 or 46 of the UK GDPR.
“Aggregated Statistics” means anonymous figures drawn from the Platform, never a count smaller than five.

2. How the roles work

2.1 Clavia is one platform with one account per Learner across every academy. The same item of personal data can therefore be held for more than one purpose, and each party’s role depends on the purpose, not on the data:

Processing	Clavia	Customer
A Learner’s account, sign-in, profile and training record across all academies; issuing and verifying Certificates; recording consents; account deletion	Controller	Not involved
Creating and using Aggregated Statistics, including benchmarking and distributor and rep products	Controller	Not involved
Showing a distributor with a paid subscription a Learner by name, where that Learner has switched on sharing with distributors and named that distributor as somewhere they buy — the only way any distributor sees a name	Controller	Not involved
Moving Learners into the Academy from an earlier academy site owned and run by Clavia (terms §18)	Controller	Not involved until the data is Shared Data
Moving Learners into the Academy from a site the Customer owns (or one run for it by another provider), on the Customer’s written instructions (terms §18)	Processor	Controller
The Customer’s use of Learner data it receives once a Learner is in its Academy (viewing, exporting, contacting Learners, its own marketing where the Learner opted in)	Disclosing controller	Independent controller
Operating the Academy for the Customer: hosting Customer Content; its dashboard, reports and AI analysis over its own Academy’s data; managing the Academy where Clavia manages it; class invitations, classes and trainers on the Customer’s instructions	Processor	Controller
Accounts of the Customer’s administrators and trainers	Controller of the account; processor for the Customer’s choice of who holds access	Controller of its staff’s data in its own records

2.2 Part A (clauses 3 to 6) applies where Clavia is the Customer’s processor. Part B (clauses 7 to 9) applies where the parties are independent controllers. Part C (clauses 10 to 13) applies to both.

2.3 Where Clavia processes data as controller, it does so under its own privacy policy, and this DPA does not make the Customer responsible for that processing.

Part A — Clavia as processor

3. Processing on instructions

3.1 Clavia processes Processor Data only on the Customer’s documented instructions, including about international transfers, unless UK law requires otherwise (in which case Clavia tells the Customer first unless the law prohibits it). The Agreement, the Customer’s set-up of its Academy and its use of the Platform’s features are its documented instructions. Further instructions — including an instruction to move Learners from a site the Customer owns — must be in writing and consistent with the Agreement.

3.2 Clavia tells the Customer promptly if, in its opinion, an instruction infringes Data Protection Law.

3.3 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subject are in Annex A.

4. Clavia’s obligations as processor

4.1 Confidentiality. Everyone Clavia authorises to process Processor Data is bound by a duty of confidentiality.

4.2 Security. Clavia implements the measures in Annex B, designed to meet Article 32 of the UK GDPR. It may update them provided the overall level of protection is not materially reduced.

4.3 Sub-processors.

(a) The Customer gives Clavia general written authorisation to engage Sub-processors. Those in use are listed in Annex C, and the Customer authorises them.
(b) Clavia gives the Customer at least 30 days’ notice, by email to its administrators, before adding or replacing a Sub-processor, stating its name, purpose and location.
(c) The Customer may object on reasonable data protection grounds by writing to privacy@claviagroup.com within that period. The parties will discuss it in good faith. If it is not resolved and Clavia cannot reasonably avoid using the Sub-processor for the Customer’s Academy, the Customer may end the Agreement by written notice, and Clavia refunds any fees paid for the period after it ends.
(d) Clavia puts in place with each Sub-processor a written contract giving at least the protection required by Article 28(3) of the UK GDPR, and remains liable to the Customer for each Sub-processor’s performance.
(e) Where a Sub-processor must be replaced urgently to keep the Platform secure or available, Clavia may do so on shorter notice; the right to object then runs from when the Customer is told.

4.4 Requests from individuals. Clavia helps the Customer, by appropriate technical and organisational measures so far as possible, to respond to requests from individuals to exercise their rights. A request Clavia receives about Processor Data is passed to the Customer without undue delay; Clavia only acknowledges it and says where it has gone, unless it also concerns data Clavia controls.

4.5 Assistance. Clavia gives reasonable assistance with the Customer’s obligations under Articles 32 to 36 of the UK GDPR, taking into account the nature of the processing and the information available to it. Clavia may charge its reasonable costs for assistance beyond the Security Overview and its existing documentation.

4.6 Personal data breaches. Clavia notifies the Customer of a personal data breach affecting Processor Data or Shared Data without undue delay and in any event within 48 hours of becoming aware of it, describing so far as then known the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences, and the measures taken or proposed. Clavia provides further information as it becomes available, takes reasonable steps to contain and remedy the breach, and co-operates with the Customer. Notifying is not an admission of fault.

4.7 Deletion and return. When the Agreement ends, Clavia keeps the Customer’s own content for a reasonable period so it can be handed back (terms §19) and then deletes Processor Data, except where UK law requires it to be kept and except data Clavia holds as controller under clause 2.1 (including what is needed to keep Learners’ training records and Certificates). Deleted data drops out of backups as they expire, within 35 days. Working copies of a former site’s data used for a move are deleted once the move has been checked.

4.8 Information and audit. Clavia makes available the information necessary to demonstrate compliance with Article 28 of the UK GDPR, and allows for and contributes to audits: (a) by providing its Security Overview and this DPA; (b) by answering a reasonable written security or privacy questionnaire, not more than once in any 12 months unless there has been a personal data breach or a supervisory authority requires it; (c) by providing, on request, audit log entries relating to the Customer’s Academy; and (d) where (a) to (c) are not enough, by permitting an on-site or remote audit by the Customer or an independent auditor bound by confidentiality, not more than once in any 12 months, on at least 30 days’ written notice, during UK business hours, at the Customer’s cost and without compromising other customers’ data. Sub-processors are audited through their own published certifications and reports.

5. The Customer’s obligations as controller

5.1 The Customer ensures that its instructions comply with Data Protection Law, that it has a lawful basis for the processing it instructs, and that personal data it places in the Platform (for example the email addresses of people it invites to a class, or names in Customer Content) was obtained lawfully.

5.2 The Customer will not place special category data (such as health information) or criminal offence data in the Platform, or ask Learners for it, unless agreed in writing.

5.3 Moving Learners from a site the Customer owns. Before instructing such a move the Customer confirms that it has the right to give Clavia that data for the purpose, and it tells those Learners — before the move — that their accounts and training records are moving to Clavia, and why. It gives Clavia access to the data, or an export of it, by a secure means agreed with Clavia. Each Learner then agrees to Clavia’s terms and privacy policy at their first sign-in, from when Clavia holds their account as controller under clause 2.1.

6. US state privacy laws

6.1 Where Processor Data is subject to the California Consumer Privacy Act or a similar US state law, Clavia acts as the Customer’s “service provider” or “processor” and will not sell or share it; retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than providing the Platform; or combine it with personal information it receives from others, except as that law permits (including to create deidentified Aggregated Statistics).

Part B — Shared Data

7. What is shared, and how

7.1 A Learner’s data becomes Shared Data once the Learner is in the Customer’s Academy: by a deliberate act of their own (accepting the Academy’s welcome screen, entering a class code, or accepting an invitation), or by being moved into it from an earlier academy site under terms §18, in which case they are told and agree to Clavia’s terms at their first sign-in. Browsing the Academy’s public pages shares nothing.

7.2 Shared Data is limited to what relates to the Customer’s Academy: the Learner’s name, email address, company, job role and work address as given on their Clavia profile; their progress, quiz and assessment results, class attendance and questions to trainers in the Customer’s courses; Certificates issued by the Customer’s Academy; and whether they have opted in to marketing from the Customer. The Customer never receives a Learner’s activity, results or Certificates in another academy.

7.3 What Learners say about the brands they buy and where they buy them reaches the Customer only as anonymous counts, never against a name. Feedback is shown only as anonymous summaries (averages from three responses, written comments from five), never with who gave it.

7.4 Clavia tells Learners, in its privacy policy and on the Academy’s welcome screen (or, for a Learner moved from an earlier site, at their first sign-in), that being in an academy shares their record in that academy with its manufacturer, and records the wording each Learner was shown.

8. Each controller’s responsibilities

8.1 Each party is separately responsible for its own compliance with Data Protection Law for the Shared Data it processes, including having a lawful basis and giving any privacy information required.

8.2 The Customer will: (a) use Shared Data only for training-related purposes, managing its relationship with its trained base and compatible purposes, and for marketing only where the Learner opted in to marketing from the Customer’s Academy or the Customer has another lawful basis it can demonstrate; (b) make its own privacy notice available to Learners, which it may list on its Academy’s welcome screen; (c) not attempt to identify the author of anonymous feedback, or re-identify any Aggregated Statistic; (d) keep Shared Data it exports secure, keep it no longer than necessary, and be responsible for transfers it makes of it; and (e) not disclose Shared Data to any other manufacturer, or use it to build a profile of a Learner’s activity outside its Academy.

8.3 Clavia will keep Learners informed as in clause 7.4, apply Learners’ choices (including withdrawn marketing consent and account deletion) on the Platform promptly, and tell the Customer of any personal data breach affecting Shared Data under clause 4.6.

8.4 When a Learner deletes their Clavia account, their data is removed from the Customer’s dashboard and reports. Clavia does not notify the Customer of each deletion; copies the Customer has already exported are its own responsibility.

9. Requests, complaints and co-operation

9.1 A request from a Learner about their Clavia account or training record is Clavia’s to handle; one about the Customer’s own use of Shared Data (its marketing, or its exported copies) is the Customer’s. Either party passes on a request meant for the other within five business days.

9.2 Each party gives the other reasonable assistance with requests, complaints and regulatory enquiries about Shared Data.

9.3 Quizzes and assessments are marked automatically. Where a Learner asks for a human review of a result, Clavia refers it to the Customer, who reviews it, and Clavia provides the attempt information the Platform holds.

Part C — Both parts

10. International transfers

10.1 Processor Data and Shared Data are hosted mainly in the United States (application hosting and database) and the European Economic Area (file storage, video, email and translation), as in Annex C.

10.2 Clavia transfers Processor Data outside the UK only where a Transfer Mechanism applies: for Sub-processors in the EEA, the UK’s adequacy regulations; for Sub-processors in the United States, the UK Extension to the EU-US Data Privacy Framework where the Sub-processor is certified, and otherwise the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

10.3 Where the Customer is outside the UK, the transfer of Shared Data to it is made under the UK Extension to the Data Privacy Framework where the Customer is certified, and otherwise under the UK International Data Transfer Agreement, which the parties will enter into on request. Where the EU GDPR applies to the Customer, the parties will agree the necessary EU Standard Contractual Clauses on request.

10.4 Clavia keeps a record of the transfer risk assessments it has made for its Sub-processors and shares a summary on request.

11. Liability

11.1 Each party’s liability under this DPA is subject to the limits in the Agreement. Nothing in this DPA limits either party’s liability to individuals or supervisory authorities where the law does not permit it.

12. Duration and precedence

12.1 This DPA lasts for as long as Clavia processes Processor Data or the Customer holds Shared Data received under the Agreement, whichever is longer.

12.2 Where this DPA and the rest of the Agreement differ about the processing of personal data, this DPA applies.

13. Changes in law, and to this DPA

13.1 If a change in Data Protection Law, or a decision of a supervisory authority or court, requires this DPA to change, the parties will agree in good faith the minimum change needed. Clavia may replace a Transfer Mechanism with another that is lawful, on notice.

13.2 This page shows the current version. An agreement signed on the Platform keeps the version it was signed with, reproduced in full in the signed copy.

Annex A — Details of the processing

A1. Clavia as processor

Subject matter	Operating the Customer’s Academy on the Platform; and, on the Customer’s written instruction, moving Learners into it from a site the Customer owns.
Duration	The Agreement, plus the hand-back and deletion period in clause 4.7.
Nature of processing	Hosting, storage, retrieval, display, analysis (including by AI features), transmission (including email), translation, backup and deletion; for a move, reading the former site’s data or an export of it and copying it into the Academy.
Purposes	Providing the Academy to Learners for the Customer; its dashboard, reports, Ava and analysis over its own Academy’s figures; managing the Academy where Clavia manages it; classes, trainers and invitations; support; a move the Customer instructs.
Data subjects	Learners in the Customer’s Academy; people it invites to a class; its administrators and trainers; individuals named in Customer Content; for a move, the users of the former site.
Personal data	Names; email addresses; company; job role; work address including ZIP or postcode; course progress; quiz and assessment results and answers; Certificates; class attendance; questions on classroom slides and trainers’ answers; anonymous feedback (used only in aggregate); consent records for the Customer’s Academy (marketing opt-in and agreement to its policies, with the wording shown); invitation status; audit entries of administrator actions. For a move: also former usernames and password hashes (never readable passwords), kept only so Learners can sign in as before.
Special category data	None intended.
Frequency	Continuous; a move happens once, re-run until the switch-over.

A2. Shared Data (independent controllers)

Data subjects	Learners in the Customer’s Academy.
Data shared	As in clause 7.2.
Not shared	Passwords; activity, results and Certificates in other academies; who gave which feedback; brands and buying against a name; private notes on slides; marketing choices for Clavia or other academies.
Customer’s permitted use	As in clause 8.2(a).
How it is shared	Through the Customer’s dashboard, reports and exports on the Platform.

Annex B — Technical and organisational measures

As at October 2026; the Security Overview gives more detail.

B1. Hosting and infrastructure

The Platform runs on managed, serverless hosting and a managed database. Clavia runs no servers of its own; the providers patch operating systems and runtimes.
Software dependencies are kept up to date, with automated vulnerability alerts.
A web application firewall with bot protection and per-address rate limits sits in front of the Platform.
Spending caps are set on every paid provider, so abuse cannot cause runaway use of a service.

B2. Encryption

All traffic uses HTTPS (TLS). The database and file storage are encrypted at rest by their providers (AES-256).
Nightly backups are additionally encrypted, with a key held offline by Clavia, before they leave the database.

B3. Separation between customers

All academies share one database, each record tied to its academy (row-level tenancy).
Every page and action checks the viewer’s rights on the server; reporting views enforce the academy scope inside the database, so a report returns only the signed-in viewer’s own academy’s data.
An automated test signs in as every manufacturer and checks that none can see another academy’s data. It is run as the Platform changes.

B4. Access control and authentication

Sign-in by email and password (at least 10 characters, stored hashed), or Google, Microsoft or LinkedIn. Sessions last up to 30 days.
Two-step verification (authenticator app) is required for Clavia staff and available to every other account.
Rate limits on sign-in and sign-up, and bot checks on sign-up, password-reset requests and enquiry forms.
Fixed roles: learner, manufacturer administrator (own academy only), academy teachers and customer admins (what is seen on that academy only), distributor and rep administrators, Clavia administrator, Clavia support (read-only).

B5. Clavia staff

A small number of Clavia administrators have platform-wide access. Every administrative change is written to an audit log; entries about a customer’s academy are available to it on request.
Staff are bound by confidentiality obligations.

B6. Data minimisation in features

Feedback is anonymous and shown only in aggregate, with minimum response thresholds; Aggregated Statistics are never a count under five.
Email addresses are removed from report results before they are sent for AI analysis; no AI feature writes or runs database queries without a person reviewing them.
Error monitoring strips identity, cookies, headers, request bodies, query strings and email addresses before anything is sent.
Demo tour accounts are temporary and cannot reach real academies, real figures or any paid service.

B7. Uploads and content

Uploaded files are checked by extension and content type, stored on a separate storage domain, and never executed. No raw HTML can be added anywhere on the Platform.
Security headers stop the Platform being framed by other sites and restrict content sniffing, referrer information and browser permissions; a Content Security Policy limits which scripts run on academies with marketing tags.

B8. Availability and backup

Database point-in-time restore for 7 days, and a nightly encrypted copy stored off-site in Western Europe for 35 days; media files are copied nightly. A full restore has been rehearsed.

B9. Incidents

Errors are monitored centrally with personal data stripped. Vulnerability reports are received at support@claviagroup.com, as published in /.well-known/security.txt.
Clavia follows a written incident response procedure, and notifies customers of personal data breaches within 48 hours (clause 4.6).

B10. Not yet in place

Clavia does not yet hold ISO 27001, SOC 2 or Cyber Essentials certification; an independent penetration test and single sign-on (SAML/OIDC) are planned.

Annex C — Sub-processors

Sub-processor	Purpose	Where
Vercel Inc.	Application hosting; web firewall and bot protection	USA (Washington DC region)
Neon Inc. (on Amazon Web Services)	Database	USA (N. Virginia)
Cloudflare Inc.	File storage (images, documents, slides, uploads, recordings, encrypted backups); DNS; bot checks; live webinar rooms	Storage in Western Europe; webinar media and bot checks on its global network
BunnyWay d.o.o. (Bunny.net)	Video hosting and streaming	EU (Slovenia), global delivery network
Resend Inc.	Email (password reset, certificates, notices, invitations)	EU (Ireland)
Anthropic PBC	AI features (Ava, analysis panels, course and script drafting, spam checks)	USA
DeepL SE	Machine translation	EU (Germany)
Stripe Payments Europe Ltd / Stripe Inc.	Payments for paid courses (card details go to Stripe only)	EU and USA
Functional Software Inc. (Sentry)	Error monitoring, with personal data stripped	USA
GitHub Inc.	Runs the nightly backup job (the backup is encrypted in transit)	USA

YouTube and Vimeo are used only where the Customer chooses to embed a video from them; nothing loads from them until the Learner presses play and agrees. They are the Customer’s choice and not Clavia’s Sub-processors. Google, Microsoft and LinkedIn sign-in are used only when a Learner chooses them.