Coursebox Data Processing Agreement (DPA)

Updated 24th September 2026

The Coursebox Data Processing Agreement (DPA) sets out how Coursebox processes personal data on your behalf when you use the Coursebox platform. It forms part of the Coursebox Client Terms.

This article summarises what the DPA covers and how to get a signed copy if your organisation needs one.

View or download the Coursebox DPA: Coursebox Data Processing Agreement

Questions about the DPA: privacy@coursebox.ai

Who the DPA applies to

The DPA applies automatically to every Account Holder who agrees to the Client Terms, on every plan. No separate signature is needed for it to take effect.

If your organisation needs a separately signed copy, for example for procurement or a vendor review, contact privacy@coursebox.ai. Enterprise customers can also agree additional terms, such as Contractual Data Residency, in their Enterprise agreement.

Roles under data protection law

Your organisation is the Controller. You decide what personal data is collected about your admins and learners and why.
Coursebox is the Processor. We process that personal data only to provide and secure the Coursebox services, and only on your documented instructions.

The DPA covers the EU GDPR, UK GDPR, the Australian Privacy Act 1988, the Swiss FADP, and the CCPA and comparable US state privacy laws. Under US state laws, Coursebox acts as a service provider and does not sell or share personal data.

What the DPA covers

Details of processing: the categories of people (admins, learners, course creators and instructors) and data (identity, account, learning, communication, usage and uploaded content data) and why it is processed.
Security measures: encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access with MFA for admin access, penetration testing, logging and monitoring, and staff background checks and training.
Sub-processors: the list of authorised sub-processors and how changes are notified.
International transfers: the safeguards used when data is processed outside the EEA, UK or Switzerland.
Data breaches: notification without undue delay, and within 72 hours at most, after Coursebox becomes aware of a breach affecting your data.
Data subject rights: how Coursebox helps you respond to requests for access, correction, deletion, restriction, portability and objection.
Audits: the information and audit support Coursebox provides to demonstrate compliance.
Return and deletion: how your data is handled at the end of the agreement.

International transfers and Standard Contractual Clauses

Where personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, the DPA relies on the EU Standard Contractual Clauses (SCCs), Module Two (controller to processor). The UK Addendum applies to UK transfers, and the SCCs apply with the required changes for Swiss transfers.

AI processing

Some processing happens outside your hosting region, whatever region you choose:

Azure OpenAI Service and Azure AI Speech run in US regions.
Google Vertex AI requests are served through Google's global endpoint, which may include the US.
Every other sub-processor processes data in the location listed for it in the DPA.

Your hosting region controls where the Coursebox platform stores your data at rest. It does not change where these sub-processors process data.

Coursebox does not use your personal data, course content or learner data to train or fine-tune any Coursebox model. Our AI sub-processors are engaged on terms that prohibit using your data to train or improve their models.

Optional AI features can be disabled for your environment on request if your organisation's policy requires it. AI-assisted authoring, assessment and grading features are designed for human review before content is published or results are released.

Sub-processors

Under the DPA, you give Coursebox general written authorisation to engage sub-processors. These cover hosting, AI inference and content generation, AI video and voice, document OCR, vector search, billing and payments, support messaging, product analytics, error monitoring, LLM tracing and Enterprise SSO.

The current list, with each provider's purpose and location, is published in our Privacy & Security article.

Change notices: Coursebox will update the published list before any new or replacement sub-processor starts processing your data. To also get these notices by email, ask to subscribe at privacy@coursebox.ai.

Objections: if you have reasonable data protection grounds to object to a new sub-processor, tell us in writing within 30 days of the notice. We will discuss it in good faith. If it cannot be resolved, you can end the affected services without penalty.

Hosting and data residency

By default, Coursebox portals are hosted on Google Cloud Platform in our EU (France) region.

On eligible plans, your portal can be hosted in a different Google Cloud region. Enterprise customers can also agree Contractual Data Residency in a named Google Cloud region as part of their Enterprise agreement.

Backups, recovery and deletion

Standard: daily backups retained for 14 days (RPO 24 hours, RTO 12 hours).
Isolated Database (Enterprise add-on): a dedicated database with same-region replicas and point-in-time recovery, backup retention extendable to 30 days, and recovery targets of RPO under 1 hour and RTO under 4 hours.
At the end of your agreement: we return or delete your personal data, at your choice, within 30 days. Copies in encrypted backups are deleted when the backup cycle ends (14 days, or up to 30 days with Isolated Database). Written confirmation of deletion is available on request.

Certifications

GDPR: Coursebox Pty Ltd is certified by American Quality Standards Registrars (AQSR), Certificate Number 17412. You can verify it at www.aqsrworld.com.
ISO 27001: company-level certification is in progress.
SOC 2: Coursebox does not currently hold SOC 2.
Our hosting provider, Google Cloud Platform, is certified to ISO 27001, ISO 27017, ISO 27018 and SOC 2.

How to get a signed copy

Email privacy@coursebox.ai and let us know you need a separately signed DPA.
Enterprise customers can also raise this with their Account Manager. Tell us your preferred hosting region if you need Contractual Data Residency.
If your organisation uses its own DPA template or has a vendor security questionnaire, send it through and our team will review it.

Privacy & Security

This article is a summary for information only. The DPA and the Client Terms (and, for Enterprise customers, your Enterprise agreement) are the binding terms of your agreement with Coursebox.