Data Processing Agreement (DPA)

Last updated: 2026-10-06

When your organization ("Controller") uses Kwizmo Litoria to train and certify its employees, Kwizmo d.o.o. ("Processor") processes personal data about those employees on the Controller's behalf. This page summarizes the terms that apply to that processing. A signed, organization-specific version of this DPA is available on request - see Contact below.

Subject matter and duration

The Processor processes employee personal data for the duration of the Controller's active use of the platform, for the purpose of providing AI-literacy training, examination, certification, and related governance reporting.

Nature and purpose of processing

Storage, retrieval, and reporting of: employee name and email, training and exam progress and results, certificate issuance data, and (optionally) role/industry classification - all as described in the Privacy Policy.

Processor obligations

• Process personal data only on the Controller's documented instructions, as reflected in the Controller's use of the platform.
• Ensure persons authorized to process the data are bound by confidentiality.
• Implement appropriate technical and organizational security measures (see the Security page).
• Assist the Controller in responding to data subject rights requests and in meeting its own compliance obligations, where reasonably possible given the nature of the platform.
• Notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data.
• At the Controller's choice, delete or return employee personal data at the end of the engagement, except where retention is required by law.
• Make available information reasonably necessary to demonstrate compliance with this DPA.

Sub-processors

The Processor uses SendGrid (Twilio Inc.) as a sub-processor for transactional email, where email sending is configured. The Controller consents to the use of this sub-processor and will be informed of any change of sub-processor used for its data.

Anthropic (optional AI features). Where the Controller's administrator configures its own Anthropic API key to enable the AI use-case risk assessment or "Can I use AI for this?" assistant features, Anthropic PBC is not engaged by the Processor as a sub-processor under this DPA. Instead, the Controller supplies its own API credentials and is itself party to its own, independent agreement with Anthropic governing that processing. The Processor's platform technically transmits the text the Controller's users submit through these features to Anthropic's API using those credentials, generates a response, and separately stores both the submitted text and Anthropic's response in the Processor's own systems as part of the relevant feature's records (use-case register / assistant history). The Processor makes no representation regarding Anthropic's own data handling, retention, or model-training practices - these are governed solely by the Controller's own agreement with Anthropic. If this feature is not configured, no data is transmitted to Anthropic.

International transfers

Where a sub-processor is located outside the EEA, transfers are made subject to appropriate safeguards (e.g. Standard Contractual Clauses) as required by applicable data protection law.

Requesting a signed copy

If your organization requires a countersigned, org-specific DPA (e.g. for your own compliance records), contact us and we will provide one for signature.

Contact

Kwizmo d.o.o. · Contact us