Data Processing Addendum

This Data Processing Addendum (DPA) forms part of the Terms & Conditions between Grand Cayman Group Ltd. ("we", operator of Workflow Academy) and the customer who agrees to them.

• Where an organization enrols its own members, that organization is the controller of its members' learning records and we act as processor on its documented instructions.
• Where an individual purchases access directly, we act as controller of that account relationship.

This DPA applies only where it is expressly incorporated into an order form or other written agreement signed or accepted by the customer. It does not otherwise vary the Terms & Conditions and is not automatically binding on individual purchasers.

This is a standard template. It is subject to legal review and to customer review or negotiation before it is incorporated into an agreement.

Workflow Academy is independent professional training. It is not affiliated with, endorsed by, or certified by OpenAI.

We process personal data only to deliver the courses, record progress and assessment evidence, issue and verify certificates, administer enrolments and entitlements, secure the service, and support learners. Processing lasts for the duration of the customer relationship, plus any retention period the customer configures or that we must observe for legal, accounting, or certificate-verification purposes.

Data subjects: learners, organization administrators, instructors, and content editors.

Personal data: account identifiers (email, display name), authentication metadata, organization and group membership, enrolment and entitlement records, lesson progress, quiz and assessment attempts, workbook responses and uploaded artifacts, capstone submissions and reviewer feedback, certificate records, support tickets, tutor conversation history, and administrative audit records.

We do not process payment card data. Card details are collected and processed by Paddle as merchant of record.

• Process personal data only on the controller's documented instructions and as needed to deliver the service.
• Keep personal data confidential and limit access to personnel and service identities that require it.
• Assist the controller with data subject requests, including access, export, correction, and erasure.
• Make available the information needed to demonstrate compliance with this DPA.
• On termination, delete or return personal data in line with the retention settings the controller has configured, except where retention is legally required.

The measures below are implemented in the platform today:

• Application data is protected by row-level security policies, with forced row-level security on the tenant and control-plane surfaces where it is configured.
• Access is governed by an explicit role and capability model (student, instructor, content editor, administrator, and a narrowly scoped maintenance service identity), enforced in the user interface, server functions, and database policies.
• Authoritative decisions about enrolment, grading, completion, publication, certificates, roles, and entitlements are made server-side; the browser only displays state.
• Private files (submissions, private resources, certificates, packaged course content) are stored in non-public buckets and delivered through short-lived signed URLs issued after a server-side authorisation check.
• High-impact administrative actions write audit records, including role changes, enrolment and entitlement changes, publication and rollback, certificate actions, and destructive actions.
• Platform administrators have no standing read access into organization data; support access is time-boxed and visible to the tenant.
• Payment webhooks are signature-verified, replay-resistant, and idempotent.
• Data is transmitted over TLS. Storage-level encryption at rest is a property of the managed hosting and database providers and of the deployment plan in use; we do not restate it as a control of our own, and we can confirm the position applicable to your contract on request.
• Optional multi-factor authentication is available per user, and organizations can require it through an organization authentication policy alongside session maximum-age and idle-timeout settings.

We do not currently hold SOC 2, ISO 27001, PCI DSS, or HIPAA attestations, and we have not commissioned an independent penetration test. We do not claim any of them.

We use a small number of subprocessors to host and operate the service. The current list, including what each one processes, is published at /subprocessors. We remain responsible for their processing under this DPA. Where a change to the list is material, we will publish the updated list before the change takes effect.

Paddle is treated separately. Paddle is the merchant of record for purchases and determines its own processing for payment, tax, and fraud purposes, so it acts as an independent controller or as a payment service provider in its own right rather than as a subprocessor acting solely on our instructions.

Personal data is processed in the hosting regions configured for the deployment by the operator. Because the region is an operator-configured setting rather than a fixed platform property, we do not state a single region here. Contact us at info@grandcaymangroup.com for the region applicable to your contract.

• Access and export: learners can export their own account and learning records from within the application.
• Correction: learners can update their own profile fields; administrators can correct administrative records.
• Erasure: an administrator-operated erasure and anonymisation mechanism removes or pseudonymises personal identifiers while retaining the academic and financial history we are required to keep. Administrator and service accounts are protected from accidental erasure.

Send requests to info@grandcaymangroup.com. Where we act as processor, we refer the request to the controlling organization and assist it.

Essential browser storage is used to keep you signed in: the authentication client stores your session, and one first-party cookie records a navigation preference. When you start a purchase, Paddle's hosted checkout is loaded and may set its own cookies under its policies.

The application code contains no advertising or analytics stack, so no non-essential first-party consent banner is presented. If we later introduce analytics or advertising technology, we will add a consent mechanism before doing so.

If we become aware of a personal data breach affecting personal data we process, we will notify the affected customer without undue delay and provide the information available to us so the controller can meet its own notification duties. We maintain internal runbooks for access and payment incidents.

On reasonable written request, and no more than once a year unless required by a supervisory authority, we will provide available documentation about the measures described above. We do not currently offer third-party audit reports or certifications.

This DPA is governed by the laws of the Cayman Islands.

Grand Cayman Group Ltd. · info@grandcaymangroup.com