Data Processing Addendum

This addendum forms part of the Cognya Terms and Conditions between Fayyad Uddin trading as Cognya, 159 Micklefield Road, High Wycombe, HP13 7HA, United Kingdom (“Cognya”), and the subscribing tutor or organisation (“Customer”).

It applies to personal information Cognya processes on the Customer’s behalf to provide the service (“Customer Student Data”). The Customer is controller and Cognya is processor for that processing. UK data-protection terms have their meanings in the UK GDPR and Data Protection Act 2018, as amended.

This addendum takes priority over conflicting service terms concerning processor activities. It does not reduce anyone’s direct statutory obligations or an individual’s rights.

It does not appoint Cognya as processor for activities for which Cognya actually decides its own purposes, including the separate manual quality-check activity identified in the Privacy Policy. Those controller activities are described in the Privacy Policy. This addendum does not authorise unrestricted reuse or provide consent on a child’s behalf.

The Customer’s documented instructions consist of this agreement, selected features, operations through the account and lawful support instructions. Instructions to use features are limited to processing described in the service documentation and this addendum.

The Customer determines and documents its lawful basis, supplies required notices, ensures data is relevant and accurate, and maintains appropriate security for its account and passcodes. The Customer must reasonably check and separately confirm that each student is aged 14 or over before homework access is enabled and report an incorrect confirmation promptly. These obligations do not remove Cognya’s own statutory responsibilities. Neither party assumes that a tutor can always give consent for a child.

Cognya will process Customer Student Data only on documented instructions, including concerning transfers, unless required by applicable law. Where legally permitted, Cognya will notify the Customer of such a requirement before processing. Cognya will promptly inform the Customer if an instruction appears to infringe applicable data-protection law and may pause the affected processing while the parties resolve it.

Cognya will ensure authorised people with access are bound by confidentiality obligations and restrict access to what their role requires. Cognya will implement appropriate technical and organisational measures under Article 32, considering risk, including risks to children.

Access controls prevent a tutor from accessing another tutor’s students or homework. The Supabase project is hosted in eu-west-1 (Ireland). Cognya currently uses the Supabase Free plan without an included customer-accessible project-backup/restore facility. No restoration from a customer project backup is promised where that facility is not available.

Changes must not materially reduce overall protection. The Customer remains responsible for security of systems and data within its own control.

The security measures include HTTPS connections, tutor-account authentication, access controls separating tutors’ student/homework records, restricted administrator access and controls limiting repeated invalid authentication or homework-code attempts. Cognya will maintain measures appropriate to the risk and review their effectiveness. It will restrict retained copies and assess the availability and recovery arrangements appropriate to the service.

The Customer gives general written authorisation for the subprocessors listed below, for the stated tasks. Cognya will bind each relevant subprocessor to equivalent applicable data-protection obligations and remains responsible to the Customer for its performance of those obligations.

Cognya will give the Customer advance written notice by email of intended additions or replacements, with a reasonable opportunity to raise a substantiated data-protection objection before the new provider starts the relevant processing. The parties will seek a workable alternative. If the concern cannot reasonably be resolved, they will discuss ending the affected service and returning or deleting its data.

The Privacy Policy separately describes Google tutor sign-in, Stripe payments and Anthropic worksheet generation. They are not listed here as recipients of the ordinary student records processed on the Customer’s behalf. If a feature changes so another provider receives Customer Student Data, the subprocessor provisions above apply.

Cognya will make or authorise restricted transfers only in compliance with applicable transfer rules and documented instructions, with the required mechanisms, assessments and information available to the Customer. A list of providers alone is not a transfer safeguard.

Cognya will promptly inform the Customer of requests concerning Customer Student Data and provide reasonable assistance with access, correction, erasure, restriction, objection and portability where applicable. Except where required by law or authorised, Cognya will not decide the Customer’s response independently. Available self-service controls do not replace assistance needed to meet legal rights.

Cognya will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Student Data. It will provide available information about the nature of the incident, affected records and people, likely consequences and corrective measures, updating it as information becomes available. Notification must not wait for every fact to be confirmed.

Cognya will provide reasonable assistance with the Customer’s security obligations, breach assessments and notifications, DPIAs and any required regulatory consultation, taking account of the nature of processing and information available. Each party remains responsible for its own statutory duties. Breach notification does not itself constitute an admission of liability.

Cognya will make available information necessary to demonstrate compliance with Article 28 and allow and contribute to proportionate audits and inspections by the Customer or its independent auditor. The parties may agree confidentiality, security and reasonable notice arrangements, provided these do not obstruct legal rights, urgent incident-related review or regulator access. Unrelated customer information must remain protected.

Cognya will maintain required processor records and cooperate with the regulator as required by law.

At the end of relevant processing, Cognya will, at the Customer’s choice, return or delete Customer Student Data and delete existing copies unless applicable law requires retention. A paid subscription or beta may become a continuing Free account, subject to its plan limits and retention rules.

The Customer instructs Cognya to delete a Free account and its associated student and homework records after 30 consecutive days without either a tutor sign-in or associated student homework activity. Either activity restarts the period. Cognya will send an email warning before deletion. An active paid subscription or Pro beta is excluded. An account moving to Free receives a full 30-day period from the downgrade date, restarted by later qualifying activity.

Customers may use the available controls to delete students, homework and accounts. If a return of information or a rights request requires assistance, contact support@cognya.co.uk. The absence of a self-service export does not eliminate the obligation to provide required assistance or an agreed return.

Where return is requested, Cognya will agree a reasonably usable electronic format with the Customer and provide it without undue delay. The absence of a self-service export button does not prevent a request. Following an instructed account deletion, associated live student and homework records are removed. Any copies that cannot immediately be erased must be restricted from ordinary use and removed under an appropriate retention cycle; legal retention exceptions must be identified and limited.

Cognya will identify any legally required retention, its basis and restrictions where permitted, and confirm completion of deletion or return on reasonable request.

Contact support@cognya.co.uk for instructions, incidents and requests. The governing-law provisions of the main agreement apply, without limiting data subjects’ mandatory rights or regulator powers.