Data Processing Agreement.

1. Definitions

ControllerProcessorPersonal Data and other terms have the meanings given in Regulation (EU) 2016/679 (GDPR).

“Services” means the AI-powered learning platform operated by Omie as described in the subscription agreement (“Main Agreement”). “Sub-processor” means any third party engaged by Omie to process Personal Data.

2. Processing details

Nature and purpose

Omie processes Personal Data solely to provide, operate, and improve the Services—including storing learning records, personalising content with AI, delivering transactional emails, and generating aggregated analytics.

Categories of data subjects

• Employees or learners enrolled on the platform by the Controller.
• Managers and team administrators designated by the Controller.

Categories of personal data

• Identifiers: name, work email, job title, seniority.
• Learning data: completed lessons, quiz scores, skill ratings.
• Preference data: language, learning style, notification settings.
• Usage telemetry: page views, session duration (anonymised after 90 days).

Omie does not process special category data (Art. 9 GDPR) unless the Controller explicitly enables functionality that requires it and confirms a valid lawful basis.

Duration

Processing continues for the term of the Main Agreement. Upon termination, Omie deletes or returns Personal Data within 30 days unless longer retention is required by law.

3. Processor obligations

Instructions

Omie processes Personal Data only on documented instructions from the Controller, as set out in this DPA and the Main Agreement.

Confidentiality

All persons authorised by Omie to process Personal Data are bound by contractual or statutory confidentiality obligations.

Security

Omie implements and maintains the technical and organisational measures in Section 4 below (and Annex II of the PDF). These are reviewed and updated no less than annually.

Sub-processors

The Controller grants general authorisation for Omie to engage the sub-processors listed at tryomie.com/legal/subprocessors. Omie provides at least 30 days’ advance notice before adding a new sub-processor. If the Controller objects on legitimate grounds within that period, Omie will use reasonable efforts to accommodate the objection or permit termination without penalty.

Data subject rights

Omie provides technical mechanisms to assist the Controller in responding to data subject requests under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection).

Breach notification

Omie notifies the Controller within 48 hours of becoming aware of a Personal Data breach, including nature, affected categories and count, likely consequences, and measures taken.

Audit

Omie makes available the information reasonably necessary to demonstrate compliance with this DPA and cooperates with audits by the Controller or a mandated auditor, with 30 days’ prior written notice.

4. Technical & organisational measures

Encryption in transit

All connections use TLS 1.3 with strong cipher suites (ECDHE + AES-128-GCM or ChaCha20-Poly1305).

Encryption at rest

All database storage is AES-256 encrypted via Supabase on AWS, with AWS KMS key management.

Backups

Automated daily snapshots retained for 30 days. Point-in-time recovery with a 5-minute RPO. Backups encrypted with separately managed keys stored in multiple EU regions.

Access controls

Row-Level Security on all database tables. Admin access requires MFA and is logged in an immutable audit trail. Production credentials are rotated annually.

Incident response

24/7 on-call rotation for security incidents. Severity-1 issues triaged within 1 hour. Controller notified within 48 hours of a confirmed breach.

5. Standard Contractual Clauses

The parties hereby incorporate the Standard Contractual Clauses approved by EU Commission Implementing Decision 2021/914 of 4 June 2021, Module 2 (Controller to Processor). The options and supplements are as set out in Annex I of the PDF.

Governing law: Dutch law. Jurisdiction: Courts of Amsterdam.