Data Processing Agreement (Template)

1. Status of this document

This is a counsel-ready template for Organisation customers (schools and tutoring centres). It should be reviewed by Australian privacy counsel and executed as a signed agreement before production Organisation deployments. Contact hello@censai.com.au to obtain an executable version.

2. Parties and roles

• Processor / contracted service provider: Censai
• Controller / APP entity for Organisation-provided student data: the Organisation
• For consumer accounts created directly by individuals, Censai’s Privacy Policy applies and this DPA does not re-characterise that relationship

3. Subject matter and duration

• Subject matter: hosting and operation of Censai for exam-preparation learning, including accounts, practice attempts, learning profiles, optional AI tutoring, and staff administration
• Duration: for the term of the Organisation agreement and until deletion/return under this DPA
• Nature: collection, storage, retrieval, organisation, disclosure to sub-processors, deletion
• Purpose: provide the Service on the Organisation’s instructions

4. Types of personal information and data subjects

• Students: name/display name, email, year level, subjects, jurisdiction, learning activity, AI tutoring content, progress metrics
• Staff: name, email, role, organisation affiliation
• Parents/guardians: only if provided by the Organisation for notices/billing (minimise)
• Special categories/sensitive information: not sought; Organisation must not upload health/biometric data

5. Processing instructions

Censai will process personal information only on documented instructions from the Organisation (including product configuration such as AI enabled/disabled), unless required by Australian law.

6. Security measures

• TLS in transit; encryption at rest via infrastructure providers
• Access controls, MFA for admin accounts, server-side secrets
• Row Level Security and organisation-scoped authorisation when Organisation Accounts are enabled
• Personnel limited to those who need access

7. Sub-processors

The Organisation authorises the sub-processors listed in Censai’s Privacy Policy / sub-processor register (Supabase, Vercel, Upstash, OpenAI for AI features if enabled, Stripe if used for that Organisation’s billing, transactional email). Censai will provide notice of material sub-processor changes and allow objections on reasonable privacy grounds where required by the signed DPA.

8. Overseas processing

Primary persistent application data is stored in Australia (Sydney). Limited overseas processing may occur for AI inference (if enabled), payments, email, and edge hosting as disclosed. The Organisation instructs Censai to undertake those transfers subject to APP 8-aligned safeguards described in the Privacy Policy.

9. Assistance

• Assist with access, correction, and deletion requests relating to Organisation-managed data
• Assist with Notifiable Data Breach assessments reasonably required
• Make available information reasonably necessary to demonstrate compliance with this DPA

10. Breach notification

Censai will notify the Organisation without undue delay after becoming aware of a personal data breach affecting Organisation personal information, targeting notice within 24–72 hours of a confirmed eligible breach, and will provide information reasonably available to help the Organisation meet its own obligations.

11. Return and deletion

Upon termination or written request, Censai will delete Organisation-linked personal information from production systems within 30 days (or sooner via org offboarding tools when available), subject to backups rolling off per vendor retention, legal holds, and retention of irreversibly anonymised aggregates.

12. AI annex

• If AI is enabled, student messages and question context may be processed outside Australia for inference
• No use of student content to train foundation models
• Organisation may disable AI features when supported

13. Contact

Censai — hello@censai.com.au