Data Processing Agreement (DPA)

This is the template AVD Labs offers every customer. The version signed with each customer forms part of its contract and prevails over this page.

1. Parties and subject matter

The Company (controller) engages AVD Labs LLC (processor), a Florida, United States company with its address at 1127 Royal Palm Beach Blvd, Ste 183, Royal Palm Beach, FL 33411, to process personal data on its behalf through Kenavia, for the sole purpose of delivering the contracted service: creating, delivering and certifying training programs for the Company’s staff.

2. Duration

For as long as the service is in force. On termination, AVD Labs returns the Company’s data (platform export) and deletes or anonymises it within the periods of its retention policy, except what the law requires to keep.

3. Data and data subjects

Categories of data subjects: employees and collaborators of the Company, instructors and administrators it designates, and people who appear in the documents the Company provides. Categories of data: identification and work contact details, position and area, access credentials, training record (assignments, progress, scores, certificates, points), on-the-job practice reports and —where the Company enables those features— voice recordings, transcripts and conversations with virtual advisors. No payment data of individuals is processed.

4. Obligations of AVD Labs

• Process the data only on the Company’s documented instructions, namely this agreement, the terms of service and the configuration the Company sets in the platform.
• Ensure that persons with access to the data are bound by confidentiality.
• Apply appropriate technical and organisational measures: encryption in transit and at rest, isolation per company, role-based access control, available two-factor authentication, audit logging, encrypted backups with tested restores, and an incident response procedure.
• Engage only the sub-processors on the list AVD Labs provides to the Company as an annex to this agreement, under contracts imposing the same obligations, and give the Company thirty days’ notice of any change, with a right to object.
• Assist the Company in responding to data subject rights (access, rectification, erasure, portability, objection): the platform offers export and account closure from each person’s account and editing from the administration.
• Notify the Company without undue delay, and at the latest within forty-eight hours of becoming aware, of any personal data breach, with the information available so the Company can meet its own notification duty.
• Assist the Company with impact assessments and consultations with the authority where the processing requires it.
• Make available the information needed to demonstrate compliance and allow reasonable audits, with prior notice and without access to other companies’ data.
• Inform the Company if, in its view, an instruction infringes data protection law.

5. International transfers

The service is delivered from the United States. Where the Company is subject to the General Data Protection Regulation, this agreement incorporates the Standard Contractual Clauses approved by the European Commission (Decision 2021/914, module two, controller to processor), and AVD Labs maintains a valid transfer mechanism with each sub-processor. For Costa Rica’s Law 8968, this agreement is the contract that guarantees the required level of protection.

6. Obligations of the Company

The Company warrants that it has a lawful basis to process its staff’s data and to provide the documents and recordings it uploads to Kenavia, that it informs its people about the use of the platform, and that its instructions comply with the law.

7. Liability

Each party is liable for damage caused by breaching its obligations under this agreement and applicable law, under the terms of the main contract.

8. How to sign

Write to [email protected] stating your company and the signatory; we will send the agreement with full details for electronic signature. Once signed, it becomes an annex to your contract.

This is a courtesy translation. The Spanish version of this document is the binding one; in the event of any discrepancy, the Spanish text prevails.