Data Processing Agreement

Version: 1.0 — 22 March 2026 Processor: AGL Consult Com.V

This Data Processing Agreement (hereinafter: "DPA") applies to all organisations (hereinafter: "the Controller") that use the AI Literacy Certification platform (hereinafter: "the Platform") offered by AGL Consult Com.V. By activating the Platform or ticking the relevant box during onboarding, the Controller accepts the terms of this DPA.

1. Parties

Processor: AGL Consult Com.V Coebergerstraat 27, 2000 Antwerp, Belgium VAT: BE0650532478 E-mail: privacy@ailiteracy-certification.eu

Controller: The organisation that has taken out a subscription to the Platform, as identified through the associated account.

2. Subject Matter

AGL Consult Com.V processes personal data of the Controller's employees solely for the purpose of delivering the Platform: providing AI literacy training, administering assessments, and issuing certificates in accordance with EU AI Act Article 4.

This DPA runs concurrently with the subscription agreement. Upon termination of the subscription, the provisions on data deletion and confidentiality continue to apply.

3. Personal Data Processed

Category	Data
Identification	Name, e-mail address, department
Learning journey	Course progress, exam results, pass/fail status
Certification	Certificate number, issue date
Technical	IP address in server logs, session timestamps

No special categories of personal data (such as health data) are processed. Data subjects are exclusively employees of the Controller.

4. Obligations of AGL Consult Com.V as Processor

4.1 Instructions AGL Consult Com.V processes personal data solely on the instructions of the Controller, as set out in this DPA and the subscription agreement. In the event of a legal obligation to deviate, the Controller will be informed in advance, unless prohibited by law.

4.2 Confidentiality All staff and sub-processors with access to personal data are bound by a confidentiality obligation.

4.3 Security AGL Consult Com.V implements appropriate technical and organisational measures in accordance with Article 32 GDPR, including:

Encrypted connections (HTTPS/TLS) on all pages
Passwordless authentication via magic link
Row Level Security: organisations are strictly separated within the database
Hosting exclusively within the European Union (Frankfurt, Germany)

4.4 Sub-processors AGL Consult Com.V engages the following sub-processors. A data processing agreement has been concluded with each of them:

Sub-processor	Role	Data location
Supabase Ireland Ltd	Authentication and database	Frankfurt, DE (EU)
Stripe Payments Europe Ltd	Payment processing	EU
Brevo SAS (Sendinblue)	Transactional e-mail	Paris, FR (EU)
Vercel Inc.	Hosting platform	Frankfurt, DE (EU via AWS)

Changes to the list of sub-processors will be communicated at least 14 days in advance via the website or by e-mail. The Controller may object within that period.

4.5 Data Subject Rights AGL Consult Com.V assists the Controller in responding to data subject requests (access, rectification, erasure, restriction, portability, objection). Requests received directly by AGL Consult Com.V will be forwarded to the Controller without delay.

4.6 Personal Data Breach Notification In the event of a personal data breach, AGL Consult Com.V will notify the Controller within 36 hours of discovery via privacy@ailiteracy-certification.eu. The notification will include the nature of the incident, the categories of data involved, the likely consequences, and the measures taken.

4.7 Audit Right The Controller or an auditor appointed by the Controller has the right to verify AGL Consult Com.V's compliance with this DPA. AGL Consult Com.V will cooperate and provide the necessary information. Audit costs are borne by the Controller.

5. Obligations of the Controller

The Controller:

Ensures a lawful basis for processing the personal data of its employees and informs them accordingly;
Only submits data that is necessary for use of the Platform;
Only issues instructions that comply with the GDPR.

6. International Data Transfers

All processing takes place within the European Economic Area. For Vercel Inc. (established in the US), Standard Contractual Clauses apply; data is physically stored on EU servers in Frankfurt.

7. Retention and Deletion

Following termination of the subscription, all personal data will be deleted or anonymised within 60 calendar days, unless a statutory retention obligation requires otherwise. Upon request, AGL Consult Com.V will provide written confirmation of deletion. A data export may be requested prior to termination via privacy@ailiteracy-certification.eu.

8. Liability

Each party is liable for damage resulting from a breach of the GDPR or this DPA attributable to that party. The liability of AGL Consult Com.V is limited to the amount paid by the Controller in the 12 months preceding the damaging event. Liability for indirect or consequential damage is excluded, unless caused by intent or gross negligence.

9. Final Provisions

This DPA is governed by Belgian law. Disputes will be submitted to the competent court of the district of Antwerp. In the event of conflict between this DPA and the subscription agreement, this DPA prevails with regard to the processing of personal data.

10. Contact

For questions about this Data Processing Agreement or to request an individually signed copy: privacy@ailiteracy-certification.eu

By using the AI Literacy Certification platform, the Controller confirms having read and agreed to this Data Processing Agreement.