Data Processing Terms

Cette page est affichée en anglais. Le texte anglais fait foi tant que les traductions n’ont pas fait l’objet d’une relecture juridique.

These terms set out the data-protection rules that apply when someone other than Neda handles learners’ personal data on Neda eCampus, or when Neda handles personal data for an organisation. They are made under the EU General Data Protection Regulation (GDPR). They form part of the Creator Agreement, and of any arrangement under which an organisation brings its own learners to Neda eCampus. How Neda itself uses personal data is explained in the Privacy Policy.

Summary

• Learners have one responsible party. Neda eLearning Solutions is responsible for learners’ data on Neda eCampus. Creators see the learners in their own courses so they can teach, and they use that data only for us and only on our instructions (Part A).
• Creators may use learner data to teach, and for nothing else. No marketing, no mailing lists, no passing it on, no AI tools. Keep it secure, and tell us within 24 hours if something goes wrong.
• Organisations that bring their own learners — for example a university or NGO that issues enrolment codes — decide what happens to those learners’ records for their own purposes. For that use, the organisation is responsible and Neda handles the data on its behalf, on the terms in Part B.
• Neda keeps its own responsibilities for learners’ accounts, security, accounting and legal claims, whichever part applies.
• All platform data is hosted in the EU — on Hetzner servers in Finland, with backups in Germany. The companies that help us run the service are listed on the Sub-processors page.

1. Which part applies

Situation	Who is responsible for the data	Part
Learners join your course through the Neda eCampus catalogue or a link — paid or free	Neda. You access the data on Neda’s behalf.	A
Your organisation gives its own people enrolment codes, enrols learners itself, or commissions a course for them, and uses their records for its own purposes (for example, to track staff training or student progress)	Your organisation, for that use. Neda handles the data on your behalf.	B
Learners’ accounts, sign-in, security, purchases, certificates held in their account, and our legal duties	Neda, in every case	Privacy Policy

One course can involve both parts — for example, a course some learners buy in the catalogue while others join with your organisation’s codes. Each part then applies to its own learners.

Part A — Creators and learner data

2. Our roles

Neda sells and provides every course on Neda eCampus, and learners’ contracts are with us. We therefore decide why and how learners’ data is used on the platform: we are the controller. When you see and use the data of learners in your courses, you do so on our behalf and only on our instructions, as our processor. These terms are our instructions, and they are the contract that the GDPR requires between us.

3. What the processing covers

Subject matter	Teaching the courses you publish on Neda eCampus.
Duration	For as long as you have access to a course’s learners under the Creator Agreement. Your duties of confidentiality, and to delete copies, continue after that.
Nature and purpose	Viewing, assessing and responding to learners’ work on the learning platform: following progress, marking submissions, giving feedback and grades, answering questions, moderating course forums, and improving the course.
Types of personal data	Learners’ names and profile pictures; enrolment status; progress and activity completion; activity records for your course (which parts a learner opened, and when); submissions, grades and feedback; posts and messages in your course; and other details the learning platform shows teachers, such as an email address where it is displayed.
Categories of people	Learners enrolled in your courses.
Special categories	None are required. Do not design a course that asks learners for health, religious, political or other special-category data. If a learner volunteers such information in a submission, use it only to mark that work, and treat it with extra care.

4. Your obligations

• Follow our instructions. Use learner data only for the purpose in section 3, on the learning platform. If you think an instruction from us breaks data-protection law, tell us straight away.
• No other use. Do not use learner data for marketing, do not contact learners outside the platform about anything other than the course they are taking with you, do not add them to your own lists, and do not combine their data with other data you hold.
• Keep it on the platform. Download or copy learner data only where teaching needs it — for example, to mark submissions offline. Keep any such copy secure, and delete it as soon as you no longer need it, and at the latest when your access to that course ends.
• Confidentiality. Only you, and people working for you who need it to teach the course and are bound to keep it confidential, may see learner data. You are responsible for them.
• Security. Keep your account credentials to yourself, use two-factor authentication where we ask you to, keep devices you use for teaching locked and up to date, and do not leave learner data where others can see it.
• No sub-processors. Do not pass learner data to anyone else, or to any outside service — including AI assistants, translation tools, cloud storage or spreadsheet services — unless we have agreed in writing.
• Learners’ rights. If a learner asks you to see, correct or delete their data, or objects to how it is used, do not answer it yourself: forward it to us at info@neda-els.com within three working days, and help us respond.
• Incidents. If you learn of any unauthorised access to, loss of, or disclosure of learner data — including a lost device or a compromised account — tell us within 24 hours, with what you know, and help us deal with it. Do not notify learners or authorities yourself unless we ask you to or the law requires it.
• When your access ends, delete any copies of learner data you hold within 30 days, and confirm this to us if we ask. Learner data stays with us on the platform; you do not take it with you.
• Information and checks. Give us the information we reasonably need to show that these terms are being followed, and cooperate with any check we, or a data-protection authority, make.

5. What we do

We tell learners, in our Privacy Policy, that creators see their data. We give you access only to the learners in your own courses, and co-creators get no access to learners at all. We answer learners’ requests about their data. If you breach these terms, we may restrict your access under section 12 of the Creator Agreement.

Part B — Organisations that bring their own learners

6. When Part B applies, and our roles

Part B applies when an organisation — for example a university, school, NGO, public body or company — brings its own learners to Neda eCampus: by issuing enrolment codes, by enrolling learners itself, or by commissioning a course for them, and decides who is enrolled and uses their records for its own purposes. For that use, the organisation is the controller and Neda is its processor. In this Part, “you” means the organisation.

Neda remains an independent controller for its own purposes: learners’ Neda eCampus accounts and sign-in; the security of the platform; purchases, invoices and accounting; certificates held in a learner’s own account; and establishing, exercising or defending legal claims. Those uses are covered by our Privacy Policy, not by this Part.

7. What the processing covers

Subject matter	Providing the courses you make available to your learners on Neda eCampus, and the records of their participation.
Duration	For as long as your arrangement with us lasts, and then until the data is deleted or returned under section 13.
Nature and purpose	Hosting, enrolling and unenrolling learners, delivering course content, recording progress, submissions, grades and completion, issuing certificates, and giving you the reports and records you ask for.
Types of personal data	Names, email addresses, enrolment codes used, enrolment and completion status, progress and activity records, submissions, grades, feedback, forum posts, and certificates issued.
Categories of people	Your learners — for example students, staff, members or beneficiaries — and the members of your team who manage the course.

8. Your responsibilities as controller

You confirm that you have a lawful basis for enrolling your learners and for the use you make of their records, that you have told them how their data is used (including that Neda provides the platform), and that you give us only the personal data the course needs. Your instructions to us must comply with data-protection law.

9. What Neda does as your processor

• Instructions. We process your learners’ data only on your documented instructions — these terms, the way you set up your course and its enrolment, and anything else you ask in writing — including as regards transfers outside the EU. If the law requires us to do something else, we will tell you first, unless the law forbids it. If we think an instruction breaks data-protection law, we will tell you.
• Confidentiality. Everyone at Neda who can access the data is bound to keep it confidential.
• Security. We protect the data with appropriate technical and organisational measures, which we review as the platform changes. They include encrypted connections, passwords stored only as hashes, two-factor authentication (required for some accounts), access limited by role, and server access by key from named accounts only. We will give you a fuller description on request. Security problems can be reported to us as our Security page explains.
• Learners’ rights. If one of your learners asks us to see, correct or delete their data held under this Part, we will pass the request to you, and we will help you answer it.
• Other assistance. We will help you meet your duties on security, breach notification, data-protection impact assessments and consultation with authorities, taking into account what we know about the processing. Reasonable assistance is free; if a request is unusually large, we will agree any cost with you first.
• Breaches. If we become aware of a personal-data breach affecting your learners’ data, we will tell you without undue delay, and in any event within 48 hours, with the information you need to meet your own obligations, and we will keep you informed as we learn more.

10. Sub-processors

You authorise us to use the sub-processors listed on our Sub-processors page. We will tell you at least 30 days before we add or replace one, by email and on that page. You may object within that time, on reasonable data-protection grounds. If you object, we will discuss it with you; if we cannot resolve it, you may end the affected arrangement before the change takes effect, without penalty. Each sub-processor is bound by a contract that gives your data the same protection as these terms, and we remain responsible to you for what they do.

11. International transfers

All the systems that make up Neda eCampus run on Hetzner servers in Finland, with backups in Germany, both in the EU. We do not move your learners’ data outside the European Economic Area as part of running your courses, except through the sub-processors that the Sub-processors page marks as outside the EEA. For each of those, that page names the safeguard the GDPR requires, such as an adequacy decision or standard contractual clauses. We will not add a new transfer without the notice in section 10.

12. Information and audits

We will give you the information you reasonably need to show that we meet these terms. If that is not enough, you, or an auditor you appoint who is bound to confidentiality, may audit our compliance once a year — or more often after a breach, or when a data-protection authority requires it — with at least 30 days’ notice and in a way that does not compromise other customers’ data or the security of the platform. You bear the cost of your own audit.

13. When the arrangement ends

When your arrangement with us ends, you choose whether we return your learners’ course records to you, in a common format such as a spreadsheet file, or delete them. We do so within 30 days of your choice. If you do not choose within 30 days of the end, we delete them. Deleted data leaves our backups as they cycle out.

Two things are not deleted at your request, because they are not held for you: what the law requires us to keep, such as purchase and tax records; and what belongs to the learner’s own relationship with us — their Neda eCampus account, and certificates held in it — which stay until the learner closes their account, as our Privacy Policy explains.

14. Both parts: precedence, changes and contact

If these terms conflict with the Creator Agreement, or with any other agreement between us, on a data-protection matter, these terms win. An organisation that needs a signed copy of Part B, or wants to agree specific additional terms, can ask us.

We will give at least 30 days’ notice by email of any change to these terms that affects you, unless the change is required by law. Questions about these terms, notices and incident reports go to info@neda-els.com with “Data protection” in the subject line.

Version 2.0 (draft pending legal review) — effective 20 October 2026, last updated 14 October 2026. Earlier versions are available on request from info@neda-els.com.