Last Updated: [Month Day, Year]
This Data Processing Agreement, including its schedules and any applicable Standard Contractual Clauses, forms part of the Agreement between Learn Tourism and Customer.
This DPA applies when Learn Tourism processes Personal Data on behalf of Customer in connection with the Services.
This DPA is entered into by and between Learn Tourism, Inc. (“Learn Tourism,” “we,” “us,” or “our”) and the customer identified in the applicable Order Form, Quote, Proposal, Scope of Work, or other written agreement (“Customer,” “you,” or “your”).
This DPA supplements the Master Customer Terms, Product-Specific Terms, Privacy Policy, and applicable Order Form.
If there is a conflict between this DPA and the Master Customer Terms regarding the processing of Personal Data, this DPA will control. If there is a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses will control for the applicable transfer.
“Agreement” means the Master Customer Terms, applicable Order Form, Product-Specific Terms, this DPA, the Acceptable Use & Community Standards, and any other document incorporated by reference.
“Authorized User” means any learner, administrator, employee, contractor, representative, stakeholder, partner, participant, or other person Customer authorizes to access or use the Services.
“Customer Content” means content, materials, files, documents, images, videos, logos, text, course materials, or other information Customer provides to Learn Tourism or uploads to the Services.
“Customer Data” means data, records, files, content, and information submitted to or collected through the Services by or on behalf of Customer, including Learner Data and Customer Content.
“Data Protection Laws” means all privacy, data protection, and data security laws and regulations applicable to the processing of Personal Data under the Agreement.
“Data Subject” means an identified or identifiable individual to whom Personal Data relates.
“Learner Data” means Personal Data relating to individuals who enroll in, access, participate in, complete, or otherwise interact with courses, learning environments, events, or training programs provided through the Services.
“Personal Data” means information relating to an identified or identifiable individual that is included in Customer Data and protected as personal data, personal information, personally identifiable information, or similar terms under applicable Data Protection Laws.
“Personal Data Breach” means a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data processed by Learn Tourism under this DPA.
“Processing” means any operation performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, transmission, alignment, restriction, erasure, or destruction.
“Restricted Transfer” means a transfer of Personal Data subject to GDPR, UK GDPR, Swiss data protection law, or similar law to a country or recipient that does not provide an adequate level of protection without appropriate safeguards.
“Security Measures” means the technical and organizational measures described in Schedule B.
“Sensitive Information” means Social Security numbers, government identification numbers, financial account numbers, protected health information, biometric information, precise geolocation, children’s personal information, special categories of Personal Data under GDPR, account passwords, or other highly sensitive data.
“Services” means the products, subscriptions, learning environments, courses, consulting, instructional design, course development, speaking, sponsorship, promotion, training, technology, support, integrations, or other services provided by Learn Tourism under the Agreement.
“Standard Contractual Clauses” or “SCCs” means the then-current standard contractual clauses approved by the European Commission or other applicable authority for Restricted Transfers, as incorporated into this DPA where applicable.
“Subprocessor” means any third party engaged by Learn Tourism to process Personal Data on behalf of Customer in connection with the Services.
The terms “controller,” “processor,” “business,” “service provider,” “contractor,” “personal information,” “sell,” “share,” and similar privacy-law terms have the meanings given to them under applicable Data Protection Laws.
Customer is the controller of Customer Data and Personal Data it provides to Learn Tourism or causes to be processed through the Services, except where Learn Tourism independently determines the purposes and means of processing.
Customer determines the purposes and means of processing Personal Data in connection with Customer’s use of the Services, including which individuals may access the Services, what Customer Content is provided, what learning programs are offered, and how Customer uses learner reports and records.
Learn Tourism acts as a processor when it processes Personal Data on behalf of Customer to provide the Services.
Learn Tourism will process Personal Data only:
The Agreement, including this DPA and the applicable Order Form, constitutes Customer’s documented instructions to Learn Tourism.
Learn Tourism may act as an independent controller for certain limited activities, such as:
These activities are governed by Learn Tourism’s Privacy Policy and applicable law.
Unless expressly agreed in writing, the parties do not intend to act as joint controllers.
Customer will:
Customer is responsible for the accuracy, quality, legality, and completeness of Customer Data and the means by which Customer acquires Customer Data.
Learn Tourism will:
Learn Tourism will notify Customer if, in Learn Tourism’s opinion, an instruction violates applicable Data Protection Laws.
The details of processing are described in Schedule A.
Customer acknowledges that the scope of Personal Data processed may vary depending on the Services purchased, Customer’s configuration, Customer Content, and Customer’s use of the Services.
The Services are not designed to process Sensitive Information unless expressly stated in the Order Form or otherwise agreed in writing.
Customer will not submit Sensitive Information to the Services unless Learn Tourism has expressly agreed in writing.
If Customer submits Sensitive Information without written approval, Customer is responsible for resulting compliance obligations, risks, and consequences, except to the extent caused by Learn Tourism’s violation of this DPA.
Learn Tourism will maintain reasonable technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.
The Security Measures are described in Schedule B.
Customer acknowledges that security measures may evolve over time. Learn Tourism may update Security Measures, provided such updates do not materially reduce the overall level of protection for Personal Data during the applicable term.
If Learn Tourism becomes aware of a Personal Data Breach affecting Personal Data processed under this DPA, Learn Tourism will notify Customer without undue delay.
Notice may be provided to the primary customer contact, administrator contact, privacy contact, security contact, or other contact listed in the applicable Order Form or customer account.
To the extent available, Learn Tourism’s notice will include:
Learn Tourism may provide information in phases as it becomes available.
Learn Tourism will reasonably cooperate with Customer’s investigation, mitigation, and notification obligations related to a Personal Data Breach.
Customer is responsible for determining whether notice to regulators, Data Subjects, customers, employees, or other parties is required, unless applicable law requires Learn Tourism to provide notice directly.
Notice of a Personal Data Breach is not an admission of fault or liability by Learn Tourism.
Customer provides general authorization for Learn Tourism to use Subprocessors to provide the Services.
Learn Tourism will enter into written agreements with Subprocessors that impose data protection obligations substantially similar to those in this DPA, to the extent applicable to the nature of the services provided by the Subprocessor.
Learn Tourism will maintain a list of Subprocessors used to process Personal Data in connection with the Services.
The list may be made available on a legal, privacy, or security page, by request, or through another reasonable method.
Learn Tourism may add or replace Subprocessors from time to time.
Where required by Data Protection Laws, Learn Tourism will provide notice of new or replacement Subprocessors through a posted list, email notice, customer notice, or other reasonable method.
Customer may object to a new Subprocessor on reasonable data protection grounds by providing written notice within thirty (30) days after notice of the change.
If Customer objects, the parties will work in good faith to resolve the objection. If the objection cannot be resolved, Customer may terminate only the affected Services, and termination rights, refunds, or credits will be handled according to the Agreement.
Customer is responsible for responding to Data Subject requests where Customer is the controller.
Data Subject requests may include requests to access, correct, delete, restrict, object, withdraw consent, or port Personal Data.
Learn Tourism will provide reasonable assistance to Customer in responding to Data Subject requests, taking into account the nature of the Services and the information available to Learn Tourism.
Assistance may include:
If Learn Tourism receives a Data Subject request relating to Personal Data processed on behalf of Customer, Learn Tourism may:
Learn Tourism will not independently fulfill a request for Customer-controlled Personal Data unless authorized by Customer or required by law.
During the applicable term, Customer may request reasonable exports of Customer Data available through the Services, subject to platform capabilities, privacy restrictions, and applicable law.
After expiration or termination of the applicable Services, Learn Tourism will delete or return Personal Data according to the Agreement, applicable Order Form, Customer’s written instructions, and applicable law.
Where technically feasible and commercially reasonable, Learn Tourism will provide Customer an opportunity to export Customer Data before deletion or deactivation.
Learn Tourism may retain Personal Data where required or permitted by law, including for:
Retained Personal Data will remain subject to the confidentiality and security obligations of this DPA for as long as it is retained.
Upon reasonable written request, Learn Tourism will provide information reasonably necessary to demonstrate compliance with this DPA.
This may include security summaries, subprocessors, privacy documentation, certifications, policies, questionnaires, or other information appropriate to the nature of the Services.
If required by applicable Data Protection Laws, Customer may request an audit of Learn Tourism’s compliance with this DPA.
Any audit must:
Customer is responsible for audit costs unless otherwise required by law.
Learn Tourism may respond to reasonable security and privacy questionnaires. Extensive questionnaires, custom assessments, or procurement reviews outside ordinary scope may require additional fees if agreed by the parties.
Customer acknowledges that Learn Tourism and its Subprocessors may process Personal Data in the United States and other countries where Learn Tourism or its Subprocessors operate.
Where Personal Data is subject to Data Protection Laws that restrict international transfers, Learn Tourism will use an appropriate transfer mechanism where required, such as:
Where the SCCs apply, the parties agree that the SCCs are incorporated into this DPA by reference.
For purposes of the SCCs:
Where required by applicable Data Protection Laws, Learn Tourism will provide reasonable assistance and information to support Customer’s transfer impact assessment, taking into account the nature of the processing and information available to Learn Tourism.
To the extent Learn Tourism processes Personal Data subject to U.S. state privacy laws on behalf of Customer, Learn Tourism will process such Personal Data as a service provider, processor, contractor, or similar role as defined by applicable law.
Learn Tourism will not:
Learn Tourism may process Personal Data to:
Taking into account the nature of processing and the information available to Learn Tourism, Learn Tourism will provide reasonable assistance to Customer with:
Such assistance may be subject to reasonable fees if it requires substantial effort outside the ordinary operation of the Services.
Learn Tourism will ensure that personnel who process Personal Data are subject to confidentiality obligations.
Customer will treat security, privacy, and compliance information provided by Learn Tourism as Confidential Information unless it is publicly available.
Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, unless otherwise required by applicable Data Protection Laws.
This DPA remains in effect for as long as Learn Tourism processes Personal Data on behalf of Customer.
Learn Tourism may update this DPA from time to time.
Updates will apply to new Order Forms and renewals after the updated DPA is posted or otherwise provided.
For active Order Forms, material changes will not reduce the overall protection of Personal Data during the then-current term unless required by law, third-party platform changes, security needs, or mutual agreement.
Privacy questions or requests related to this DPA may be sent to:
Learn Tourism, Inc.
Attn: Privacy
8433 Enterprise Circ – 100338; Lakewood Ranch, FL 34202
Security questions may be sent to:
Learn Tourism’s processing of Personal Data in connection with the Services provided to Customer.
The duration of processing is the term of the Agreement and any period during which Learn Tourism retains Personal Data according to the Agreement, this DPA, applicable law, backup practices, or Customer’s instructions.
Learn Tourism processes Personal Data to provide, maintain, support, secure, improve, and administer the Services, including:
Data Subjects may include:
Personal Data may include:
The Services are not intended to process Sensitive Information unless expressly agreed in writing.
Continuous or as needed to provide the Services.
Processing operations may include collection, recording, organization, storage, hosting, access, retrieval, use, disclosure, transmission, analysis, modification, deletion, return, export, and other operations necessary to provide the Services.
Learn Tourism will maintain reasonable technical and organizational measures appropriate to the nature of the Services and Personal Data processed.
Security Measures may include:
Customer is responsible for:
Learn Tourism uses Subprocessors to provide, host, support, secure, analyze, communicate, and improve the Services.
Where Personal Data is subject to GDPR, UK GDPR, or Swiss data protection law:
Where Personal Data is subject to California or other U.S. state privacy laws: