This data processing agreement (“DPA”) forms part of the Agreement between JollyDeck and the Customer (the “Agreement”) under which JollyDeck provides its learning management system (JollyDeck LMS) and e-learning authoring tool (JollyDeck Create) as software-as-a-service (“SaaS”). This DPA ensures that JollyDeck processes data securely and in compliance with relevant laws while maintaining transparency in its operations.
2.1 Scope and roles
JollyDeck acts as the Data Processor, processing personal data solely to provide the Service. the Customer is the Data Controller, deciding how and why personal data is processed.
2.2 Purpose and duration
JollyDeck will process personal data to deliver JollyDeck LMS and JollyDeck Create. Processing continues for the duration of the Agreement unless instructed otherwise by the Customer or required by law.
2.3 Customer instructions
JollyDeck processes personal data only in accordance with the Customer’s documented instructions unless legally required to do otherwise. JollyDeck will promptly inform the Customer if any legal requirement prevents it from complying with the instructions.
2.4 JollyDeck personnel
All JollyDeck personnel handling personal data are bound by confidentiality obligations, receive data protection training, and must follow internal security policies.
2.5 Backups and retention
JollyDeck performs full system backups daily and retains them for 14 days. All backups are stored for 14 days in physically redundant locations. Additionally, JollyDeck keeps three versions of every piece of e-learning content that the Customer creates, which is not subject to the 14-day limit, in physically redundant locations. Where these backups are restored (for example, for disaster recovery tests), JollyDeck does not extend the original retention period. Restoration for testing follows our business continuity and disaster recovery plan, tested every six months.
2.6 Deletion of personal data
Upon termination of the Agreement, JollyDeck will delete or return personal data within twelve (12) months, or sooner if required by law. If a different period is agreed to in writing, that period prevails. JollyDeck provides written confirmation of deletion upon request.
3.1 Use of subprocessors
JollyDeck may engage subprocessors to provide hosting, email, analytics, or other services. A current list is available at JollyDeck’s legal page.
3.2 Notification
JollyDeck keeps an up-to-date list of its subprocessors online. No prior notice of any new or replaced subprocessor is provided. The Customer can consult the online list at any time.
3.3 Subprocessor obligations
JollyDeck ensures subprocessors are bound by equivalent data protection obligations under this DPA, including strict confidentiality and security measures.
4.1 Data centre locations
JollyDeck hosts data in physically secure data centres located in Europe.
4.2 Transfers to third countries
If personal data is transferred outside the selected region or the EEA or UK, JollyDeck ensures compliance with data protection laws. Standard contractual clauses (SCCs) or the UK international data transfer addendum (IDTA) apply where needed. Any transfers to non-EEA regions are detailed on JollyDeck’s legal page.
5.1 Data subject requests
The Customer is responsible for managing data subject requests (for example, access, rectification, deletion). If JollyDeck receives a data subject request, it will inform the Customer without undue delay and provide reasonable assistance.
5.2 Assistance
JollyDeck assists with data subject requests where required, and may charge reasonable fees for excessive or unfounded requests. Self-service tools may be provided to help manage data subject rights efficiently.
JollyDeck implements technical and organisational measures to protect personal data, including:
JollyDeck will notify the Customer without undue delay upon becoming aware of a personal data breach. The notification includes the nature of the breach, likely consequences, and measures taken or proposed to mitigate adverse effects.
JollyDeck provides relevant compliance documentation upon request and may allow audits under reasonable terms, with minimal disruption to its operations. These audits must preserve the confidentiality and security of other customers’ data.
9.1 Liability
Liability follows the Agreement, except as required otherwise by data protection laws.
9.2 Suspension or termination for breach
If the Customer violates this DPA or JollyDeck’s acceptable use and content licence policy (for example, by uploading data without a lawful basis), JollyDeck may suspend or terminate the Customer’s access to the Service. JollyDeck will provide notice where feasible, but reserves the right to act immediately if the violation poses a security or legal risk.
9.3 Effect of termination
This DPA remains in effect until all personal data is deleted or returned following termination. Termination does not affect obligations that survive by nature, such as confidentiality.
9.4 Conflict
In case of a conflict between this DPA and the Agreement, the DPA terms take precedence regarding data protection obligations.
10.1 AI copilot
Personal data will not be processed by the AI copilot unless explicitly uploaded by the Customer. JollyDeck handles such data under the terms of this DPA and JollyDeck’s AI copilot content generation policy, ensuring no further training of AI models occurs with that data.
10.2 Special categories and minors
JollyDeck does not routinely process special categories of data or minors’ data. The Customer is responsible for ensuring a valid lawful basis for any data uploaded, as stated in JollyDeck’s acceptable use and content licence policy.
10.3 Customer obligations
The Customer represents and warrants that it has a lawful basis for processing personal data. The Customer must also ensure that end users are informed of how their data is processed and that any required consents or notices are in place.
Appendix 1: Categories of personal data
Names, email addresses, job titles, and company affiliation of users (this is additional personal data that the Customer may enter at their sole discretion in JollyDeck LMS).
Course progress, assessment results, analytics (such as time spent learning), and files or content uploaded by the Customer via JollyDeck Create or JollyDeck LMS.
Appendix 2: Subprocessors
Below is the current list of subprocessors engaged by JollyDeck. This list may be updated from time to time:
| Entity | Type of service provider | Location of processing |
| Hetzner | Data hosting | Europe |
| Amazon SES | Email service provider | Europe |
| Freshworks | Customer service | US |
Appendix 3: Security measures
JollyDeck performs daily backups which are stored for 14 days.
Data is encrypted at rest using AES-256 and in transit using TLS.
Throughout JollyDeck, we define user roles for different levels of access, and we maintain access controls with multi-factor authentication via single sign-on (SSO).
Our incident response policies are tested, and our business continuity plan is tested every six months.
We do not retain personal data beyond twelve months after contract end, unless agreed otherwise or required by law.
JollyDeck, revised and updated in January 2025