Data Processing Agreement
Version 2.0 — published on 20 October 2026
Effective from 24 November 2026.
1. Introduction and Background
This personal data processing agreement (“DPA“) governs the processing of personal data taking place by Open Badge Factory Oy (“Supplier“) on behalf of its customer (“Customer“) under the agreement concerning the provision of Open Badge Factory services (“Agreement“). Customer refers in this DPA to the entity that has entered into the agreement on the provision of the Open Badge Factory services. This DPA is an essential and inseparable part of the Agreement. In this DPA, the Customer and the Supplier are referred together as “Parties” and individually as a “Party“.
In this DPA, the Supplier acts as a processor on behalf of the Customer who acts as a controller. The Supplier processes Personal Data as a processor on behalf of the Customer when it is providing the services.
The processing of Personal Data is described in more detail in Schedule 1 (Description and Details of the Personal Data Processing) which is attached to this DPA.
In the event of any discrepancy between the content of the body of this DPA or any of the Schedules of the DPA, the Agreement or Data Protection Legislation, the following order of precedence shall be applied:
- Data Protection Legislation
- The Schedules to this DPA; the priority between the Schedules shall be determined in the numerical order, so that a schedule with a smaller number shall prevail over a schedule with a larger number
- This DPA
- The Agreement
2. Contact Details
The Supplier’s entity is Open Badge Factory Oy.
The Supplier’s address is Kalasuolantie 11, 90220 Oulu, Finland.
All reports and notifications to the Supplier under this DPA shall be made by email to: contact(at)openbadgefactory.com. The person responsible for data protection matters at the Supplier is the CEO of Open Badge Factory Oy.
3. Definitions
TERM
Appropriate Transfer Mechanism
DEFINITION
means a transfer mechanism that permits the lawful transfer of Personal Data under the Data Protection Legislation, including appropriate safeguards pursuant to Article 46 GDPR.
Data Protection Legislation
means all applicable laws relating to protection of personal data, including without limitation the GDPR and any amendments thereto, and any other applicable EU or national privacy and data protection laws and regulations and any amendments thereto. Where the Customer is established in the United Kingdom, Data Protection Legislation shall also include the UK GDPR and the Data Protection Act 2018 and any amendments thereto.
Data Subject
means a natural person whose Personal Data is processed by the Supplier under the Agreement and this DPA.
Description and Details of the Personal Data Processing
means a Schedule to this DPA describing the Personal Data Processing taking place under this DPA.
EEA
means the European Economic Area, consisting of the Member States of the European Union and Iceland, Liechtenstein and Norway.
GDPR
means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) and any amendments thereto.
Personal Data
means any information relating to an identified or identifiable natural person, and which the Supplier is processing under the Agreement or otherwise, and of which the Customer is a data controller. In this regard, processing means any operation, or set of operations, performed by the Supplier on Personal Data, by any means, such as collecting, organizing, storing, amending, retrieving, using, disclosing, transmitting, combining, blocking, erasing or destructing Personal Data.
Personal Data Breach
means a breach of security leading to destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed
Subprocessor
means a processor acting on behalf of the Supplier.
Third Country
means any country or territory outside the European Union (EU) and the European Economic Area (EEA) that is not subject to a valid adequacy decision adopted by the European Commission pursuant to Article 45 of the GDPR.
UK GDPR
means the GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019, and as further amended from time to time. Applicable only where the Customer is established in the United Kingdom.
Terms defined in Data Protection Legislation which are not defined herein shall have the meaning given to them in Data Protection Legislation.
4. Rights and Responsibilities of the Customer
The Customer shall process Personal Data in compliance with Data Protection Legislation and good data processing practice.
This DPA automatically becomes effective between the Parties when the Customer accepts the Terms and Conditions of the Service and creates an account. This standard DPA applies to all license levels (Basic, Premium, Pro, and Enterprise). Only Enterprise license holders may request an exception to execute a separately signed version of this DPA. If the Parties execute a separately signed DPA, that signed version shall supersede this automatic DPA. The written instructions given by the Customer to the Supplier are included in this DPA and the Schedules thereto. Any new or amended documented instructions from the Customer require a written agreement between the Parties. The Supplier is entitled to charge the Customer for additional costs incurred in complying with new or amended documented instructions from the Customer and for other unexpected costs and expenses arising from tasks not included in this DPA and the Schedules thereto.
In addition, the Customer undertakes to:
- ensure that there is a legal ground for processing the Personal Data covered by this DPA, and that necessary data processing agreements in accordance with Data Protection Legislation are in force;
- ensure that the Data Subjects, as required by the Data Protection Legislation, have received sufficient information regarding the processing, including information on that the Supplier may process the Personal Data on behalf of the Customer;
- immediately after it is brought to the Customer’s attention, inform the Supplier of any erroneous, rectified, updated or deleted Personal Data subject to the Supplier’s processing; and
- in a timely manner, provide the Supplier with lawful and documented instructions regarding the Supplier’s processing of Personal Data.
5. Responsibilities of the Supplier
5.1 General Principles Applicable to the Processing of Personal Data
The Supplier shall:
5.1.1 process Personal Data in compliance with this DPA, Data Protection Legislation and good data processing practice;
5.1.2 process Personal Data on documented instructions from the Customer, unless prescribed otherwise by a provision of Data Protection Legislation applicable to the Supplier. In such a case, the Supplier shall inform the Customer of such requirement in reasonable time before beginning the processing of Personal Data in accordance with the instructions, unless
informing of such requirement is prohibited in Data Protection Legislation. In case the Supplier considers that instructions of the Customer are in breach of Data Protection Legislation, the Supplier shall inform the Customer without undue delay;
5.1.3 ensure that the persons in service of the Supplier with access to Personal Data have committed themselves to appropriate confidentiality undertakings;
5.1.4 carry out the measures prescribed in Section 5.2 (Data security) of this DPA;
5.1.5 follow the conditions concerning the use of Subprocessors as prescribed in Section 8 (Subprocessors) of this DPA;
5.1.6 taking into account the information available to the Supplier, provide assistance to the Customer in responding to requests for exercising the rights of Data Subjects where the Customer does not have the needed information. The Supplier is entitled to charge the Customer for costs and expenses that are incurred as a result of complying with this Section 5.1.6;
5.1.7 taking into account the information available to the Supplier, provide assistance to the Customer in ensuring compliance with its obligations set out in Data Protection Legislation, relating to data security, Personal Data Breaches (as further defined in Section 6 of this DPA), data protection impact assessments, and prior consulting obligations. The Supplier is entitled to charge the Customer for costs and expenses that were incurred as a result of complying with this Section 5.1.7;
5.1.8 at the choice of the Customer, delete or return Personal Data to the Customer as prescribed in Section 11.2 of this DPA;
5.1.9 make available to the Customer all information necessary to demonstrate compliance with obligations set out in this DPA and in Data Protection Legislation. The Customer is obliged to keep all such information confidential. The Supplier is entitled to charge the Customer for costs and expenses that were incurred as a result of complying with this Section 5.1.9;
5.1.10 allow the Customer to perform audits as prescribed in Section 9 (Auditing) of this DPA.
5.2 Data Security
The Supplier shall implement technical and organisational measures to ensure an appropriate level of security to protect Personal Data against unauthorised access and loss, destruction, damage, alteration or disclosure, or against other unlawful processing. Technical and organizational measures are documented in Schedule 3 (List of Technical and Organisational Measures).
6. Personal Data Breach Notification
6.1 The Supplier shall notify the Customer of all Personal Data Breaches without undue delay after the Supplier has become aware of the suspected Personal Data Breach. The Personal Data Breach notification shall contain the following:
- description of the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects concerned and the categories and approximate number of data records concerned;
- name and contact details of the contact person of the Supplier handling the Personal Data Breach;
- description of likely consequences and/or realised consequences of the Personal Data Breach; and
- description of the measures the Supplier has taken to address the Personal Data Breach and to mitigate its adverse effects.
6.2 If it is not possible to provide the information listed at the same time, the information may be provided in phases.
6.3 The Supplier shall document Personal Data Breaches and disclose the documentation to the Customer upon the Customer’s request.
6.4 After the Supplier has become aware of the Personal Data Breach, the Supplier shall ensure security of Personal Data and take appropriate measures to ensure protection of Personal Data in cooperation with the Customer.
7. Transfers of Personal Data
7.1 The Supplier shall not transfer Personal Data to a Third Country or to a Subprocessor processing personal data in a Third Country, unless the Customer has given its prior written permission for the transfer and the Supplier ensures that an Appropriate Transfer Mechanism is in place before Personal Data is transferred into a Third Country.
8. Subprocessors
8.1 The Supplier is entitled to use Subprocessors in the processing of Personal Data when the Customer has approved such Subprocessors. On the date the Customer enters into the Agreement and accepts the terms and conditions of this DPA, the Customer simultaneously agrees to the use of Subprocessors that are listed on that date in Schedule 2 (List of Authorised Subprocessors).
8.2 The Supplier is entitled to reduce the number of Subprocessors without separate notice.
8.3 The Supplier shall notify the Customer about an addition of a Subprocessor processing Personal Data under this DPA at least thirty (30) days before the Subprocessor begins processing Personal Data. If the Customer’s denial of the use of the new Subprocessor results in any additional costs or expenses for the Supplier, the Supplier shall be compensated by the Customer for such additional and/or increased costs and expenses. If the Supplier and the Customer are not able to agree on engagement of another Subprocessor, the Supplier has the right to terminate the Agreement with a fourteen (14) days’ notice following the denial, as a whole and/or with respect to services the Supplier deems cannot be reasonably delivered under the Agreement due to the Customer denying the proposed Subprocessor.
8.4 The Supplier shall ensure that Subprocessors comply with obligations corresponding to those specified in this DPA, including security and confidentiality requirements. The Supplier remains liable for its Subprocessors and the work of its Subprocessors as for its own.
9. Auditing
9.1 The Customer or a third party (not a competitor of the Supplier) appointed by the Customer shall have the right to audit the Supplier’s compliance with obligations set out in this DPA and Data Protection Legislation in order to ensure that the Supplier has fulfilled the obligations set out in this DPA.
9.2 The Customer shall bear the costs and expenses incurred by the Supplier and the Customer in connection with the audit. The Customer shall bear the fees and expenses of the third party and is responsible for all costs associated with the audit.
9.3 The Customer must notify the Supplier of the audit at least thirty (30) business days in advance. The Supplier shall assist the Customer and the third party during normal business hours in conducting the audit with reasonable measures. The audit shall be carried out as quickly as possible and it shall not disturb the Supplier’s normal business operations. The auditor shall comply with the Supplier’s work rules, security requirements and standards when conducting site visits. Before commencing any audit, the Customer or the independent auditor (including relevant parties/persons conducting the audit) shall enter into the non-disclosure agreement(s) provided by or approved by the Supplier.
9.4 If the audit reveals shortcomings, the Supplier shall correct such shortcomings without delay or at the latest within thirty (30) days of a written notice from the Customer, unless the Parties agree otherwise. Any material shortcomings that pose an obvious threat to data security shall be rectified without delay.
10. Limitation of Liability
10.1 If any tangible or intangible damage is caused to a person due to a breach of the Data Protection Legislation or the DPA, the Supplier shall be liable for the damage only in so far as it has failed to comply with the obligations directed to personal data processors in the Data Protection Legislation or this DPA.
10.2 Both Parties are obligated to pay only the part of the damages or administrative fine that corresponds to their liability for damages confirmed in the final decision of a data protection authority or a court of law. However, the Supplier shall not be liable for any damages or administrative fines to the extent such damages or administrative fines are caused, directly or indirectly, by any act or omission of the Customer. The Supplier shall not be liable for lost profits or any indirect damages. For clarity, any administrative fines imposed on and paid by the Customer shall be considered indirect damages.
10.3 Otherwise, the liability of the Parties shall be determined pursuant to the Agreement. What has been agreed in this Section 10 shall not limit the applicability of what has been agreed on the limitation of liabilities in the Agreement.
11. Term and Termination
11.1 This DPA becomes effective when the Parties have entered into the Agreement and continues to be in effect until termination or expiration of the Agreement, provided the parties have no other obligations concerning Personal Data processing activities towards one another.
11.2 Upon expiry of the Customer’s license, the Customer’s account and all its content shall be retained for a period of six (6) months. During this retention period, the Customer retains access to its account and may export its data at any time. One (1) month before the end of the six (6) month retention period, the Supplier shall send a written reminder to the Customer notifying it of the forthcoming deletion of its account and data. Upon expiry of the six (6) month retention period, all Personal Data and account content shall be permanently deleted by the Supplier, with the exception of Personal Data necessary for the hosting of badges issued under the Agreement, as described in Section 11.6. Once the retention period has expired and the data has been deleted, the Supplier will not be able to return or restore any such data to the Customer.
11.3 The Customer may delete its account and all associated content at any time. Prior to deletion, the Customer may export its account data directly from the Service. As the Customer has the means to export its own data, the Supplier is not required to deliver data to the Customer upon account deletion. By default, account deletion does not affect Personal Data necessary for the hosting of badges previously issued under the Agreement. However, the Customer may choose to revoke all issued badges, in which case the associated Personal Data used solely for hosting purposes shall also be deleted. The Customer acknowledges that revoking issued badges will permanently invalidate them, meaning that badge recipients will no longer be able to access, display or verify their badges.
11.4 Where the Customer has registered a trial account and has not purchased a license within the sixty (60) day trial period, the trial account and all associated content, including all issued badges, shall be retained for a period of six (6) months from the expiry of the trial period. During this retention period, the Customer retains access to its account and may export its data at any time. One (1) month before the end of the six (6) month retention period, the Supplier shall send a written reminder to the Customer notifying it of the forthcoming deletion of its account and data. Upon expiry of the six (6) month retention period, all Personal Data, account content and issued badges shall be permanently deleted and automatically revoked by the Supplier without further notice. The Customer acknowledges that the automatic revocation of badges will permanently invalidate them, meaning that badge recipients will no longer be able to access, display or verify their badges. As badges issued under a trial account have not been created under a commercial license, the Supplier shall not be required to retain any Personal Data for hosting purposes following the deletion of the trial account. Once the retention period has expired and the data has been deleted, the Supplier shall not be able to return or restore any such data to the Customer.
11.5 For the avoidance of doubt, any failure or delay in the sending or receipt of the written reminder referred to in Sections 11.2 or 11.4, for whatever reason, shall not affect the six (6) month retention period referred to in Sections 11.2 and 11.4 or the deletion of the Customer’s account, its content, Personal Data or issued badges upon the expiry of the retention period.
11.6 Notwithstanding the above, following the termination or expiry of this DPA, the Supplier may at its own discretion retain Personal Data that is necessary for the Supplier to be able to host the badges issued under a commercial license. The Supplier will process such Personal Data as a controller only for the purposes of hosting the badges and allowing the Data Subjects to use, access and display the badges. This DPA shall no longer apply to such processing the Supplier carries out as a controller.
12. Additional Provisions for Customers Established in the United Kingdom
12.1 This Section 12 applies exclusively to Customers established in the United Kingdom and supplements the provisions of this DPA accordingly. In the event of any conflict between this Section 12 and the remainder of this DPA, this Section 12 shall prevail for UK-established Customers.
12.2 Applicable legislation. For UK-established Customers, Data Protection Legislation shall include the UK GDPR and the Data Protection Act 2018 in addition to the EU GDPR. All references to the GDPR in this DPA shall be read as including equivalent references to the UK GDPR where applicable.
12.3 Competent supervisory authority. For UK-established Customers, the competent supervisory authority is the Information Commissioner’s Office (ICO), located at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom (www.ico.org.uk).
12.4 Data transfers. For the purposes of Section 7.1 of this DPA, transfers of Personal Data from the UK shall be governed by the UK GDPR and the relevant transfer mechanisms recognised under UK law, including the UK International Data Transfer Agreement (IDTA) or any equivalent mechanism approved by the ICO, in addition to the mechanisms set out in Section 7.1.
Schedule 1 — Description and Details of the Personal Data Processing
The nature of processing is collecting, dissemination or otherwise making available, storing and structuring.
The Supplier shall process Personal Data only for the purpose of providing the Open Badge Factory service, to allow the Customer to fill in information about the badge recipients in order to create individual badges for each badge recipient and in order to transfer badges to the recipients. Additionally, the Supplier processes the personal data to host the badge and in order for it to be accessed, used and displayed by the Data Subject. In addition, the Supplier processes Personal Data to grant access to the Open Badge Factory Customer’s user account, to maintain the accounts, and to grant view of the issued badges and other information on the account. The Supplier may also take action, without consulting the Customer first, upon requests of Data Subjects exercising their rights under the GDPR or UK GDPR and e.g., provide Data Subjects access to their Personal Data or delete their Personal Data upon explicit request.
Categories of Data Subjects and Personal Data
The categories of Data Subjects whose Personal Data is processed are the Customer’s representatives, employees, students, business partners or other associates, members or its own customers, and any Data Subject who receives a badge from a Customer.
The Supplier shall process only the following categories of Personal Data:
Identification and contact data of the Customer’s account users: name, account password, email address
Technical data of the Customer’s account users and recipients: IP address, other technical information in relation to the use of the service, account name, account password, login data, login time, information relating to security incidents
Badge information of the recipients submitted by the Customer or by the badge recipient, for the purpose of issuing the badge: first name, surname, email address, skills, trainings and educations completed and other accomplishments of the recipient, badge applicant’s work such as texts, images, or videos that may contain personal information, social media shares (LinkedIn and other services)
Duration of Personal Data processing
Personal Data shall be processed as long as it is necessary for the provision of services under the Agreement.
Schedule 2 — List of Authorised Subprocessors
Subprocessor – Purpose for processing Personal Data
Geographic location of Personal Data
AWS Mailer system — sending Open Badge Factory emails – backup storage for Open Badge Factory data
Ireland (EU)
Mailjet Mailer system — sending Open Badge Factory emails
France (EU)
UpCloud – Cloud service provider — hosting of the service – backup storage for Open Badge Factory data
Germany (EU)
Schedule 3 — List of Technical and Organisational Measures
Last updated: 21.08.2026
The Supplier has implemented the following technical and organisational measures to ensure an appropriate level of security for the processing of Personal Data under this DPA, in accordance with Article 32 GDPR and, where applicable, the equivalent provisions of the UK GDPR.
1. Access Control
Physical Access Control
The Supplier’s services are hosted in the EU by a cloud service provider whose data centres are equipped with the following physical security measures: magnetic or chip card access systems, electronic door openers, facility security services, entrance security staff, alarm systems, and video/CCTV monitoring. The cloud service provider maintains the following certifications: ISO 22301 (Security and resilience), ISO 27001 (Information security management), SOC 2 Type II (Data security and privacy), and PCI-DSS (Information security).
Electronic Access Control
The Supplier’s service is protected by firewalls and TLS encryption. Access to data processing and storage systems is restricted to authorised and named system administrators only. System administrator access requires two-factor authentication and encrypted connections. All system administrator activities are logged for security monitoring purposes.
Isolation Control
The Supplier operates a multi-client (multi-tenant) architecture in which all customer organisations are served by a single shared deployment. Logical isolation is enforced at application level: each customer organisation is able to access only its own data, and the architecture prevents unauthorised access to, or disclosure of, one customer’s data to another.
Access rights are scoped to the customer organisation and are enforced on every request. The Supplier does not provide dedicated or physically separated environments per customer.
2. Data Encryption
All data stored in the Supplier’s systems is encrypted using industry-standard encryption protocols. All data transmitted between systems or endpoints is secured through TLS encryption to prevent unauthorised access or interception. When personal data is erased, anonymisation is applied where identifiers cannot be fully removed.
3. Physical Security
The Supplier relies on its cloud service provider’s secure data centre infrastructure, which includes advanced physical protection measures such as access controls, video monitoring, and the certifications listed under Section 1 above.
4. Data Retention and Deletion
Full backups of service content are created daily to ensure data availability and service continuity. Backups are intended solely for restoring service content in the event of a technical issue and do not restore end-user data that has been deliberately deleted. Data deletion processes comply with applicable Data Protection Legislation, including anonymisation of identifiers when personal data is erased.
5. Personal Data Breach — Incident Response
In the event of a Personal Data Breach, the Supplier follows the procedures outlined in Section 6 of this DPA, in compliance with Article 33 GDPR and, where applicable, the equivalent provisions of the UK GDPR. The breach response process includes documenting the nature of the breach, its likely consequences, the measures taken to address it, and notification to the Customer without undue delay to enable the Customer to fulfil its notification obligations to the relevant supervisory authority within the statutory timeframe.
6. Personnel and Confidentiality
All personnel and system administrators of the Supplier with access to Personal Data are subject to strict access control protocols and are bound by appropriate confidentiality obligations. Internal procedures ensure adherence to applicable Data Protection Legislation and the obligations set out in this DPA.
7. Backup and Disaster Recovery
Full backups of service content are performed daily. Backups are encrypted both in transit and at rest and are replicated to two separate storage locations held with two distinct infrastructure providers, each accessed through separate administrator credentials protected by two-factor authentication, so that the compromise or unavailability of one provider does not affect the backups held with the other. Backups are retained on a rolling thirty (30) day window, after which the oldest backups are automatically and permanently deleted. The restoration procedure is documented and tested at least annually, including verification of the integrity and usability of the restored data. Data centres are equipped with uninterruptible power supply (UPS) systems, power generators, firewalls, and antivirus software. Regular monitoring ensures the resilience and availability of the Supplier’s services.
8. Sub-processors and Supplier Management
The Supplier uses the sub-processors listed in Schedule 2 of this DPA for the processing of Personal Data. All sub-processors are subject to contractual obligations equivalent to those set out in this DPA, including security and confidentiality requirements. The Supplier remains liable for its sub-processors as for its own actions.
9. Pseudonymisation and Anonymisation
The Supplier applies pseudonymisation through the use of user IDs and identity hashes. Anonymisation is applied when personal data is erased, ensuring that it cannot be re-identified.
10. Audit and Monitoring
The Supplier conducts regular testing, assessment, and evaluation of its technical and organisational measures to ensure the ongoing confidentiality, integrity, availability, and resilience of its processing systems and services. Security and compliance are reviewed during both development and production phases. Audit logs are maintained to monitor all transactions and system administrator activities