Data processing agreement (DPA)

This agreement applies between the GenieUs client (company or sole trader enrolling learners), as controller, and the provider of the GenieUs platform (details in the site footer), as processor, under Article 28 of Regulation (EU) 2016/679 (GDPR). It is accepted electronically when the account is created, and the accepted version is kept in the consent register.

1. Subject matter and duration

The processor processes the data of the learners enrolled by the controller, strictly to provide the Romanian language programme and the related documents (including those required by GEO 32/2026), for the duration of the contract between the parties.

2. Data and data subjects

• Data subjects: the learners (workers) enrolled by the controller and the users of the controller's account.
• Categories of data: name, email, phone, preferred language, optionally identity document data (personal numeric code, passport, date of birth), workplace, study time, progress, test results, certificates, IP address and device used in study sessions.
• No special categories of data (Art. 9 GDPR) are processed.

3. Processor obligations

• processes data only on the documented instructions of the controller (this agreement and the settings in the client account);
• ensures confidentiality: staff with access are bound by confidentiality;
• applies appropriate technical and organisational measures (Art. 32): encrypted connections and sensitive data, two-step authentication, separation of data between clients, audit log, encrypted backups;
• assists the controller in answering data subject requests (for example, by exporting a learner's data);
• notifies the controller without undue delay (at the latest within 48 hours) after becoming aware of a personal data breach;
• at the end of the contract, at the controller's choice, deletes or returns the data, except where the law requires retention;
• makes available the information needed to demonstrate compliance with this agreement and allows reasonable audits, with prior notice.

4. Sub-processors

The controller gives general authorisation for the sub-processors needed to run the platform (hosting, email delivery, backup storage, payments and invoicing), listed in the Privacy policy. The processor informs the controller before adding or replacing a sub-processor, and the controller may object. Sub-processors are bound by the same data protection obligations.

5. International transfers

Data is not transferred outside the EEA except on the basis of an adequacy decision or standard contractual clauses.

6. Controller obligations

The controller guarantees that it has a legal basis for enrolling learners, that it informs them about the processing (including the role of GenieUs) and that the data entered is accurate.

7. Final provisions

This agreement forms part of the GenieUs Terms and conditions. In case of conflict regarding data protection, this agreement prevails. A new version is published on this page and accepted from the client account.