ULYDIA

Data Processing Agreement

Last updated: July 2026

This Data Processing Agreement (DPA) applies when a school, training provider, company or other organization (the Customer) uses Ulydia features, such as CRM, applications or messaging, to process personal data of students, applicants or candidates. For that processing, the Customer acts as data controller and Sendbiz Inc. (Ulydia) acts as data processor under Article 28 GDPR. This DPA forms part of our Subscription Terms.

1. Scope of processing

Subject matter: hosting and operation of the Ulydia platform features used by the Customer. Duration: the term of the Customer subscription or use of the Services. Nature and purpose: storage, display, organization and transmission of applicant and student data for admission, orientation and recruitment management. Categories of data subjects: students, applicants, job seekers and Customer staff. Categories of data: identification and contact details, education and career information, application documents such as CVs, diplomas and transcripts, messages and interaction history.

2. Processor obligations

Ulydia will:

  • process personal data only on documented instructions from the Customer, including as configured through the Services;
  • ensure that persons authorized to process the data are bound by confidentiality obligations;
  • implement appropriate technical and organizational security measures, including access controls, encryption in transit and at rest, and security monitoring;
  • assist the Customer, taking into account the nature of the processing, in responding to data subject requests and in meeting security, breach notification and impact assessment obligations;
  • notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer data;
  • at the end of the Services, delete or return personal data at the choice of the Customer, unless retention is required by law;
  • make available the information necessary to demonstrate compliance and allow reasonable audits, which may be satisfied through documentation and third-party reports.

3. Subprocessors

The Customer authorizes Ulydia to use the following subprocessors, which may evolve over time. We will inform Customers of material changes and allow reasonable objection:

  • Supabase (database, authentication and storage, hosted in AWS eu-west-1, Ireland);
  • Vercel Inc. (application hosting and delivery);
  • Stripe Inc. (payments, billing and tax calculation);
  • OpenAI (AI processing for guidance and matching features);
  • email delivery providers used for transactional notifications.

4. International transfers

Customer data is primarily stored within the European Union (AWS region eu-west-1, Ireland). Where a subprocessor processes personal data outside the European Economic Area, transfers rely on appropriate safeguards such as the European Commission Standard Contractual Clauses or, where applicable, the EU-US Data Privacy Framework certification of the receiving provider.

5. Customer obligations

The Customer is responsible for the lawfulness of its processing, including having a valid legal basis, providing required information to data subjects, responding to data subject requests addressed to it, and configuring the Services appropriately. The Customer must not use the Services to collect data unrelated to education, orientation or recruitment purposes.

6. Contact

For questions about this DPA or to exercise controller rights, contact us at contact@ulydia.com.