Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between:

Data Controller: [INSTITUTION NAME], [INSTITUTION ADDRESS], [REGISTRATION NUMBER] ("Controller" or "Institution"); and

Data Processor: EduCreds Labs, Kampala, Uganda (URSB incorporation in progress) ("Processor" or "EduCreds").

Together referred to as the "Parties." This DPA forms part of and supplements the Master Service Agreement or institution subscription agreement between the Parties (the "Service Agreement").

Article 1 — Definitions

In this Agreement, the following terms have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person as defined under the Uganda Data Protection and Privacy Act 2019.
• "Processing" means any operation or set of operations performed on personal data, whether or not by automated means.
• "Data Controller" means the Institution, which determines the purposes and means of processing personal data of students and staff.
• "Data Processor" means EduCreds Labs, which processes personal data on behalf of the Controller.
• "Sub-Processor" means any processor engaged by EduCreds to carry out specific processing activities on behalf of the Controller.
• "Data Subject" means the natural person to whom personal data relates (primarily students of the Institution).
• "PDPA 2019" means the Uganda Data Protection and Privacy Act 2019 and any regulations, guidance, or amendments made thereunder.
• "Platform" means the EduCreds digital credential management platform and associated services.

Article 2 — Scope and Purpose of Processing

EduCreds processes personal data provided by the Institution solely to deliver the credential management services described in the Service Agreement, including: issuing W3C Verifiable Credentials on behalf of the Institution; enabling students to access and share their credentials; enabling authorised verifiers to verify credential authenticity; and maintaining revocation and audit records.

EduCreds shall not process personal data for any purpose other than those specified in this DPA and the Service Agreement, unless required by applicable law, in which case EduCreds shall (where legally permitted) inform the Controller before such processing takes place.

Article 3 — Data Categories

Category	Examples	Controller-Determined?
Student Identifiers	Student names, student numbers, email addresses (if provided by institution)	Yes — institution determines what data is submitted
Academic Records	Degree title, graduation date, grades (if included by institution), academic awards	Yes — institution determines credential content
Credential Metadata	Credential type, issuance date, credential status, cryptographic identifiers	Partially — EduCreds generates technical metadata
Platform Usage Data	Login timestamps, IP addresses, API access logs	No — generated automatically for security purposes

Article 4 — EduCreds Obligations as Processor

EduCreds shall:

1. Process personal data only on documented instructions from the Controller (as set out in the Service Agreement and this DPA) unless required by applicable law;
2. Ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under appropriate statutory obligations of confidentiality;
3. Implement appropriate technical and organisational security measures as described in Article 6;
4. Respect the conditions for engaging Sub-Processors as set out in Article 5;
5. Assist the Controller in fulfilling its obligations regarding data subject rights requests (Articles 7 of this DPA) and data protection impact assessments where relevant;
6. Delete or return all personal data to the Controller upon termination of the Service Agreement (Article 8);
7. Make available all information necessary to demonstrate compliance with this DPA and cooperate with audits as described in Article 9;
8. Inform the Controller if, in EduCreds' opinion, an instruction from the Controller violates applicable data protection law.

Article 5 — Sub-Processors

The Controller grants EduCreds general authorisation to engage the following current Sub-Processors, subject to the conditions in this Article:

Sub-Processor	Country	Processing Activity	Data Categories
Microsoft Azure	USA / Global	Cloud infrastructure — compute, database, key vault, monitoring, email	All data categories (encrypted)
IPFS / Pinata	USA / Decentralised	Decentralised storage for public credential schema metadata	Public metadata only — NO student PII

EduCreds shall: (a) impose the same data protection obligations on Sub-Processors as those imposed on EduCreds by this DPA; (b) remain fully liable to the Controller for Sub-Processor compliance; (c) provide 30 days' prior written notice of any intended changes to Sub-Processors; and (d) allow the Controller to object to such changes within the notice period.

Article 6 — Security Measures

EduCreds shall implement and maintain the following technical and organisational security measures:

Encryption

• All data in transit encrypted via TLS 1.2 or higher
• All data at rest encrypted via AES-256 on Azure managed disks
• All W3C Verifiable Credentials cryptographically signed with ES256 keys stored in Azure Key Vault

Access Control

• Role-based access control (RBAC) — staff access limited to data required for their specific role
• Multi-factor authentication (MFA) required for all administrative platform access
• Regular access reviews and prompt de-provisioning of departed staff
• No student personal data accessible in application logs

Audit Logging

• Append-only audit logs for all credential issuance, revocation, and data access events
• Audit logs retained for a minimum of 7 years
• Centralised log management via Azure Application Insights

Organisational Measures

• Staff data protection training upon onboarding and annually thereafter
• Information Security Policy (EC-SEC-001) maintained and reviewed annually
• Annual security review; penetration testing prior to production launch and following major releases

Article 7 — Data Subject Rights & Breach Notification

Data Subject Rights

EduCreds shall, within 7 calendar days of receipt, forward any data subject rights requests received directly to the Controller. EduCreds shall provide reasonable technical assistance to the Controller in fulfilling data subject rights obligations under PDPA 2019.

Where a data subject requests deletion of credentials issued on behalf of the Controller, EduCreds shall act on documented instructions from the Controller, noting that blockchain-anchored credential hashes are technically irremovable from the public ledger (though PII is not stored on-chain and credential records in EduCreds' database can be deleted).

Data Breach Notification

In the event of a personal data breach, EduCreds shall notify the Controller without undue delay and in any event within 72 hours of becoming aware of a breach. The notification shall include, to the extent available: (a) a description of the nature of the breach; (b) the categories and approximate number of data subjects and records affected; (c) the likely consequences; and (d) measures taken or proposed to address the breach.

EduCreds shall provide reasonable cooperation to the Controller in managing notifications to data subjects and the Uganda Personal Data Protection Office as required under PDPA 2019.

Article 8 — Data Return and Deletion

Upon termination or expiry of the Service Agreement, EduCreds shall, at the Controller's choice: (a) return all personal data to the Controller in a machine-readable format (W3C VC format); or (b) securely delete all personal data from EduCreds' systems, with written confirmation of deletion provided within 30 days.

EduCreds may retain anonymised audit log data and technical records required by applicable law or for legitimate business purposes (e.g., financial records), provided such retained data does not include student personal data in identifiable form.

On-chain credential hashes (which contain no PII) remain permanently anchored on the blockchain and cannot be deleted — this is disclosed to the Controller at the time of onboarding.

Article 9 — Audit Rights

EduCreds shall, upon reasonable notice (minimum 14 business days) and no more than once per 12-month period (unless the Controller has reasonable grounds to believe a breach of this DPA has occurred), make available to the Controller or its appointed auditor all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits conducted by the Controller or its auditor.

Audits shall be conducted at the Controller's expense and shall not unreasonably interfere with EduCreds' business operations. The parties shall agree the scope and duration of any audit in advance.

Article 10 — International Data Transfers

Processing of personal data by the Sub-Processor Microsoft Azure may involve transfer of data outside Uganda to Azure data centres in the USA and other regions. Such transfers are subject to Microsoft Azure's data processing terms and applicable transfer safeguards.

EduCreds shall ensure that any transfer of personal data outside Uganda is subject to appropriate safeguards in accordance with PDPA 2019, including contractual clauses that provide equivalent protections to those required under Ugandan law.

Article 11 — Term and Termination

This DPA commences on the date the Service Agreement is executed and continues for the duration of the Service Agreement. Upon termination of the Service Agreement for any reason, the obligations in this DPA shall survive to the extent necessary to complete the data return/deletion obligations in Article 8.

Either Party may terminate this DPA by written notice if the other Party commits a material breach of its obligations under this DPA and fails to remedy such breach within 30 days of written notice.

Article 12 — Governing Law

This DPA is governed by and construed in accordance with the laws of Uganda, including the Uganda Data Protection and Privacy Act 2019. The Parties submit to the non-exclusive jurisdiction of the courts of Uganda for resolution of any dispute arising under this DPA.

Where this DPA is silent on a matter relating to data protection, the provisions of PDPA 2019 and any applicable regulations shall apply.

Signature Blocks

Completed copies of this DPA should be sent to: admin@educreds.xyz | +256757282316