Data Processing Agreement (DPA)
Last Updated: June 13, 2026
1. Introduction
This Data Processing Agreement ("DPA") describes how LILO Learning processes personal data in compliance with the EU General Data Protection Regulation (GDPR) and similar international data protection laws.
Applicability: This DPA applies to all users in the EU, EEA, UK, or who are otherwise subject to GDPR or similar regulations.
2. Definitions
- Personal Data: Any information relating to an identified or identifiable natural person (email, name, code, IP address, etc.).
- Processing: Any operation on personal data (collection, use, storage, sharing, deletion).
- Data Controller: LILO Learning (the entity collecting and using your data).
- Data Processor: Third-party service providers who process data on our behalf.
- Data Subject: You (the user whose data is being processed).
- Standard Contractual Clauses (SCCs): International agreements enabling data transfers outside the EU/EEA.
3. Legal Basis for Processing
| Purpose | Legal Basis | Retention |
|---|---|---|
| Provide educational services | Contract Performance | Active + 30 days |
| Personalization & recommendations | Consent + Legitimate Interest | 1 year |
| Analytics & improvement | Consent + Legitimate Interest | 90 days |
| AI-assisted learning | Consent | 1 year |
| Tax & legal compliance | Legal Obligation | 7 years |
| Fraud prevention | Legitimate Interest | 1 year |
| Communication | Consent | For the purpose + 30 days |
You can withdraw consent at any time by contacting privacy@learnwleo.com.
4. What Personal Data We Process
Account Information
- Email address
- Full name
- Profile picture
- Email verification status
Learning Activity
- Code submissions
- Test results
- Progress tracking
- Study preferences
Behavioral Data
- Pageviews & feature usage
- Session recordings
- AI-generated learner profile
- Device, browser, OS
- IP address (temporarily)
User Content
- Bug reports
- Feature requests
- Feedback & ratings
- Resumes (Academy)
5. Third-Party Data Processors
5.1 Mandatory Processors (Required for Service)
| Processor | Purpose | Location | SCC Status |
|---|---|---|---|
| Supabase | Authentication | U.S. | SCCs signed |
| MongoDB | Database | U.S. | SCCs signed |
| Cloudflare | Code execution | Global | SCCs signed |
| Amazon S3 | File storage | U.S. | SCCs signed |
5.2 Optional Processors (Analytics)
| Processor | Purpose | Opt-Out |
|---|---|---|
| Mixpanel | Analytics & session recording | Yes — disable in account settings |
| Google Cloud (Vertex AI) | AI narrative generation | Yes — local inference fallback |
6. International Data Transfers
Your data is transferred to the United States and other countries where our service providers are located. We rely on Standard Contractual Clauses (SCCs) signed with all U.S. processors to legally transfer your data.
U.S. data protection laws differ from GDPR. Your data may be subject to U.S. government surveillance under the CLOUD Act.
7. Your Rights Under GDPR
Right of Access
Request a copy of all personal data we hold about you. Response within 30 days, free of charge.
Email privacy@learnwleo.com — Subject: "GDPR Article 15 - Right of Access"
Right to Rectification
Correct inaccurate personal data (email, name, profile info).
Update in account settings, or email privacy@learnwleo.com — Subject: "GDPR Article 16"
Right to Erasure ("Right to be Forgotten")
Request deletion of your personal data. Grounds include: data no longer necessary, withdrawal of consent, unlawful processing.
Email privacy@learnwleo.com — Subject: "GDPR Article 17 - Right to Erasure"
Right to Restrict Processing
Restrict processing while a dispute is resolved (e.g., you contest accuracy, or we no longer need data but you need it for a legal claim).
Email privacy@learnwleo.com — Subject: "GDPR Article 18"
Right to Data Portability
Receive your data in portable JSON or CSV format.
Email privacy@learnwleo.com — Subject: "GDPR Article 20 - Data Portability"
Right to Object
Object to processing based on legitimate interests, statistical/profiling purposes, or direct marketing.
Email privacy@learnwleo.com — Subject: "GDPR Article 21 - Right to Object"
Rights Related to Automated Decision Making
Request human review of decisions made by automated systems (AI-generated learner profiles, engagement scoring, cheat detection).
Email privacy@learnwleo.com — Subject: "GDPR Article 22 - Automated Decision Making"
All GDPR requests are responded to within 30 days. We may extend by 60 days for complex requests (you'll be notified). Identity verification required.
8. Data Breach Notification
If a data breach impacts your personal data, we will notify you within 72 hours of discovery with details of what was breached, likely consequences, and remediation steps.
To report a security issue: security@learnwleo.com
You have the right to lodge a complaint with your local Data Protection Authority (EU: European Data Protection Board; UK: ICO at ico.org.uk).
9. Contact & DPO
Data Protection Officer (DPO): dpo@learnwleo.com
Privacy inquiries: privacy@learnwleo.com
Response time: 7 business days for general inquiries; 30 days for formal data subject requests.