Data Processing Addendum

Under an institutional engagement, the sponsoring school, college, or employer determines which cohort participates and what data is passed to Dheya. In that context, Dheya typically acts as a data processor for the participant information that flows from the institution, and as a data controller for the assessment outputs and content it produces. A DPA sets out the specifics of that relationship.

• Scope and duration of processing tied to the programme agreement.
• Categories of participants (typically students by class/year) and data types.
• Roles of Dheya, the institution, and any sub-processors used.
• Security controls, incident-notification timelines, and audit rights.
• Return or deletion of participant data at the end of the engagement.
• Cross-border transfer terms, where applicable.

Dheya relies on a small set of infrastructure and communication sub-processors to deliver assessments, reports, session scheduling, and secure hosting. A current list, with the region each processor operates from, is shared as part of the DPA request.

Write to us at the contact below from the institution’s official domain, including the programme name, expected cohort size, the term you plan to run, and any specific clauses your legal team requires. We will return a draft DPA aligned with your programme agreement.