Skip to content
Cohorta™
Sign up

Documents

Data Processing Agreement (DPA)

This is a translation. The Polish version is legally binding. Read the Polish version.

Template data processing agreement within the meaning of Article 28 GDPR. The agreement is binding as part of accepting the Terms of Service when the platform is used by the Controller (the client company); on request we provide a version for separate signature (contact). The document must be reviewed by a legal adviser before production use.

1. Parties to the agreement

Processor: YES FOR sp. z o.o., ul. Świętokrzyska 61, 32-650 Kęty, Poland, entered in the register of entrepreneurs of the National Court Register (KRS) kept by the District Court for Kraków-Śródmieście in Kraków, 12th Commercial Division of the National Court Register, under KRS number 0001181754, NIP (tax identification number) 5492485016, REGON 542135795, share capital PLN 100,000.00, operator of the Cohorta platform (the “Processor”).

Controller: the company or entity that sets up and runs a workspace on the Cohorta platform and enters personal data into it (the “Controller”). The data identifying the Controller (name, NIP, address, contact person) follow from the workspace data and from the acceptance of this agreement.

2. Subject matter and duration of the processing

The Controller entrusts the Processor with processing personal data solely to the extent and for the purpose necessary to provide the services of the Cohorta platform (hosting of courses, members, communities, events, certificates, payments and automations). The entrustment applies for the period during which the service is used and for the period necessary to settle and close it, after which the data are deleted or returned in accordance with section 8.

3. Nature, purpose, type of data and categories of data subjects

  • Purpose: providing the services of an educational SaaS platform to the Controller.
  • Categories of data subjects: participants/learners, community members, workspace staff (trainers, moderators, administrators), buyers.
  • Type of data: identification and contact data (first name, surname, email), account data, content created by the user, learning progress and certificates, billing data necessary for invoices. The Processor does not collect special categories of data (Article 9 GDPR) as part of the standard service; if the Controller enters such data, the Controller is responsible for the legal basis.

4. Obligations of the Processor (Article 28(3) GDPR)

  • processes data only on documented instructions from the Controller (including with regard to transfers outside the EEA), unless required to do so by Union or Member State law;
  • ensures that persons authorised to process the data have committed themselves to confidentiality;
  • takes the security measures required by Article 32 GDPR (section 5);
  • respects the conditions for engaging sub-processors (section 6);
  • as far as possible, assists the Controller in fulfilling data subjects' rights and the obligations under Articles 32 to 36 GDPR;
  • deletes or returns the data after the end of the service (section 8);
  • makes available the information necessary to demonstrate compliance and allows for audits (section 9).

5. Security (Article 32 GDPR)

The Processor applies, among other measures: isolation of data per workspace at database level (Row Level Security), encryption in transit (TLS) and at rest, access control based on roles and permissions, private file storage with short-lived signed links, rate limiting, verification of payment webhook signatures and event logging. The measures are reviewed periodically (security audits).

6. Sub-processing (sub-processors)

The Controller gives general authorisation for the use of the sub-processors listed in Annex 1. The Processor informs the Controller of intended changes to the list in advance, giving the opportunity to object. The Processor imposes on sub-processors data protection obligations no less stringent than those in this agreement.

7. Personal data breaches

The Processor notifies the Controller of a personal data breach without undue delay, and no later than 48 hours after becoming aware of it, providing the information necessary to fulfil the obligation under Article 33 GDPR.

8. Termination and deletion of data

After the end of the provision of services, the Processor, at the choice of the Controller, deletes or returns all personal data and deletes existing copies, unless the law requires their storage (for example billing data for tax purposes).

9. Audit

The Processor makes available to the Controller the information necessary to demonstrate compliance with its obligations and allows for audits, including inspections, conducted by the Controller or an authorised auditor, within a reasonable time and with due regard for confidentiality and continuity of the service.

10. Transfers outside the EEA and final provisions

Some sub-processors are based in the US; transfers take place on the basis of standard contractual clauses (SCCs) and the Data Privacy Framework. Matters not governed by this agreement are subject to the GDPR and Polish law. This agreement forms an integral part of the Terms of Service and the Privacy Policy.

Annex 1: list of sub-processors

  • Supabase Inc.: database and authentication hosting (EU region, SCCs for transfers to the US).
  • Vercel Inc.: application hosting.
  • Stripe: payment operator (Ireland/US).
  • Resend: transactional email provider.
  • Fakturownia.pl: issuing VAT invoices (when the Controller enables the integration).
  • Anthropic PBC: language models powering the generation of course outlines and lesson content (only when the Controller uses this feature). The model receives the content entered by the Controller: course topic, target group, goal, lesson titles and guidelines. Participants' personal data are not transferred, and the content of the requests is not stored by us. Anthropic does not use the content it receives to train its models.
  • Google Ireland Ltd.: Google Analytics and Google Tag Manager, only when the workspace Administrator enables analytics and after consent to analytics cookies.

Questions about data processing: use the contact form.

Version of 21 August 2026. The previous version applied from 1 June 2026; the change concerns the entity operating the platform, which since August 2026 has been YES FOR sp. z o.o.