Data Processing Addendum

This DPA governs the processing of personal data by DoxaEd.Analyticx on behalf of its customer schools. Our full legal-counsel-reviewed DPA is delivered as a PDF on first paid-contract sign-up. This page summarises the key terms.

Roles

The school is the Data Fiduciary. DoxaEd.Analyticx is the Data Processor acting on documented instructions.

Sub-processors

Full list at /legal/sub-processors. We will notify customers 30 days before adding any new sub-processor.

Security measures

• TLS 1.2+ for all data in transit
• AES-256 encryption at rest
• Column-level access control on PII
• Append-only audit log of all data access
• Annual third-party penetration testing
• Quarterly backup restoration drills

Data subject rights

We provide tooling for schools to fulfil access, correction, and erasure requests directly in the admin console. Right-to-erasure requests are honoured within 30 days.

Breach notification

We notify customers within 72 hours of confirmed breach, with a detailed incident report and remediation timeline.

Requesting the full DPA

For your school’s DPA with original signatures, email legal@analyticx.doxaed.com with your school name, affiliation number, and the email of the signing principal.