Data Processing Addendum

Draft framework. This describes how Vouch handles data as a software platform; the final binding legal text is to be completed with counsel before public launch.

This addendum describes how Vouch processes personal data on behalf of a training center. It is meant to be referenced by a center's own privacy policy, so learners can see that the center is the controller and Vouch is its processor.

Roles

The training center is the data controller. Vouch is the processor, acting only on the center's documented instructions.

Scope of processing

Vouch processes learner, applicant, and staff data (profiles, applications, enrollments, documents, attendance, grades, certificates, messages) for the sole purpose of providing the platform to the center.

Security and isolation

Data is partitioned per center and access-controlled at the database level (row-level security). Platform-staff access is limited and recorded in an access log the center can review.

Sub-processors

Vouch relies on infrastructure and AI sub-processors to run the platform. [The current sub-processor list and notification terms to be provided.]

Return and deletion

A center can export its records at any time from Settings → Data & governance, and set a retention window. On offboarding, Vouch returns or deletes the center's data. [Formal return/deletion terms to be completed with counsel.]

Full addendum

[The complete, binding Data Processing Addendum — including international transfer mechanisms and breach-notification terms — is to be completed with counsel before public launch.]