Institution Data Processing Addendum

Version: 2026.7.1

This DPA forms part of the Institution subscription between the school or university (“Institution”) and Bacenik CareerClear (“Processor”).

Roles

• Institution is Controller of learner personal data it uploads or directs learners to enter.
• CareerClear is Processor for that institutional data.

Processing scope

Career assessments, pathway plans, cohort analytics, seat administration, and related support.

Processor obligations

• Process only on Institution instructions
• Apply appropriate technical and organizational security measures
• Ensure personnel confidentiality
• Assist with data-subject requests under applicable privacy law where feasible
• Delete or return institutional personal data on contract end (subject to legal retention)
• Notify Institution without undue delay after becoming aware of a personal data breach

Sub-processors

Infrastructure, email, and payment providers (for example hosting, transactional email, and card processors). A current list is available on request.

International transfers

Safeguards are applied where sub-processors process data outside the Institution’s primary jurisdiction.

Institution obligations

• Provide required notices and consents (including parental consent where required)
• Not upload unnecessary special-category data
• Configure counselor and admin roles appropriately