Data Processing Addendum

Effective Date: June 2026
Last Updated: June 2026

1. Parties

This Data Processing Addendum (“Addendum”) forms part of the agreement for services between:

Professional Learning International Limited
NZBN: 9429046250513
Trading as / operating CBI Mathematics
(“PLI”, “CBI Mathematics”, “we”, “us”, or “our”)

and the customer, school, organisation, subscriber, or authorised entity using the CBI Mathematics services (“Customer”).

Together, PLI and the Customer are referred to as the “Parties”.

2. Purpose

This Addendum sets out the Parties’ respective responsibilities regarding privacy, data protection and the limited processing of personal information in connection with the CBI Mathematics Portal and associated services.

This Addendum should be read alongside our:

• Privacy Policy;
• Terms & Conditions;
• Sub-Processors & Third-Party Services page;
• Cookie Policy;
• and any applicable registration, subscription, or services agreement between the Parties.

3. Platform Purpose

PLI primarily processes limited data relating to educators, staff, accounts, operations, subscriptions and course participation required to provide, administer, secure, support and improve the services.

The CBI Mathematics Portal is designed for educators, schools and authorised professional users. It is not designed for student accounts or direct student use.

The platform is not intended to collect, host, or process identifiable student personal information, identifiable student assessment records, identifiable student analytics, or identifiable student educational records.

Schools may voluntarily provide anonymised or de-identified student work samples, assessment examples, or aggregated school-wide testing results to support professional learning, programme evaluation, research, quality assurance, impact review, or service improvement. Such information must not identify individual students.

4. Roles of the Parties

PLI may act as:

• a Data Controller for its own business operations, website management, analytics, security, procurement administration, communications, marketing, billing and legal compliance; and
• a limited Data Processor where it processes educator or staff account information on behalf of a Customer organisation.

The Customer remains responsible for:

• ensuring its own compliance with applicable privacy, education, employment and data protection laws;
• ensuring it has a lawful basis for any personal information provided to PLI;
• ensuring authorised users use the platform appropriately;
• ensuring identifiable student personal information is not uploaded or submitted to the platform;
• ensuring any student work samples, assessment examples, or school-wide results shared with PLI are anonymised, de-identified, or aggregated before being provided.

5. Customer Responsibilities

The Customer agrees that it will:

• not upload identifiable student personal information into the CBI Mathematics Portal;
• not use the services to process special category, highly sensitive, or regulated personal information unless expressly agreed in writing;
• ensure that all personal information provided to PLI is accurate, lawful and appropriate for the services;
• ensure authorised users maintain appropriate account security and password practices;
• remove student names, identifying details, and other direct identifiers from any student work samples or assessment examples before sharing them with PLI;
• remain responsible for any downloaded assessment materials, templates, spreadsheets, or records managed within the Customer’s own systems or environments.

Where schools or educators use downloaded assessment materials or templates, the Customer remains responsible for complying with applicable education, privacy and data protection obligations relating to student information.

6. Nature of Processing

PLI may process limited personal information, including:

• name;
• email address;
• school, company, or organisation affiliation;
• account credentials and account details;
• subscription and purchase records;
• educator course enrolment information;
• course participation, progress and completion records;
• technical usage information;
• IP address;
• browser and device information;
• support and communication records.

PLI may also receive anonymised, de-identified, or aggregated student work samples, assessment examples, or school-wide testing results where provided by a school or organisation for professional learning, programme evaluation, research, quality assurance, impact review, or service improvement purposes.

Processing purposes may include:

• account administration;
• service provision;
• educator professional learning;
• course delivery and certification;
• customer support;
• billing and subscription management;
• platform security and operational integrity;
• analytics and service improvement;
• programme evaluation and impact review;
• legal, accounting and administrative compliance.

7. Course Participation and Analytics

Analytics and participation tracking relate to educator professional learning participation, engagement, progress and course completion activity.

PLI does not use platform analytics or participation information to make automated educational, grading, employment, or similarly significant decisions about individuals.

8. Student Data

The CBI Mathematics Portal is not designed for student use and does not provide student accounts.

PLI does not:

• provide student accounts;
• intentionally collect identifiable student personal information through the platform;
• intentionally host identifiable student assessment records through the platform;
• intentionally process identifiable student analytics;
• intentionally process identifiable student educational records;
• use student information for advertising;
• sell student personal information;
• make automated decisions relating to students.

PLI may receive anonymised or de-identified student work samples, assessment examples, or aggregated assessment results that cannot reasonably identify individual students. These materials are used solely to support professional learning, programme evaluation, research, quality assurance, impact review, and continuous improvement of CBI Mathematics services.

Assessment spreadsheets, downloaded templates and teacher-managed records remain under the control of the relevant school, organisation and/or teacher within their own systems or environments unless anonymised, de-identified, or aggregated materials are voluntarily shared with PLI for the purposes described above.

9. Processor Obligations

Where PLI acts as a Data Processor, PLI shall:

• process personal information only on documented instructions from the Customer, unless required by applicable law;
• ensure authorised personnel are subject to confidentiality obligations;
• implement commercially reasonable technical and organisational security measures appropriate to the limited nature of the personal information processed;
• provide reasonable assistance regarding applicable data subject rights requests;
• notify affected Customers without undue delay upon becoming aware of a confirmed reportable personal data breach affecting Customer personal information;
• take commercially reasonable steps to investigate, mitigate and remediate confirmed breaches;
• delete or anonymise relevant Customer information upon written request within a reasonable operational timeframe, subject to legal, accounting, security, operational and backup retention requirements.

Temporary backup data may persist in accordance with the infrastructure provider’s backup schedules.

10. Sub-Processors

PLI may engage trusted third-party sub-processors necessary for the operation, hosting, administration, support, security, analytics, communication, billing and improvement of the services.

These may include:

• hosting and infrastructure providers;
• analytics providers;
• CRM and communication providers;
• payment and billing providers;
• customer support and operational service providers;
• legal, accounting, or compliance service providers.

PLI shall take reasonable steps to ensure sub-processors are subject to appropriate contractual privacy, confidentiality and security obligations.

A current list of our principal sub-processors and third-party service providers is available on our Sub-Processors & Third-Party Services page.

11. International Data Transfers

PLI and its sub-processors may process limited personal information outside New Zealand and outside the European Economic Area, including in Australia, the United States and other jurisdictions.

PLI does not locally host or store customer data for the CBI Mathematics Portal in New Zealand.

Where international transfers occur, PLI seeks to rely on appropriate safeguards implemented by relevant providers, including where applicable:

• Standard Contractual Clauses approved by the European Commission;
• EU-U.S. Data Privacy Framework participation;
• contractual safeguards;
• or other lawful transfer mechanisms recognised under applicable data protection laws.

12. Security Measures

PLI maintains commercially reasonable technical and organisational security measures appropriate to the limited nature of the personal information processed.

These measures may include:

• encrypted HTTPS/TLS connections;
• password-protected user accounts;
• restricted administrative access;
• hosting-provider-managed infrastructure security;
• commercially reasonable monitoring and backup procedures;
• confidentiality obligations for authorised personnel;
• procedures for responding to suspected security incidents and reportable personal data breaches.

While reasonable precautions are taken, no internet transmission or storage system can be guaranteed completely secure.

13. Data Retention and Deletion

PLI retains personal information only for as long as reasonably necessary for:

• service provision;
• account administration;
• customer support;
• course completion and certification records;
• operational administration;
• legal and accounting obligations;
• legitimate business purposes.

Typical retention practices may include:

• active account information retained during the Customer relationship;
• course participation and completion records retained for reporting, certification, support and organisational administration;
• financial and transaction records retained as required by applicable law;
• de-identified or aggregated programme evaluation materials retained for research, quality assurance, impact review and service improvement;
• temporary backup retention in accordance with infrastructure provider schedules.

Upon written request, and subject to legal, accounting, operational, security and backup retention obligations, Customer information may be deleted or anonymised within a reasonable operational timeframe.

14. Data Subject Rights and Requests

PLI shall provide reasonable cooperation in response to requests from individuals exercising applicable privacy or data protection rights.

Where appropriate, PLI may direct individuals to the relevant school, organisation, or Customer if the request relates to information independently controlled by that organisation.

Requests may relate to:

• access;
• correction;
• deletion;
• objection;
• withdrawal of consent, where applicable;
• other rights available under applicable privacy or data protection laws.

15. Personal Data Breach

PLI shall notify affected Customers without undue delay upon becoming aware of a confirmed reportable personal data breach affecting personal information processed in connection with the services.

PLI shall take commercially reasonable steps to:

• investigate the breach;
• mitigate potential harm;
• remediate the issue where possible;
• provide relevant information reasonably required by the Customer for compliance purposes.

16. Automated Decision-Making

PLI does not use Customer personal information for automated decision-making or profiling producing legal or similarly significant effects.

PLI does not use platform analytics or participation information to make automated educational, grading, employment, or similarly significant decisions relating to individuals or students.

17. Audit and Compliance Information

Upon reasonable written request, PLI may provide information reasonably necessary to demonstrate compliance with this Addendum.

Any audit, inspection, or compliance review shall be subject to reasonable confidentiality, security, operational, commercial and legal limitations.

PLI is not required to provide access to systems, infrastructure, trade secrets, confidential security controls, or information that could compromise the security or privacy of other customers or users.

18. Confidentiality

Each Party shall keep confidential any confidential information received from the other Party in connection with the services, except where disclosure is required by law or permitted under the applicable agreement between the Parties.

19. Governing Law

Unless otherwise agreed in writing, this Addendum is governed by the laws of New Zealand.

20. Privacy and Agreement Contact

21. Signatures

This Addendum may be made available publicly for transparency. Where a signed DPA is required by a Customer, the Parties may complete the signature blocks below or execute a separate written agreement.