Sign inGet started

Data Processing Agreement

Last updated Oct 30, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Progma ("Progma", "Processor") and the institution that uses the Service ("Institution", "Controller"). It governs the processing of personal data that Progma carries out on behalf of the Institution in connection with the Service.

This DPA is entered into under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules and regulations. It applies automatically to every Institution that uses the Service, without a separate signature. An Institution that requires a countersigned copy may request one at dpo@progma.app; a countersigned copy does not change the terms of this DPA unless the parties expressly agree otherwise in writing.

1. Roles of the parties

For personal data processed under the Service, the Institution acts as the personal information controller and Progma acts as a personal information processor that processes such data only on the Institution's documented instructions, including as set out in this DPA and the Terms.

For certain data—such as account administration, billing, and prospect inquiries—Progma acts as a controller; that processing is governed by the Privacy Policy.

2. Subject matter and scope

  • Subject matter: Progma's provision of the programming-education Service.
  • Duration: the term of the Institution's subscription, plus any period required for return or deletion of data.
  • Nature and purpose: hosting, executing, grading, storing, transmitting, and supporting the data necessary to operate the Service, and keeping usage records to understand feature use and the cost of operating the Service.
  • Categories of data subjects: the Institution's administrators, teachers, and students (who may include minors).
  • Categories of personal data: identity and contact data, account and authentication data, course and enrollment data, learning data (including submitted code and grades), usage records (counts and categories of feature use that never contain user content, IP addresses, or device information, kept for 24 months; see the Privacy Policy, Sections 2 and 9), and related records.
  • Sensitive personal information: student learning records, such as grades, submissions, and feedback, are information about education and are therefore sensitive personal information under the Data Privacy Act. Progma processes them as such. The Institution must not submit other sensitive personal information that the Service does not need, such as health information or government-issued identification numbers.

3. Processor obligations

Progma will:

  • process personal data only on the Institution's documented instructions, unless required by law (in which case it will inform the Institution where legally permitted);
  • ensure persons authorized to process personal data are bound by appropriate confidentiality obligations;
  • implement appropriate technical and organizational security measures (see Section 6);
  • assist the Institution, taking into account the nature of processing, in responding to data-subject requests and in meeting the Institution's security, breach-notification, and impact-assessment obligations;
  • make available information reasonably necessary to demonstrate compliance; and
  • at the Institution's choice, delete or return personal data at the end of the engagement, except where retention is required by law.

Student data. Students may include minors. The Institution confirms that it has a lawful basis for having Progma process its students' personal data, and that it has obtained any consent required under applicable law, including from parents or legal guardians where required. Progma will use student personal data only to provide the Service to the Institution. Progma will not sell student personal data, will not use it for advertising, and will not use it to profile students for any purpose other than the Institution's educational purposes.

4. Sub-processors

The Institution authorizes Progma to engage sub-processors to provide the Service. A current list is published at Sub-processors. Progma will impose data-protection obligations on sub-processors that are substantially similar to those in this DPA and remains responsible for their performance. Before adding or replacing a sub-processor, Progma will notify the Institution's administrators by email at least thirty (30) days in advance and update the Sub-processors page. Within that period, the Institution may object in writing on reasonable data-protection grounds, by email to dpo@progma.app. The parties will work in good faith to resolve the objection. If it cannot be resolved, the Institution may end its subscription by written notice before the change takes effect, and Progma will refund prepaid fees as described in the Refund & Billing Policy.

5. International transfers

Some sub-processors process personal data outside the Philippines. Their locations are published on the Sub-processors page. Progma remains responsible for personal data it transfers to sub-processors, including across borders, and uses contractual or other reasonable means to ensure that the data receives a comparable level of protection while it is processed by them, consistent with Section 21 of the Data Privacy Act.

AI-assisted features. The Service's AI-assisted features are powered by DeepSeek, which processes requests in China. These features include the in-product assistant used by teachers and students (including images and documents attached to its messages), question and test-case generation (including from uploaded documents), and feedback on code submissions. Progma limits what is sent to DeepSeek to the content needed for each request: the text, code, images, and document text that users type or upload to an AI feature. Progma does not send names, email addresses, or account identifiers with these requests, does not send the file names of documents attached to assistant messages, removes embedded metadata (including location data) from images attached to assistant messages before they are sent, and samples of imported user lists are masked before they are sent. By accepting this DPA, the Institution authorizes this transfer. The Institution should instruct its users, consistent with the Acceptable Use Policy, not to include other people's personal data in content they submit to AI features.

6. Security measures

Progma maintains technical and organizational measures designed to protect personal data, which may include: access controls and role-based authorization; logical isolation between institution tenants; encryption of data in transit; secure credential storage; two-factor authentication available for accounts that sign in with a password and required for Progma platform administrators; audit logging of sensitive actions, with out-of-band notice to the account holder of security-relevant account changes; and operational monitoring. The current description of these measures is published on our Security & Responsible Disclosure page, which forms the security-measures schedule to this DPA.

7. Personal data breach

Progma will notify the Institution without undue delay after becoming aware of a personal data breach affecting the Institution's data, and will provide information reasonably available to assist the Institution in meeting its obligations, including any notification to the National Privacy Commission and affected data subjects.

8. Data-subject requests

If Progma receives a request from a data subject relating to data processed on behalf of the Institution, Progma will, where legally permitted, direct the request to the Institution and assist the Institution in responding.

9. Return and deletion

On termination or expiry, Progma will delete or return personal data processed on behalf of the Institution in accordance with the Institution's instructions, except where retention is required by law. Some data is soft-deleted before permanent deletion as part of normal operations.

10. Audits

Progma will make available to the Institution information reasonably necessary to demonstrate compliance with this DPA, including by responding to reasonable written security and privacy questionnaires and providing relevant documentation.

An on-site or other direct audit may be conducted only where required by the National Privacy Commission or other competent authority, or following a personal data breach affecting the Institution's data. Such an audit:

  • may take place no more than once in any twelve (12) month period, unless the authority requires otherwise;
  • requires at least thirty (30) days' written notice, and is scheduled to minimize disruption to the Service;
  • is subject to reasonable confidentiality and security conditions, and may not give access to other customers' data; and
  • is conducted at the Institution's cost.

11. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms. In the event of a conflict between this DPA and the Terms regarding the processing of personal data, this DPA controls.

12. Contact

Questions about this DPA, and notices concerning the processing of personal data under it, may be sent to Progma's Data Protection Officer at dpo@progma.app.