Global Data Processing Addendum

DATED 2024-10-01 · VERSION 20260811_rev01 · COMPARED WITH 20241212_rev01

Full text changes — 20241212_rev01 to 20260811_rev01

COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED

72721. **Schedule of Data**. The following Personal Data elements Processed by the Services are described below.
7373
7474<table><tbody><tr><td><p><strong>Services Name</strong></p></td><td><p><strong>Personal Data Elements</strong></p></td></tr><tr><td><p><strong>Canvas Learning Management System (including mobile apps)</strong></p></td><td><p>Application username/ID &amp;&nbsp; hashed password</p><p>Assessment results (e.g., 86%)&nbsp;</p><p>Avatar URL (if enabled by the Customer, e.g., URL of Avatar image)&nbsp;</p><p>Browser locale (e.g., en, browser language setting)&nbsp;</p><p>Calendar events (e.g., event location)</p><p>Comments (e.g., discussions, media comments, submissions)&nbsp;</p><p>Country (e.g., CAN)&nbsp;</p><p>Course content (e.g., Lesson #4, Syllabus)&nbsp;</p><p>Course results (e.g., B+)&nbsp;</p><p>Email address (e.g., John.Doe@awesomeu)</p><p>Enrollment status (end-users association with a specific course or section, e.g., Student or Teacher)</p><p>First and last name&nbsp;</p><p>IP Address (e.g., 127.0.0.1)&nbsp;</p><p>Locale (The end-user's locale. This is an optional field and may not be entered by the end-user, e.g., en - language selection)&nbsp;</p><p>Messages (e.g., notifications and course conversations)</p><p>Media content created by the user (e.g., images, voice recording, comments)</p><p>Phone number (if enabled by the customer, for SMS messages)</p><p>Pronouns (if enabled by the customer, preferred pronouns selected by the end-user, e.g., she/her)&nbsp;</p><p>Session ID</p><p>School Name&nbsp;</p><p>School Position (e.g., Student)&nbsp;</p><p>Short name (selected by the end-user, e.g., Sam)</p><p>Student Information System (SIS) Identification Number</p><p>SIS source ID (ID for the correlated record in the SIS if a SIS integration has been configured)</p><p>Submitted content (e.g., research paper, assignments)&nbsp;</p><p>Turnitin ID (unique identifier used by Turnitin)</p><p>Webconference data (participant ID, particpant comments, user ID. If enabled by the Customer)</p></td></tr><tr><td><p><strong>Canvas Commons</strong></p></td><td><p>Canvas LMS user ID/username &amp; hashed password&nbsp;</p><p>Email address (e.g., John.Doe@awesomeu)</p><p>First and last name</p><p>IP Address (e.g., 127.0.0.1)&nbsp;</p><p>Messages/comments related to the learning object</p></td></tr><tr><td><p><strong>Canvas Catalog</strong></p></td><td><p>Account ID for the Customer</p><p>Application username/ID &amp; hashed password</p><p>Canvas LMS user ID</p><p>Class completed date (e.g., March 4, 2000)</p><p>Credit card processing token via third party credit card processor</p><p>Email address (e.g., John.Doe@awesomeu)</p><p>Enrollment status (e.g., enrolled, registered)</p><p>External ID (Canvas enrollment ID)</p><p>First and last name</p><p>Item ID and Item Type (e.g., Intro to Statistics, online class)</p><p>Order ID (The order for the cart. The unique identifier of an order.)</p><p>Product ID (e.g., class name/ID)</p><p>Purchase date (e.g., May 5, 1999)</p></td></tr><tr><td><p><strong>Canvas Studio</strong></p></td><td><p>Application username/ID &amp; hashed password</p><p>Canvas LMS user ID</p><p>Email address (e.g., John.Doe@awesomeu)</p><p>First and last name</p><p>IP Address (e.g., 127.0.0.1)</p><p>Messages related to video content</p><p>Video or media content created by the end-user (e.g., images, voice recording, comments)</p></td></tr><tr><td><p><strong>Canvas Credentials&nbsp;</strong></p></td><td><p>Application username/ID and hashed password</p><p>Badge data such as issuing institution or program</p><p>Email address (e.g., John.Doe@awesomeu)</p><p>First and last name</p><p>Institution/organization (Issuer) affiliation</p><p>IP address (e.g., 127.0.0.1)</p></td></tr><tr><td><p><strong>Elevate Services&nbsp;</strong></p></td><td><p>All data from the Student Information System authorized by the Customer</p><p>Application Username/ID &amp; Password</p><p>Email address (e.g., John.Doe@awesomeu)</p><p>First and last name</p><p>IP Address (e.g., 127.0.0.1)</p></td></tr><tr><td><p><strong>Impact by Instructure</strong></p></td><td><p>Application activity (e.g., page clicks in an application)</p><p>Application Username/ID &amp; password</p><p>Browser locale (e.g., en, browser language setting)</p><p>Customer Learning Management System username</p><p>Education level</p><p>Email address (e.g., John.Doe@awesomeu)</p><p>First and last name</p><p>IP Address (e.g., 127.0.0.1)</p><p>Language (e.g., Eng)</p><p>School name&nbsp;</p><p>School role (e.g., student, teacher)</p><p>Slack notifications (Customer administrators)</p><p>Student identification number</p></td></tr><tr><td><p><strong>Intelligent Insights</strong></p></td><td><p>All data sets from the Data Access Platform (described at https://api-gateway.instructure.com/doc/)</p><p>LTI usage data of end-users</p></td></tr><tr><td><p><strong>LearnPlatform Services</strong></p></td><td><p>District provided identifier</p><p>Email address (e.g., John.Doe@awesomeu)</p><p>English as a Second Language status</p><p>Ethnicity&nbsp;</p><p>First and last name&nbsp;</p><p>Free or Reduced Lunch eligibility</p><p>Gender&nbsp;</p><p>Mobile device mac address (mobile application only)</p><p>Mobile device serial number (mobile application only)</p><p>Mobile device UDID (universal device identifier)</p><p>Name (e.g., John Doe)</p><p>Platform usage metrics (e.g., time on platform, activities completed, etc.)</p><p>Provider collected mastery/assessment metrics&nbsp;</p><p>Student grade level&nbsp;</p><p>Student Grade Level</p><p>Student identifier</p></td></tr><tr><td><p><strong>Mastery Services</strong></p></td><td><p>Application Username/ID &amp; hashed password</p><p>Assessment Data&nbsp;</p><ul><li>Accommodations</li><li>Assessment content</li><li>Student Assessment Scores&nbsp;</li></ul><p>Biographic Data</p><ul><li>Address (e.g., 123 Main Street)</li><li>Avatar image or photograph&nbsp;</li><li>Biographic data for teachers and administrators</li><li>Birthdate (e.g., 01/01/0000)</li><li>Email address (e.g., John.Doe@awesomeu)</li><li>English language learner status (True/False/Null)&nbsp;</li><li>Ethnicity (e.g., Native Hawaiian, Irish)&nbsp;</li><li>First and last name</li><li>Free or reduced lunch status (True/False/Null)&nbsp;</li><li>Gender (ItemLogic user profiles only)</li><li>Grade level (e.g., 5th)</li><li>Individualized Education Program status (True/False/Null)&nbsp;</li><li>Phone Number</li><li>Race (e.g., Hispanic, White, Asian)&nbsp;</li></ul><p>Conversation comments (e.g., discussion)&nbsp;</p><p>Course Data (Trackers)</p><ul><li>Curriculum Plans</li><li>Student Notes&nbsp;</li><li>Parent Notes</li><li>Tracker Title (e.g., Classrooms.title, Clasrooms.teacher name)</li><li>Tracker "Fancy Name" (classroom.teacher name)</li></ul><p>IP Address (e.g., 127.0.0.1)</p><p>Section Data</p><ul><li>Teacher enrollments</li><li>Student enrollments</li></ul><p>School Name&nbsp;</p><p>School Position (e.g., Student)</p><p>School Student ID Number</p><p>State Student ID Number</p><p>Student Information System (SIS) Identification Number</p><p>Student report card data</p><p>Teacher Social Features (messages, comments, pinned content and connections)</p></td></tr><tr><td><p><strong>Portfolium&nbsp;</strong></p></td><td><p>Application username/ID &amp; password</p><p>Avatar image or photograph</p><p>Biographical information such as: phone number, gender, social media url, resume, C.V., occupation, job title, schools attended, graduation year, skills, certificates, publications, project samples, work experiences, and microcredentials.</p><p>Date of birth&nbsp;</p><p>Device indentifier</p><p>Email address (e.g., John.Doe@awesomeu)</p><p>First and last name</p><p>IP Address (e.g., 127.0.0.1)</p><p>Messages</p><p>Porfolio artifacts such as: skills, projects, writing samples, articles, videos, photos, website links, and social media links.</p></td></tr></tbody></table>
7575
7676### **Section 2 - Description of the Processing and Transfer (when data are transferred)**
7777
78<table><tbody><tr><td><p>Categories of data subjects whose personal data is transferred:</p></td><td><p>End-users of the Services as authorized by Customer.&nbsp;</p></td></tr><tr><td><p>Categories of personal data transferred:</p></td><td><p>As described in Schedule 1, Section 1.</p></td></tr><tr><td><p>Sensitive data transferred:</p></td><td><p>The Services are generally not intended to process sensitive personal data, or special categories of personal data. Any processing of these data is determined and controlled by Customer in compliance with Data Protection Laws.</p></td></tr><tr><td><p>The frequency of the transfer (e.g., whether the data is transferred on a one-off or continuous basis):</p></td><td><p>Continuous for the duration of the Agreement.</p></td></tr><tr><td><p>Nature of the processing:</p></td><td><p>Performance of the Services described in the Agreement.</p></td></tr><tr><td><p>Purpose(s) of the data transfer and further processing:</p></td><td><p>As described in Section 3 of the DPA.</p><p>Instructure's data centers for the Services are located in the following regions based on the Customer's location.</p><ul><li>EU, EEA, or UK based customers: Ireland or Germany.</li><li>Australia: Australia, Singapore, India (Impact only)</li><li>Singapore: Australia, Singapore, India (Impact only)</li><li>Canada: Canada</li><li>U.S.: U.S.&nbsp;</li><li>Latin America: U.S.&nbsp;</li><li>Africa: U.S., or Ireland</li><li>Instructure's data centers for all Mastery Services and Elevate Services are in the U.S. regardless of Customer location.</li></ul><p>Instructure's Processing locations for its support services where Instructure operates as a Controller is described at https://community.canvaslms.com/t5/Privacy-Articles/Instructure-s-Third-Party-Processing-Guide/ta-p/606339.</p><p>Instructure may Process and/or transfer Customer Personal Data and Account Data outside of the Customer's home region for the underlying support services.&nbsp;</p><ul><li><em>Relationship and Contract Management</em>. Including providing contract and customer relationship management services.</li><li><em>Customer Support</em>. Including end-user helpdesk support and technical operations support.&nbsp;</li><li><em>Professional Services</em>. Including integration services, implementation services, and configuration services as purchased by Customer.&nbsp;</li><li><em>Engineering and Security Support</em>. Including Customer Personal Data included in, user support tickets, application logs, security logs, database logs, systems logs, application databases, and security alerting tools may be reviewed by Instructure authorized personnel.&nbsp;</li></ul></td></tr><tr><td><p>The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period:</p></td><td><p>Processor will process Customer Personal Data for the duration of the Agreement. Upon termination of the Agreement, it will be deleted in accordance with this DPA or the Agreement.</p></td></tr><tr><td><p>For transfers to (sub-) processors, also specify subject matter, nature, and duration of the processing:&nbsp;</p></td><td><p>The duration will be until the termination of the Agreement.</p></td></tr></tbody></table>
78<table><tbody><tr><td><p>Categories of data subjects whose personal data is transferred:</p></td><td><p>End-users of the Services as authorized by Customer.&nbsp;</p></td></tr><tr><td><p>Categories of personal data transferred:</p></td><td><p>As described in Schedule 1, Section 1.</p></td></tr><tr><td><p>Sensitive data transferred:</p></td><td><p>The Services are generally not intended to process sensitive personal data, or special categories of personal data. Any processing of these data is determined and controlled by Customer in compliance with Data Protection Laws.</p></td></tr><tr><td><p>The frequency of the transfer (e.g., whether the data is transferred on a one-off or continuous basis):</p></td><td><p>Continuous for the duration of the Agreement.</p></td></tr><tr><td><p>Nature of the processing:</p></td><td><p>Performance of the Services described in the Agreement.</p></td></tr><tr><td><p>Purpose(s) of the data transfer and further processing:</p></td><td><p>As described in Section 3 of the DPA.</p><p>Instructure's data centers for the Services are located in the following regions based on the Customer's location.</p><ul><li>EU, EEA, or UK based customers: Ireland or Germany.</li><li>Australia: Australia, Singapore, India (Impact only)</li><li>Singapore: Australia, Singapore, India (Impact only)</li><li>Canada: Canada</li><li>U.S.: U.S.&nbsp;</li><li>Latin America: U.S.&nbsp;</li><li>Africa: U.S., or Ireland</li><li>Instructure's data centers for all Mastery Services and Elevate Services are in the U.S. regardless of Customer location.</li></ul><p>Instructure's Processing locations for its support services where Instructure operates as a Controller is described at <a href="https://trust.instructure.com/d/instructure-third-party-service-provider-guide/dlbvTx?lng=en" rel="noopener" target="_blank">https://trust.instructure.com/d/instructure-third-party-service-provider-guide/dlbvTx?lng=en</a>.</p><p>Instructure may Process and/or transfer Customer Personal Data and Account Data outside of the Customer's home region for the underlying support services.&nbsp;</p><ul><li><em>Relationship and Contract Management</em>. Including providing contract and customer relationship management services.</li><li><em>Customer Support</em>. Including end-user helpdesk support and technical operations support.&nbsp;</li><li><em>Professional Services</em>. Including integration services, implementation services, and configuration services as purchased by Customer.&nbsp;</li><li><em>Engineering and Security Support</em>. Including Customer Personal Data included in, user support tickets, application logs, security logs, database logs, systems logs, application databases, and security alerting tools may be reviewed by Instructure authorized personnel.&nbsp;</li></ul></td></tr><tr><td><p>The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period:</p></td><td><p>Processor will process Customer Personal Data for the duration of the Agreement. Upon termination of the Agreement, it will be deleted in accordance with this DPA or the Agreement.</p></td></tr><tr><td><p>For transfers to (sub-) processors, also specify subject matter, nature, and duration of the processing:&nbsp;</p></td><td><p>The duration will be until the termination of the Agreement.</p></td></tr></tbody></table>
7979
8080## Schedule 2 - U.S. K-12 & Higher Education Addendum
8181
8282This Schedule 2 applies to Customers that are classified as U.S. based K-12 or higher education institution that are government recognized, formally-accredited educational institutions delivering nationally approved certifications or diplomas at primary, secondary, or third levels, and supplements the DPA to which it is attached.
8383
84841. **Definitions** In addition to the terms defined in the DPA, the following definitions apply to this Schedule 2.
159159### Annex II - TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
160160
161161Instructure's technical and organizational measures are described at: https://www.instructure.com/trust-center/resources
162162
163163### Annex III - LIST OF SUB-PROCESSORS
164164
165[https://community.canvaslms.com/t5/Privacy-Articles/Instructure-s-Third-Party-Processing-Guide/ta-p/606339](https://community.canvaslms.com/t5/Privacy-Articles/Instructure-s-Third-Party-Processing-Guide/ta-p/606339)
165[https://trust.instructure.com/d/instructure-third-party-service-provider-guide/dlbvTx?lng=en](https://trust.instructure.com/d/instructure-third-party-service-provider-guide/dlbvTx)
166166
167167## APPENDIX 2 - UK International Data Transfer Addendum to the EU Commission Standard Contractual Clauses - VERSION B1.0, in force 21 March 2022
168168
169169This Addendum has been issued by the Information Commissioner for Parties making Restricted Transfers. The Information Commissioner considers that it provides Appropriate Safeguards for Restricted Transfers when it is entered into as a legally binding contract.
170170
171171### Part 1: Tables
185185"**Appendix Information**" means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in:
186186
187187<table><tbody><tr><td><p>Annex 1A: List of Parties: Schedule 3 - Appendix 1, Annex IA</p></td></tr><tr><td><p>Annex 1B: Description of Transfer: Schedule 1</p></td></tr><tr><td><p>Annex II: Technical and organisational measures including technical and organisational measures to ensure the security of the data: Schedule 3 - Appendix 1, Annex II</p></td></tr><tr><td><p>Annex III: List of Sub processors (Modules 2 and 3 only): Not applicable to a general authorisation to engage sub-processors, but a list of Instructure subprocessors is available as described in Section 5 of the DPA.</p></td></tr></tbody></table>
188188
189189**Table 4: Ending this Addendum when the Approved Addendum Changes**
190190
191<table><tbody><tr><td><p><strong>Ending this Addendum when the Approved Addendum changes</strong></p></td><td><p>Which Parties may end this Addendum as set out in Section <strong>Error! Reference source not found.</strong>:</p><p>☒ Importer</p><p>☒ Exporter</p><p>☐ neither Party</p></td></tr></tbody></table>
191<table><tbody><tr><td><p><strong>Ending this Addendum when the Approved Addendum changes</strong></p></td><td><p>Which Parties may end this Addendum as set out in <strong>Section 19 of the Mandatory Clauses.</strong>:</p><p>☒ Importer</p><p>☒ Exporter</p><p>☐ neither Party</p></td></tr></tbody></table>
192192
193193**Part 2: Mandatory Clauses -** Alternative Part 2 Mandatory Clauses:
194194
195<table><tbody><tr><td><p><strong>Mandatory Clauses</strong></p></td><td><p>Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section ‎<strong>Error! Reference source not found.</strong> of those Mandatory Clauses.</p></td></tr></tbody></table>
195<table><tbody><tr><td><p><strong>Mandatory Clauses</strong></p></td><td><p>Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under&nbsp;‎<strong>Section 18 of the Mandatory Clauses</strong><strong>.</strong>&nbsp;</p></td></tr></tbody></table>
196196
197197##
198198Schedule 4 - Jurisdiction Specific Terms
199199
200200To the extent that Services involve the Processing of Customer Personal Data originating from the following countries, the relevant provisions set out below will apply and supplement the applicable DPA provisions.
201201