Data Processing Addendum

1.1 Parties. Education Pals, Inc., 3559 Agate Drive, Unit 1, Santa Clara, CA 95051, United States (contact legal@educationpals.ai), and the Customer.

1.2 Definitions. "Data Protection Law" means every law on personal data that applies to the processing, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, and the California Consumer Privacy Act as amended (CCPA) and other US state privacy laws. "Controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meanings given in the GDPR, and the matching terms in other Data Protection Law ("business", "service provider") are read the same way. "Customer Personal Data" means the personal data described in section 2 that EducationPals processes on your behalf.

1.3 Roles. For Customer Personal Data you are the controller (or a processor acting for another controller) and EducationPals is your processor (or sub-processor).

1.4 EducationPals as a controller. Each member of your team has their own EducationPals account. EducationPals is an independent controller, outside this DPA, of the data it processes to run that account and for its own purposes — sign-in, the member's learning data and tutor conversations, billing, security and abuse prevention, product analytics, and compliance with law. Our Privacy Policy governs that data. You do not receive members' tutor conversations, answers or notes, and this DPA does not give you access to them.

3.1 Instructions. EducationPals processes Customer Personal Data only on your documented instructions. Your instructions are the Terms, this DPA and what your administrators do in the Service (for example inviting, removing or changing the role of a member). EducationPals tells you if it believes an instruction breaks Data Protection Law, unless the law forbids it. If the law requires EducationPals to process the data otherwise, it tells you first where the law allows.

3.2 Your responsibilities. You confirm that you have a lawful basis for the processing and have given members the notices it needs, including telling them what your administrators can see (section 2).

3.3 Confidentiality. Everyone at EducationPals authorised to process Customer Personal Data is bound by confidentiality.

3.4 Security. EducationPals applies the measures in Annex II (section 8) and keeps them at least as protective while this DPA applies.

3.5 Data subject requests. If a data subject contacts EducationPals about Customer Personal Data, EducationPals refers them to you unless the law requires it to act directly. Your administrators can invite and remove members and change their roles in the Service, and EducationPals helps further on request.

3.6 Personal data breaches. EducationPals notifies you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice goes to the email address of your team's owner and says what is known: the nature of the breach, the categories and approximate number of people and records, likely consequences, and what EducationPals has done. EducationPals updates you as it learns more.

3.7 Assistance. EducationPals gives you the information you reasonably need for data protection impact assessments and prior consultations with supervisory authorities, taking into account what it knows.

3.8 Deletion at the end. When your team plan or partner access ends, or you remove data, EducationPals deletes the Customer Personal Data from its live systems promptly; copies in backups expire within 35 days. EducationPals keeps a copy only where the law requires it. Members' own accounts continue under the Privacy Policy unless they delete them.

3.9 Information and audits. EducationPals makes available the information needed to show it meets Art. 28 — starting with this DPA, the Sub-processors page, the Security page and written answers to reasonable security questionnaires (at most once a year, unless a breach or a regulator requires more). If that is not enough, you may audit through an independent auditor bound by confidentiality, at your cost, on 30 days' notice, during business hours and without access to other customers' data.

4.1 General authorisation. You authorise EducationPals to use the sub-processors listed on its Sub-processors page, which is Annex III. EducationPals binds each one by a written contract with data protection obligations no less protective than this DPA, and remains liable to you for their performance.

4.2 Changes. EducationPals gives at least 14 days' notice before adding or replacing a sub-processor that will process Customer Personal Data, by updating the Sub-processors page and emailing your team's owner. In an emergency — for example to keep the Service running or secure — EducationPals may make the change first and give notice as soon as it can.

4.3 Objection. You may object on reasonable data protection grounds within the notice period by writing to legal@educationpals.ai. EducationPals will try to address the objection. If it cannot, you may end your team plan and EducationPals refunds the unused part of any prepaid fees.

5.1 Where. EducationPals processes Customer Personal Data in the United States, and its sub-processors where Annex III says.

5.2 EU. Where a transfer of Customer Personal Data to EducationPals is a restricted transfer under the GDPR, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated by reference: Module 2 where you are a controller, Module 3 where you are a processor. For them, Clause 7 (docking) applies; under Clause 9(a), Option 2 (general authorisation) applies with the notice period in section 4.2; the optional language in Clause 11 does not apply; under Clause 13, the competent supervisory authority is that of the EU member state where you are established or where your representative is; and Clauses 17 and 18 choose the law and courts of Ireland. Annex I of the Clauses is section 2 of this DPA, Annex II is section 8, and Annex III is section 4.

5.3 UK. For transfers subject to the UK GDPR, the UK International Data Transfer Addendum (version B1.0, issued by the Information Commissioner under s.119A of the Data Protection Act 2018) applies on top of the Clauses, with the details in its Tables 1–4 taken from this DPA.

5.4 Switzerland. For transfers subject to the Swiss FADP, the Clauses apply with the Federal Data Protection and Information Commissioner as the competent authority and references to EU law read as references to Swiss law.

5.5 Conflict. If the Clauses conflict with this DPA, the Clauses prevail.

6.1 Where you are a "business" under the CCPA, or a controller under another US state privacy law, EducationPals is your service provider or processor, and EducationPals:

• processes Customer Personal Data only for the business purposes in section 2 and the Terms;
• does not sell or share it (as the CCPA defines those words), and does not use it for cross-context behavioural advertising;
• does not retain, use or disclose it outside the direct business relationship with you, and does not combine it with personal data from other sources except as the law allows a service provider to;
• complies with the law that applies and gives the level of privacy protection it requires, and tells you if it can no longer do so;
• lets you take reasonable steps to stop and remedy unauthorised use, as section 3.9 describes.

6.2 EducationPals certifies that it understands and will comply with the restrictions in section 6.1.

7.1 Liability. Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Law or the Clauses do not allow them to apply.

7.2 Term. This DPA applies for as long as EducationPals processes Customer Personal Data for you, and survives the end of the Terms until that data is deleted.

7.3 Order of precedence. If documents conflict: first the Clauses (where they apply), then this DPA, then the Terms, then the Privacy Policy.

7.4 Changes. EducationPals may update this DPA with notice, in the same way as the Terms. An update never lowers the protection for Customer Personal Data unless the law requires it. The date and version at the top of this page show when it last changed.

7.5 Governing law. The Terms' governing law (the State of California) applies, except where the Clauses or Data Protection Law require another law.