Data Processing Addendum

1. Parties and incorporation

This Data Processing Addendum (“DPA”) is entered into between the organization that has accepted the StudyPulse Terms, placed an order, signed an order form, or otherwise contracted for the Service (“Customer”) and the StudyPulse contracting entity identified in the applicable order form, invoice, subscription page, or other transaction record, or, where none is identified, the operator of studypulse.ai (“StudyPulse”).

This DPA forms part of the agreement governing Customer's use of the Service (“Agreement”). It takes effect on the later of the date Customer accepts the Agreement or the date StudyPulse first processes Customer Personal Data. Capitalized terms not defined here have the meanings in the Agreement or Applicable Data Protection Laws.

2. Definitions

“Applicable Data Protection Laws” means privacy, data-protection, breach-notification, student-privacy, and children's-privacy laws applicable to the processing of Customer Personal Data under the Agreement, including the GDPR, UK GDPR, applicable U.S. state privacy laws, FERPA and COPPA where their requirements apply.

“Customer Personal Data” means personal data, personal information, or personally identifiable information processed by StudyPulse on behalf of Customer through the Service. It excludes data for which StudyPulse independently determines the purposes and means of processing, such as limited billing, security, fraud-prevention, and direct account-administration data described in the Privacy Policy.

“Controller,” “Processor,” “Data Subject,” “Processing,” “Personal Data Breach,” and “Supervisory Authority” have the meanings given by Applicable Data Protection Laws. “Subprocessor” means a third party engaged by StudyPulse to process Customer Personal Data for the Service.

3. Scope and roles

Customer is the controller, business, educational agency or institution, or processor that appoints StudyPulse, as applicable. StudyPulse is the processor, service provider, contractor, school official, or subprocessor to the extent required by Applicable Data Protection Laws and the parties' relationship.

Customer determines the educational, training, employment, administrative, or other permitted purpose for using the Service and is responsible for the lawfulness of its instructions, content, notices, permissions, role assignments, and retention decisions. StudyPulse will process Customer Personal Data only to provide, secure, support, and maintain the Service; comply with documented Customer instructions; comply with law; and perform the limited purposes set out in the Agreement and this DPA.

4. Documented instructions

The Agreement, Customer configuration of the Service, support requests, order forms, and other written directions accepted by StudyPulse constitute Customer's documented instructions. StudyPulse will notify Customer if, in StudyPulse's reasonable opinion, an instruction infringes Applicable Data Protection Laws, unless law prohibits notice.

StudyPulse may process Customer Personal Data where required by applicable law. Where legally permitted, StudyPulse will notify Customer of that requirement before processing.

5. Customer obligations

• Provide all notices and obtain all consents, authorizations, or other legal bases required for Customer's use of the Service.
• Ensure users are invited, enrolled, linked, and assigned roles lawfully and only receive appropriate access.
• Avoid submitting personal data that is unnecessary for the intended educational or operational purpose.
• Configure retention, sharing, integrations, and permissions appropriately.
• Respond to Data Subject requests and regulator inquiries for data Customer controls, with StudyPulse assistance as required.
• Use AI-assisted output with appropriate human review and not as the sole basis for high-impact decisions.
• Maintain reasonable security for Customer-controlled devices, credentials, networks, and administrator accounts.

6. Confidentiality and personnel

StudyPulse will ensure that personnel authorized to process Customer Personal Data are subject to confidentiality obligations and receive access only as necessary for their duties. StudyPulse will take reasonable steps to ensure personnel reliability and provide privacy and security awareness appropriate to their responsibilities.

7. Security measures

StudyPulse will maintain technical and organizational measures appropriate to the risk, nature, scope, context, and purposes of processing. The measures are described further in Annex 2 and may evolve to address changing threats and technology, provided the overall level of protection is not materially reduced during an active subscription.

Customer acknowledges that no system can guarantee absolute security and that Customer is responsible for security settings and controls available to it.

8. Subprocessors

Customer gives StudyPulse general written authorization to engage Subprocessors. StudyPulse will require each Subprocessor to protect Customer Personal Data under written obligations that are materially consistent with this DPA for the services it performs.

StudyPulse will maintain a current list of material Subprocessors and make it available to Customer upon request or through a designated trust or legal page. StudyPulse will provide reasonable advance notice of a new material Subprocessor where required by Applicable Data Protection Laws or Customer's enterprise agreement.

Customer may object on reasonable data-protection grounds within the notice period. The parties will work in good faith on a commercially reasonable solution. If no reasonable solution is available, Customer may discontinue the affected feature or terminate the affected Service as provided in the Agreement. StudyPulse remains responsible for its Subprocessors to the extent required by law and contract.

9. Data Subject requests

Taking into account the nature of processing, StudyPulse will provide reasonable assistance through available functionality or support so Customer can respond to requests for access, correction, deletion, restriction, objection, portability, or other rights under Applicable Data Protection Laws.

If StudyPulse receives a request relating to Customer Personal Data, StudyPulse may direct the requester to Customer and notify Customer where legally permitted. StudyPulse will not independently respond on Customer's behalf unless authorized by Customer or required by law.

10. Personal Data Breaches

StudyPulse will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notice will include available information reasonably needed for Customer to meet applicable notification obligations, such as the nature of the incident, affected data and individuals, likely consequences, and remediation measures.

StudyPulse may provide information in phases as it becomes available. Notification is not an admission of fault or liability. Customer is responsible for determining whether to notify individuals, regulators, schools, parents, guardians, or other parties, except where StudyPulse has a direct legal obligation.

11. Assistance and impact assessments

Taking into account the nature of processing and information available to StudyPulse, StudyPulse will provide reasonable assistance with Customer's data-protection impact assessments, prior consultations, security inquiries, and regulator requests relating to the Service. Additional or unusually burdensome assistance may be subject to reasonable fees where permitted by the Agreement and law.

12. Audits and information

StudyPulse will make available information reasonably necessary to demonstrate compliance with this DPA, which may include security documentation, policies, questionnaires, summaries of assessments, or independent reports when available.

Customer may conduct an audit no more than once per year on reasonable written notice, except where a regulator requires more frequent review or Customer reasonably believes a material breach has occurred. Audits must protect confidentiality, avoid disruption, comply with security requirements, and not expose information concerning other customers. StudyPulse may satisfy an audit request through current independent reports or documentation where those materials reasonably address the request.

13. Return and deletion

During the subscription, Customer may access, export, or delete Customer Personal Data using available Service functionality, subject to role permissions and technical limits. On termination or Customer's written request, StudyPulse will delete or return Customer Personal Data as required by the Agreement and Applicable Data Protection Laws, unless retention is legally required.

Residual copies may remain for a limited period in secure backups, logs, dispute records, or systems where immediate deletion is not technically practicable. Such data remains protected and is not restored except for continuity, security, legal, or disaster-recovery purposes. StudyPulse may retain data that has been irreversibly de-identified or aggregated so it no longer identifies an individual.

14. International transfers

Customer Personal Data may be processed in countries other than the country where Customer or Data Subjects are located. StudyPulse will use a lawful transfer mechanism where required.

For transfers subject to the GDPR that require appropriate safeguards, the European Commission Standard Contractual Clauses adopted by Implementing Decision (EU) 2021/914 are incorporated by reference as applicable. Module Two applies where Customer is a controller and StudyPulse is a processor; Module Three applies where Customer is a processor and StudyPulse is a subprocessor. The optional docking clause applies; the competent supervisory authority and governing law are determined under the clauses based on Customer's establishment or representative.

For transfers subject to the UK GDPR, the applicable UK International Data Transfer Addendum or another valid UK transfer mechanism is incorporated as required. For Swiss data, the clauses apply with modifications needed under the Swiss Federal Act on Data Protection. If a replacement transfer mechanism becomes legally required, the parties will cooperate to implement it.

15. Student records and FERPA

Where Customer is a U.S. educational agency or institution and FERPA applies, StudyPulse will use education records only for the school-authorized educational purpose described in the Agreement and under Customer's direct control with respect to the use and maintenance of education records, to the extent required for the school official exception.

StudyPulse will not disclose education records except as authorized by Customer, permitted by the Agreement, or required by law. StudyPulse will assist Customer with access, amendment, record, and deletion obligations to the extent applicable and technically feasible. Customer is responsible for identifying StudyPulse in its annual FERPA notice or taking other steps required for reliance on an exception.

16. Children and COPPA

Where COPPA applies to a school-authorized use, Customer represents that it is authorized to provide consent on behalf of parents only for the educational context and that it has provided legally required notices. StudyPulse will collect, use, and disclose children's personal information only for the authorized educational purpose, service security, legal compliance, and other purposes permitted by law.

StudyPulse will not use children's personal information for behavioural advertising, create commercial profiles unrelated to the educational service, or retain the information longer than reasonably necessary for the authorized purpose, subject to legal obligations and secure backup cycles. Where direct parental consent is required, the responsible party must obtain it before the relevant processing begins.

17. U.S. state privacy terms

Where StudyPulse processes Customer Personal Data as a service provider, contractor, or processor under an applicable U.S. state privacy law, StudyPulse will not sell or share the data for cross-context behavioural advertising; retain, use, or disclose it outside the direct business relationship except as permitted by law; or combine it with personal data received from another person except as legally permitted to provide the Service.

StudyPulse grants Customer the right to take reasonable and appropriate steps to help ensure processing is consistent with applicable obligations and to require remediation of unauthorized use. StudyPulse will notify Customer if it determines it can no longer meet an applicable obligation.

18. AI and Customer data

StudyPulse may process prompts, uploaded materials, AI conversations, and generated outputs to provide requested AI features, maintain safety and security, troubleshoot, and support the Service. StudyPulse will not intentionally use private Customer Personal Data or private learner AI conversations to train a public or shared general-purpose AI model without a separate written agreement and any permission required by law.

StudyPulse may use de-identified or aggregated information that no longer identifies Customer or a Data Subject for analytics, safety, quality assurance, and service improvement. Customer must not use AI features as the sole basis for grading, discipline, admissions, employment, clinical, safeguarding, or another high-impact decision without lawful safeguards and meaningful human review.

19. Liability and precedence

Liability arising under this DPA is subject to the limitations, exclusions, and allocation of risk in the Agreement, except to the extent Applicable Data Protection Laws prohibit a limitation. If this DPA conflicts with the Agreement on the processing of Customer Personal Data, this DPA controls. The Standard Contractual Clauses control over inconsistent terms where they apply.

20. Changes and termination

StudyPulse may update this DPA where necessary to reflect legal, regulatory, or technical changes, provided an update does not materially reduce Customer's data-protection rights during an active paid term without notice. This DPA survives termination for as long as StudyPulse processes Customer Personal Data.

21. Contact

Data-processing questions, Subprocessor requests, security questionnaires, and privacy inquiries may be sent to:

Email: support@studypulse.ai

Website: https://studypulse.ai/

Annex 1 - Details of Processing

Annex 2 - Technical and Organizational Measures

• Governance: documented privacy, security, incident-response, access, and vendor-management practices appropriate to the Service.
• Access control: role-based access, least-privilege principles, protected administrator access, account verification, and removal of access when no longer required.
• Authentication: protected credential storage, session controls, password safeguards, and multifactor authentication where available or required.
• Encryption: encrypted transport using industry-standard protocols and appropriate protection for stored credentials and sensitive secrets.
• Application security: secure development practices, dependency management, validation, testing, change control, and remediation of identified vulnerabilities according to risk.
• Infrastructure security: network controls, environment separation where appropriate, monitoring, logging, backups, and resilience measures.
• Data minimization: collection and use limited to service purposes, role-based visibility, organization configuration, and deletion or de-identification where appropriate.
• Logging and monitoring: security and operational logs designed to detect misuse, unauthorized access, errors, and availability issues.
• Incident response: procedures to identify, contain, investigate, remediate, document, and notify qualifying incidents.
• Business continuity: backup and recovery arrangements appropriate to the Service and risk.
• Personnel: confidentiality commitments and security awareness for authorized personnel.
• Vendor oversight: reasonable diligence, contractual privacy and security obligations, and review of material Subprocessors.
• Physical security: reliance on controlled facilities and cloud providers with physical safeguards appropriate to hosted systems.
• Customer controls: role management, permissions, content restrictions, user offboarding, integration management, and other settings available within the Service.

Annex 3 - Subprocessor Information

StudyPulse may use providers for cloud hosting, storage, content delivery, security, communications, payment processing, identity services, AI processing, transcription, document processing, analytics, customer support, and related infrastructure. The current material Subprocessor list, processing locations, and relevant function will be made available upon request at support@studypulse.ai or through a designated StudyPulse trust or legal page.

Customer may subscribe to available Subprocessor notices or request that its enterprise contact be notified of material changes.

Annex 4 - Optional Signature Block