Data Processing Agreement

Parties and Definitions

For the purposes of this Agreement, the following definitions apply:

• "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council.
• "Personal Data", "Processing", "Data Subject", "Controller", and "Processor" have the meanings given in GDPR Art. 4.
• "Services" means the Zackly vocabulary learning platform, teacher dashboard, student mobile application, and associated infrastructure provided under the school service agreement.
• "Sub-processor" means any third party engaged by Zackly to process Personal Data on behalf of the Controller.

Subject Matter and Duration

This Agreement governs the Processing of Personal Data by Zackly on behalf of the Controller in connection with the provision of the Services described in the school service agreement.

Zackly will Process Personal Data only for the duration of the service relationship, beginning on the date the school account is activated and ending on the later of:

• the date the school account is closed or the service agreement is terminated; or
• the date all Personal Data is deleted or returned in accordance with Section 12.

Nature and Purpose of Processing

Zackly processes Personal Data on behalf of the Controller solely to provide the following functions of the Services:

Zackly will not Process Personal Data for any purpose outside the scope of the Services, or for its own commercial purposes, without the prior written consent of the Controller.

Categories of Personal Data and Data Subjects

Categories of data subjects:

• Students — individuals enrolled in a class managed through the Zackly school portal. May include minors.
• Teachers / administrators — staff members of the Controller who manage the school account, create classes, and access the teacher dashboard.

Categories of personal data processed:

Zackly does not knowingly process special categories of personal data as defined in GDPR Art. 9, nor criminal conviction data under Art. 10. The Controller shall ensure that no such data is submitted to the platform.

Obligations of the Processor

Zackly, acting as Processor, undertakes to:

1. Process only on documented instructions. Process Personal Data only on the documented instructions of the Controller, including the instructions set out in this Agreement and the service agreement. If required by Union or Member State law, Zackly will inform the Controller before Processing unless prohibited from doing so.
2. Ensure confidentiality. Ensure that all persons authorised to process Personal Data are bound by appropriate confidentiality obligations.
3. Implement security measures. Implement the technical and organisational measures described in Section 6.
4. Respect sub-processor obligations. Engage sub-processors only as set out in Section 7.
5. Assist with data subject rights. Taking into account the nature of the Processing, assist the Controller in fulfilling its obligations to respond to requests from data subjects exercising their rights under Chapter III GDPR.
6. Assist with compliance obligations. Assist the Controller in ensuring compliance with the obligations in GDPR Arts. 32–36 (security, breach notification, DPIAs, prior consultation) insofar as this relates to data Processed by Zackly.
7. Delete or return data. At the choice of the Controller, delete or return all Personal Data upon termination of the Services in accordance with Section 12.
8. Provide audit information. Make available to the Controller all information necessary to demonstrate compliance with this Agreement and allow for and contribute to audits as described in Section 11.

Obligations of the Controller: The Controller represents and warrants that it has a lawful basis under GDPR for the Processing described in this Agreement (e.g. a legitimate interest in providing education, or consent of students' guardians where required), and that it has provided all required notices to data subjects.

Technical and Organisational Measures (TOMs)

Zackly implements and maintains the following technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access:

Zackly may update these measures over time to reflect the evolving security landscape, provided that the overall level of protection is not reduced. Material changes will be communicated to the Controller.

Sub-processors

The Controller provides general authorisation for Zackly to engage sub-processors, subject to the conditions below. Zackly will impose data protection obligations on each sub-processor equivalent to those in this Agreement. Zackly remains liable to the Controller for the performance of each sub-processor's obligations.

The following sub-processors are currently authorised:

Zackly will provide the Controller with at least 30 days' prior notice of any intended addition or replacement of a sub-processor. The Controller may object to such changes within that period by notifying privacy@zackly.app. Where the Controller objects and the parties cannot resolve the issue, the Controller may terminate the relevant services upon written notice.

International Data Transfers

The core of the Services keeps Personal Data within the European Union: all student and teacher account data is hosted on AWS in Frankfurt (eu-central-1); transactional email is delivered by Brevo (EU); analytics (PostHog) and error monitoring (Sentry) run in the EU region. No international transfer applies to these.

Some sub-processors are located in the United States — Stripe (school billing data; no student personal data), Expo (device push tokens and notification text; no student name or email), and OpenAI / Anthropic (learning-content generation and submission evaluation). Where Personal Data is transferred to them, Zackly relies on:

• Standard Contractual Clauses (SCCs) — the EU Commission's standard contractual clauses (2021/914) incorporated into the agreements with these sub-processors; and/or
• EU-US Data Privacy Framework certification, where the sub-processor is certified; and
• Adequacy decisions, where applicable and in force.

Upon request, Zackly will provide the Controller with copies of or links to the applicable SCCs or equivalent transfer mechanisms for each sub-processor.

Data Subject Rights

As the Controller, the School is responsible for handling data subject requests (e.g. access, rectification, erasure, portability, restriction of Processing) from students, parents, and teachers. Zackly will assist the Controller in fulfilling such requests as follows:

• Access and portability: Upon request, Zackly will provide a structured export of all Personal Data held for a specific user within 5 business days.
• Erasure ("right to be forgotten"): Zackly will permanently delete all Personal Data associated with a specific user account within 30 days of a documented request from the Controller. This includes learning activity, progress data, and any writing samples.
• Rectification: The Controller may correct teacher account data via the school portal. Student display name corrections can be submitted via privacy@zackly.app.
• Restriction of Processing: Upon written instruction from the Controller, Zackly will restrict Processing for specified accounts without deleting the data.

Requests and supporting documentation should be sent to privacy@zackly.app.

Personal Data Breach Notification

In the event of a Personal Data breach involving the Controller's data, Zackly will:

1. Notify the Controller without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
2. Provide the following information, or supplement it as soon as it becomes available:
   • A description of the nature of the breach, including the categories and approximate number of data subjects and records concerned;
   • The name and contact details of the data protection contact at Zackly;
   • A description of the likely consequences of the breach;
   • The measures taken or proposed to address the breach, including mitigation actions.
3. Cooperate fully with the Controller's own breach notification obligations to supervisory authorities and data subjects.

Breach notifications should be expected at: privacy@zackly.app.

Audit Rights

The Controller has the right to audit Zackly's compliance with this Agreement, subject to the following conditions:

• The Controller will provide at least 30 days' written notice prior to any audit.
• Audits will be conducted during normal business hours and in a manner that minimises disruption to Zackly's operations.
• The Controller may appoint a third-party auditor, subject to that auditor entering into a confidentiality agreement acceptable to Zackly.
• The cost of the audit is borne by the Controller unless the audit reveals a material non-compliance by Zackly.

In lieu of an on-site audit, Zackly may satisfy audit requests by providing up-to-date third-party security certifications, penetration test summaries, or equivalent documentation.

Termination and Data Deletion

Upon expiry or termination of the service agreement, or upon written request from the Controller, Zackly will:

1. Cease all Processing of the Controller's Personal Data;
2. At the Controller's choice:
   • Return a structured export of all Personal Data in a machine-readable format (JSON or CSV) within 30 days; or
   • Delete all Personal Data, including backups, within 30 days, and provide written confirmation of deletion.

Zackly may retain Personal Data beyond this period only to the extent required by Union or Member State law, in which case Zackly will notify the Controller and restrict Processing of such data to the legally required purposes.