Scholaxy Data Processing Agreement

Version 1.1 · Effective date: 4 October 2026 · Version 1.1 adds Hetzner Online GmbH as a Sub-processor for encrypted off-site backups (Annex C).

This Data Processing Agreement ("DPA") is between SVESHEDUTECH L.L.C-FZ, a Meydan Free Zone limited liability company, business licence no. 2314401.01, formation no. 2314401, with its registered address at Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates, operating under the Scholaxy brand (the "Provider"), and the customer that has accepted the Scholaxy Terms of Service (the "Customer"). It forms part of the agreement between them (the "Agreement"). It applies without separate signature when the Customer accepts the Terms of Service, and it governs the Provider's processing of Customer Personal Data.

1. Definitions

1.1 Capitalised terms not defined in this DPA have the meanings given in the Scholaxy Terms of Service (the "Terms").

1.2 "Applicable Data Protection Law" means all laws on the protection of personal data that apply to the processing of Customer Personal Data under the Agreement. Where applicable, this includes the GDPR, the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), and other national data protection laws.

1.3 "GDPR" means Regulation (EU) 2016/679. "UK GDPR" means the GDPR as it forms part of UK law. "Controller", "processor", "data subject", "personal data", "personal data breach", "processing" and "supervisory authority" have the meanings given in the GDPR.

1.4 "Customer Personal Data" means personal data in Customer Data that the Provider processes on the Customer's behalf under the Agreement, as described in Annex A.

1.5 "Restricted Transfer" means a transfer of Customer Personal Data, including by remote access, from the EEA, the UK or Switzerland to a country or recipient not covered by an adequacy decision (or its equivalent) under Applicable Data Protection Law.

1.6 "SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as completed in Annex D.

1.7 "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force from 21 March 2022), as completed in Annex D.

1.8 "Sub-processor" means any third party that the Provider engages to process Customer Personal Data. The Provider's employees are not Sub-processors.

1.9 "Support Access" means access by the Provider's personnel to the Customer's Installation under Section 7.

2. Scope and roles

2.1 The Customer is the controller of Customer Personal Data, and the Provider is its processor. If the Customer processes Customer Personal Data as a processor for its own clients, the Customer warrants that its controller has authorised the Customer's instructions and the Provider's engagement as sub-processor. The Customer remains the Provider's only point of contact.

2.2 The Provider is an independent controller of:

• personal data of Customer Representatives processed for account management, billing, support and document acceptance, as described in the Privacy Policy; and

• Usage Data, to the extent permitted by Section 9.5 of the Terms.

2.3 Annex A sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects.

3. Instructions and Customer responsibilities

3.1 The Provider processes Customer Personal Data only on the Customer's documented instructions, including for Restricted Transfers. The exception is where Union or Member State law to which the Provider is subject requires other processing. In that case the Provider informs the Customer before processing, unless that law prohibits this on important grounds of public interest.

3.2 The Customer's documented instructions are:

• the Agreement;

• the Customer's configuration and use of the Service, including its settings, enabled integrations, enabled AI Features and Support Access grants; and

• any other written instructions agreed by the parties.

Instructions outside the scope of the Agreement require the Provider's agreement and may incur additional fees.

3.3 The Provider will inform the Customer immediately if, in its opinion, an instruction infringes Applicable Data Protection Law. It may suspend the processing concerned until the Customer confirms or changes the instruction.

3.4 The Customer is responsible for:

• the lawfulness of the processing and of its instructions, including having a legal basis;

• giving data subjects all required information, including about the Provider, its Sub-processors, AI Features and Restricted Transfers;

• obtaining and recording any required consent, including consent of parents or guardians of children under Article 8 GDPR, COPPA and similar laws;

• the accuracy of Customer Personal Data; and

• configuring the Service (retention settings, access permissions and integrations) appropriately for its purposes.

3.5 Section 10.5 of the Terms governs special categories of personal data and criminal-conviction data.

4. Provider obligations

4.1 Confidentiality. Persons authorised to process Customer Personal Data are bound by appropriate confidentiality obligations. They access it only as needed to perform the Agreement.

4.2 Security. The Provider implements the technical and organisational measures in Annex B. It may update them, provided the overall level of protection is not reduced.

4.3 Assistance. Taking into account the nature of the processing and the information available to it, the Provider gives the Customer reasonable assistance with its obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultations. The Provider may charge reasonable fees for assistance beyond its standard documentation.

4.4 Records. The Provider keeps records of processing carried out for the Customer, as required by Article 30(2) GDPR.

5. Sub-processors

5.1 Authorisation. The Customer gives a general authorisation for the Provider to engage Sub-processors. The current Sub-processors are listed in Annex C.

5.2 Terms. The Provider enters into a written contract with each Sub-processor. The contract imposes data protection obligations no less protective than this DPA, to the extent they apply to the Sub-processor's services. The Provider remains responsible to the Customer for its Sub-processors.

5.3 Notice. The Provider notifies the Customer at least 30 days before adding or replacing a Sub-processor. Notice is given by email to the Account Owner and in the Hub.

5.4 Objection. The Customer may object to a new or replacement Sub-processor, or to a new country of access under Section 6.3, on reasonable and documented data protection grounds, by writing to privacy@scholaxy.com within the notice period. The parties will discuss the objection in good faith. The Provider may resolve it by offering a reasonable alternative, including not using that Sub-processor or country for the Customer's Customer Personal Data, or letting the Customer disable the feature concerned. If it does not, the Customer may terminate the affected part of the Service before the change takes effect and receive a refund under Section 11.1(c) of the Billing Policy.

5.5 Emergency replacement. If a Sub-processor must be replaced urgently for security or continuity reasons, the Provider may give shorter notice. The objection right in Section 5.4 then runs from the date of the notice.

5.6 Customer's own integrations. Some Third-Party Services are connected under the Customer's own account with the provider, for example its own Stripe, Google or Twilio account. These are not the Provider's Sub-processors, and the Customer's own agreement with the provider governs them. Where the Provider engages a provider under the Provider's own account to deliver an optional feature, that provider is a Sub-processor. Annex C lists it as applying only when the feature is enabled.

5.7 Individual contractors. Individual contractors are treated as Provider personnel, bound by confidentiality and by the Provider's policies. Annex D, Part 4 lists their countries of access.

6. Location of processing and international transfers

6.1 Hosting. Customer Personal Data is stored and processed in the Customer's Installation, which Netcup GmbH hosts in Germany. Backups are stored in Germany: on Netcup GmbH's servers and, as an encrypted off-site copy, with Hetzner Online GmbH. The Provider does not currently operate a second hosting region.

6.2 Provider's establishment. The Provider is established in the United Arab Emirates. The UAE is not the subject of an EU adequacy decision. Making Customer Personal Data available to the Provider, including by remote access, is therefore a Restricted Transfer where the Customer's processing is subject to the GDPR, the UK GDPR or the FADP.

6.3 Staff access. The Provider's support and engineering personnel access Customer Personal Data remotely from the United Arab Emirates. Annex D, Part 4 lists the countries from which Customer Personal Data may be accessed. The Provider will notify the Customer at least 30 days before any new country of access is added, and the Customer may object under Section 5.4. Access is subject to the measures in Annex B and Annex D, Part 4.

6.4 Sub-processors in third countries. Restricted Transfers to Sub-processors are made under the SCCs (Module 3) or another valid mechanism stated in Annex C, such as the EU-US Data Privacy Framework where the Sub-processor is certified.

6.5 SCCs. To the extent the Customer's processing is subject to the GDPR, the UK GDPR or the FADP, the SCCs, the UK Addendum and the Swiss adaptations in Annex D are incorporated into this DPA. They apply to Restricted Transfers from the Customer to the Provider. The Customer's acceptance of the Terms constitutes both parties' signature of the SCCs.

6.6 Change of mechanism. If a transfer mechanism is amended, replaced or invalidated, the parties will cooperate in good faith to put a valid alternative in place. The Provider may update Annex D by notice.

7. Support Access to the Installation

7.1 The Provider's personnel access the Customer's Installation for support only when an authorised Staff User explicitly grants access through the Service. Access is granted for a specific support request, for a limited time by default 48 hours, and only to the extent the request requires.

7.2 Every Support Access session is logged. The log records at least the staff member, the request, and the start and end time. The log is visible to the Customer in its Installation. The Account Owner is notified when access is granted.

7.3 The Customer may revoke a Support Access grant at any time.

7.4 The Provider may access the Installation without a grant only:

• where strictly necessary to prevent or respond to a security incident or a serious threat to the Service;

• where required by law, subject to Section 12; or

• for automated or infrastructure operations (backups, updates, migrations, monitoring) in which no personnel view Customer Personal Data.

Access under the first two points is logged and notified to the Customer promptly, unless the law prohibits notification.

8. AI Features and machine translation

8.1 AI Features run on the Customer's own account with the AI provider it chooses (Terms, Section 12.7). When they are used, the Provider transmits the relevant inputs to that provider on the Customer's instruction and returns the output. That provider is a Third-Party Service under Section 5.6, not a Sub-processor. Inputs include prompts, conversation history and the course or other content needed for the answer. They may contain Customer Personal Data, including data of End Users who are children.

8.2 The AI Sub-processor may machine-translate support messages from the Customer so that the Provider's staff can read and answer them. This DPA governs that processing to the extent the messages contain Customer Personal Data.

8.3 The Provider does not use Customer Personal Data to train AI models. For the Support Assistant (Section 8.2), the Provider engages its AI Sub-processor only on terms that prohibit training on Customer Personal Data and limit retention of inputs and outputs to the period set in those terms. For AI Features, those matters are governed by the Customer's own terms with its AI provider.

8.4 AI Features are available only after the Customer connects its own AI provider account, and the Customer can disconnect it at any time. Where the law requires, the Customer is responsible for telling End Users that they are interacting with an AI system.

9. Personal data breaches

9.1 The Provider notifies the Customer of a personal data breach affecting Customer Personal Data without undue delay, and in any event within 48 hours after becoming aware of it.

9.2 The notice describes, as far as known at the time:

• the nature of the breach, including the categories and approximate number of data subjects and records concerned;

• its likely consequences;

• the measures taken or proposed; and

• a contact point.

Information not yet available is provided in phases, without undue delay.

9.3 The Provider takes reasonable steps to contain and remedy the breach. It cooperates with the Customer's investigation and with the Customer's notifications to supervisory authorities and data subjects. As controller, the Customer decides on and makes those notifications. The Provider does not make them on the Customer's behalf unless instructed or required by law.

9.4 A notification by the Provider is not an admission of fault or liability.

10. Data subject requests

10.1 The Service has functions that let the Customer access, correct, export and delete Customer Personal Data. Where the Customer cannot fulfil a request with those functions, the Provider gives reasonable further assistance, taking into account the nature of the processing.

10.2 If a data subject sends a request about Customer Personal Data directly to the Provider, the Provider forwards it to the Customer within 5 business days where it can identify the Customer. The Provider does not answer the request itself, except to refer the data subject to the Customer, unless the Customer instructs otherwise.

11. Audits and information

11.1 On request, the Provider makes available the information needed to demonstrate compliance with Article 28 GDPR. This includes a description of its technical and organisational measures, answers to one reasonable security questionnaire per year, and any certifications or audit reports held by the Provider or its hosting provider.

11.2 The Customer may carry out an audit if that information is insufficient, if a supervisory authority requires an audit, or after a personal data breach. The audit may be carried out by the Customer or by an independent auditor who is bound by confidentiality and is not a competitor of the Provider. These conditions apply:

• no more than once in any 12 months, unless a supervisory authority requires it or it follows a breach;

• at least 30 days' notice;

• during business hours, without unreasonable disruption, and remotely where possible;

• the audit does not cover other customers' data or Sub-processors' facilities; Sub-processors demonstrate compliance through their own certifications and reports;

• the Customer bears its own costs and the Provider's reasonable costs.

11.3 Audit results are the Provider's Confidential Information.

12. Requests from public authorities

12.1 The Provider may receive a legally binding request from a public authority, including a third-country authority, to disclose Customer Personal Data, or may become aware of direct access by such an authority. If so, the Provider will:

• notify the Customer promptly, unless the law prohibits this; if it is prohibited, use its best efforts to obtain a waiver;

• review the legality of the request and challenge it where there are reasonable grounds to consider it unlawful;

• disclose only the minimum data necessary; and

• document the request and its response.

12.2 The Provider has not created back doors or similar mechanisms for accessing Customer Personal Data, and no law requires it to create or maintain them.

12.3 On request, the Provider will give the Customer aggregate information about requests received in the preceding 12 months.

13. Return and deletion

13.1 During the Agreement, the Customer can export and delete Customer Personal Data using the Service's functions.

13.2 Customer Personal Data is retained for 90 days from the date the Installation is locked because the Trial or the last paid Subscription Term ended, or the Agreement was terminated (the "Retention Period"). A suspension during a paid period does not start the Retention Period. The Customer may export its data during the Retention Period. When it ends, the Provider deletes Customer Personal Data from production systems. Backups containing it are rotated and purged within a further 30 days. The Provider may keep Customer Personal Data for longer while a payment dispute, legal claim or investigation concerning the Installation is pending, only for that purpose.

13.3 The Customer exercises its choice under Article 28(3)(g) GDPR by exporting data during the Retention Period. If it does not export, it has chosen deletion. If the Customer instructs the Provider in writing to delete Customer Personal Data before the Retention Period ends, the Provider does so within 30 days, and backups are purged within a further 30 days.

13.4 On request, the Provider provides a written confirmation of deletion (a certificate of deletion). It identifies the Installation, the date of deletion from production systems, and the date by which backups were purged.

13.5 The Provider may retain Customer Personal Data where Union or Member State law requires it. It then continues to protect the data under this DPA and processes it only for that retention.

14. Liability

14.1 Each party's liability under this DPA is subject to the exclusions and limitations in the Terms, to the extent Applicable Data Protection Law permits. Nothing in this DPA limits data subjects' rights under the SCCs or Article 82 GDPR.

15. US state privacy laws

15.1 This Section applies where the California Consumer Privacy Act (as amended) or a similar US state law applies to Customer Personal Data. The Provider then acts as a "service provider" or "processor". Except as those laws permit, the Provider will not:

• sell or share Customer Personal Data;

• retain, use or disclose it for any purpose other than providing the Service, or outside its direct business relationship with the Customer; or

• combine it with personal data from other sources.

The Provider will notify the Customer if it can no longer meet these obligations.

16. Duration and precedence

16.1 This DPA remains in force for as long as the Provider processes Customer Personal Data, including during the Retention Period and the backup purge period.

16.2 If there is a conflict, the SCCs (as completed in Annex D) prevail over this DPA, and this DPA prevails over the Terms.

16.3 This DPA may be changed under Section 22 of the Terms. Changes required by Applicable Data Protection Law or by a supervisory authority may be made on notice.

16.4 This DPA is governed by the law chosen in the Terms. The SCCs are governed by the law, and subject to the forum, specified in Annex D.

Annex A: Description of processing (Annex I.B to the SCCs)

Categories of data subjects

• End Users of the Customer: students and prospective students, who may include children; parents and guardians; webinar participants; recipients of the Customer's emails and messages; visitors to the Customer's website and forms; leads and contacts in the Customer's CRM.

• Staff Users: the Customer's employees, teachers, contractors and other staff who use the Installation.

• Other individuals whose personal data the Customer includes in its content, such as guest speakers.

Categories of personal data

• Identification and contact data: name, email address, phone number, username, profile photo, language, time zone.

• Account and authentication data: password hashes, two-factor authentication data, session data.

• Learning data: enrolments, progress, completion, assignments and submissions, test answers and results, grades, certificates, teacher feedback.

• Communications: messages, chats, comments, emails and SMS sent through the Service, notifications.

• CRM data: lead source, pipeline stage, notes, tags, communication history.

• Transaction data from the Customer's own payment provider: orders, amounts, dates, payment status. No full card numbers.

• Webinar data: attendance and chat messages; where the Customer enables recording, participants' images and voices.

• AI Features data: prompts, conversation history, outputs.

• Technical data: IP addresses, device and browser data, logs, cookie identifiers set by the Installation.

• Any other personal data the Customer chooses to upload.

Special categories: not required for the Service; see Section 10.5 of the Terms.

Nature of processing: hosting and storage; organisation and retrieval; display to authorised users; transmission (email, SMS where enabled, and integrations the Customer enables); processing by AI Features; machine translation of support messages; backup and restore; Support Access; deletion.

Purpose: providing, securing, supporting and maintaining the Service for the Customer under the Agreement.

Frequency: continuous during the Agreement.

Duration and retention: the term of the Agreement, plus the 90-day Retention Period and the backup purge period of 30 days (Section 13).

Transfers to Sub-processors: as set out in Annex C, for the purposes and durations stated there.

Annex B: Technical and organisational measures (Annex II to the SCCs)

1. Tenant isolation. Each Customer has a separate single-tenant Installation with its own database.

2. Encryption. Each Installation has its own encryption keys. All connections to the Service are encrypted with TLS.

3. Staff authentication. Two-factor authentication is mandatory for all Provider staff.

4. Support Access control. Staff access an Installation only with the Customer's explicit, time-limited grant for a specific request. Each access is logged and visible to the Customer, and the Account Owner is notified (Section 7).

5. Access logging. Access to production systems and Installations is logged.

6. Backups. Backups are taken several times a day and are encrypted. An encrypted copy is kept off-site with a second provider in Germany (Hetzner Online GmbH), which does not hold the encryption keys. Restores are tested regularly.

7. Hosting. Installations and the Hub are hosted in Germany by Netcup GmbH.

8. User passwords are stored as salted hashes. Rate limiting and lockout protect against brute-force attacks. Two-factor authentication is available for Customer Staff Users.

9. Development and production environments are separate. No Customer Personal Data is used in development or testing.

10. Code is reviewed and tested automatically before deployment.

Annex C: Sub-processors (Annex III to the SCCs)

Notes:

• Stripe processes billing data of Customer Representatives, for which the Provider is the controller. It is listed for transparency. Stripe does not process End Users' payments: End Users pay the Customer through the Customer's own payment account.

• Google and Twilio are listed as conditional. If the Customer connects its own account, they are the Customer's Third-Party Services, not Sub-processors (Section 5.6).

Annex D: International transfers

Part 1: EU SCCs

1. Modules. Module Two (controller to processor) applies where the Customer is a controller. Module Three (processor to processor) applies where the Customer is a processor. Modules One and Four do not apply.

2. Parties. The Customer is the data exporter and the Provider is the data importer (Part 5).

3. Clause 7 (docking clause): applies.

4. Clause 9(a): Option 2 (general written authorisation). The notice period is 30 days (Section 5.3).

5. Clause 11(a): the optional independent dispute resolution wording does not apply.

6. Clause 13(a): the competent supervisory authority is:

   • that of the Member State where the data exporter is established; or

   • if the exporter is not established in the EU but has appointed a representative under Article 27(1) GDPR, that of the Member State where the representative is established; or

   • otherwise, that of the Member State where the data subjects are located.

7. Clause 17: Option 1. The SCCs are governed by the law of Ireland.

8. Clause 18(b): the courts of Ireland.

9. Cross-references. Annex I.A is Part 5 below. Annex I.B is Annex A. Annex I.C is as in item 6. Annex II is Annex B. Annex III is Annex C.

Part 2: UK Addendum. The UK Addendum applies to Restricted Transfers subject to the UK GDPR:

• Table 1: the parties as in Part 5;

• Table 2: the SCCs, with the modules and clauses selected in Part 1;

• Table 3: Appendix Information as in Annexes A, B and C and Part 5;

• Table 4: neither party may end the UK Addendum under its Section 19.

Part 3: Switzerland. For transfers subject to the FADP, the SCCs apply with these adaptations:

• the Federal Data Protection and Information Commissioner is the competent supervisory authority for those transfers;

• references to the GDPR are read as references to the FADP; and

• the term "Member State" does not prevent data subjects in Switzerland from bringing claims where they habitually reside.

Part 4: Access from third countries and supplementary measures

1. Countries from which Customer Personal Data may be accessed or processed

2. Transfer impact assessment. Before Restricted Transfers to a listed country begin, the Provider will complete and document a transfer impact assessment for it. It will give the Customer a summary on request.

3. Supplementary measures, in addition to Annex B:

• Customer Personal Data stays stored in Germany. Access from third countries is remote only, through encrypted, key-authenticated connections (SSH), and data is not copied to local devices.

• Only named personnel have access, with mandatory 2FA, on a least-privilege basis, and all access is logged.

• Support Access to Installations happens only on the Customer's grant (Section 7).

• The public-authority request policy in Section 12 applies.

4. Access from these countries.