DATA PROCESSING ADDENDUM

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Wayflo LLC, a Wyoming limited liability company ("Wayflo," "we," "us"), and the Course Creator or organization using the Services ("Customer," "you"). It applies whenever Wayflo processes Customer Personal Data on your behalf. By using the Services, you agree to this DPA. No separate signature is required.

TABLE OF CONTENTS

• 1. Definitions
• 2. Roles of the parties
• 3. Your responsibilities
• 4. Wayflo's obligations
• 5. Subprocessors
• 6. Data subject requests
• 7. Personal data breaches
• 8. Assistance and audits
• 9. International transfers
• 10. Deletion and return
• 11. General
• Annex 1: Details of processing
• Annex 2: Security measures
• Annex 3: Subprocessors

1. Definitions

"Data Protection Laws" means all privacy and data protection laws that apply to the processing of Customer Personal Data, including the EU General Data Protection Regulation (2016/679) ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and U.S. state privacy laws such as the California Consumer Privacy Act as amended ("CCPA").

"Customer Personal Data" means personal data that Wayflo processes on your behalf in providing the Services, mainly data about your Learners.

"Subprocessor" means any third party Wayflo engages to process Customer Personal Data.

"Controller," "processor," "data subject," "personal data breach," "processing," "business," and "service provider" have the meanings given in the applicable Data Protection Laws.

2. Roles of the parties

For Customer Personal Data, you are the controller (or "business") and Wayflo is the processor (or "service provider"). Wayflo is an independent controller of the account, billing, and website data it collects about you directly, as described in our Privacy Policy.

3. Your responsibilities

You are responsible for having a lawful basis for collecting Learner data, giving Learners any required notices, obtaining any required consents (including parental consent where applicable), and making sure your instructions to Wayflo comply with Data Protection Laws.

4. Wayflo's obligations

• Instructions. We process Customer Personal Data only on your documented instructions, which include the Terms of Service, this DPA, and your use and configuration of the Services. We will tell you if we believe an instruction violates Data Protection Laws.
• No sale or sharing. We do not sell or share Customer Personal Data, and we do not use it for any purpose other than providing, securing, and improving the Services, or as required by law. We do not use Customer content to train AI models.
• Confidentiality. Everyone we authorize to process Customer Personal Data is bound by an obligation of confidentiality.
• Security. We maintain the technical and organizational measures described in Annex 2.

5. Subprocessors

You give Wayflo general authorization to engage Subprocessors to deliver and support the Services. Our current Subprocessors are listed at wayflo.com/subprocessors. We ensure each Subprocessor is bound by data protection obligations at least as protective as those in this DPA, and we remain responsible for their acts and omissions. We may update our Subprocessor list from time to time by posting updates to that page.

6. Data subject requests

Taking into account the nature of the processing, we will help you respond to requests from Learners to exercise their rights (such as access, correction, deletion, or portability), mainly through the tools in the Services. If a Learner contacts us directly, we will forward the request to you and will not respond except as instructed or required by law.

7. Personal data breaches

We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We will provide the information reasonably available to us to help you meet your own notification obligations and will take reasonable steps to contain and remedy the breach.

8. Assistance and audits

We will provide reasonable electronic assistance with data protection inquiries as required by Data Protection Laws. You agree that the terms and security measures published in this DPA and on our website fully satisfy any obligation to demonstrate compliance. If a competent data protection authority legally mandates an audit that cannot be satisfied by these materials, the parties will cooperate in good faith on reasonable terms, at your sole expense, and without disrupting Wayflo's operations.

9. International transfers

Wayflo's primary servers are in the United States, and some content is cached on global edge networks. Where Customer Personal Data is transferred from the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, the parties agree to the EU Standard Contractual Clauses (Commission Decision 2021/914), Module Two (controller to processor) and, where applicable, Module Three (processor to processor), with the UK International Data Transfer Addendum and Swiss amendments as needed. These are incorporated by reference, with the information in Annex 1 used to complete them. Option 2 (general written authorization) applies to Clause 9, with changes communicated by updating the list described in Section 5; the optional language in Clause 11 does not apply, and Clauses 17 and 18 are governed by the laws and courts of Ireland.

10. Deletion and return

You can export or delete Customer Personal Data through the Services at any time. After your account ends, we will delete Customer Personal Data in line with the retention periods in our Privacy Policy, unless the law requires us to keep it. Copies in backups are deleted as backups roll off.

11. General

If this DPA conflicts with the Terms of Service, this DPA controls for the processing of Customer Personal Data. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses control. Liability under this DPA is subject to the limitations in the Terms of Service, unless Data Protection Laws require otherwise. We may update this DPA from time to time; we will not make changes that materially reduce the protection of Customer Personal Data without notice.

Annex 1: Details of processing

• Data exporter: the Customer, as controller.
• Data importer: Wayflo LLC, 28 Geary St STE 650, Suite #697, San Francisco, CA 94108, United States, as processor. Contact: legal@wayflo.com.
• Data subjects: the Customer's Learners, students, members, instructors, and team members.
• Personal data: names, email addresses, sign-in details, enrollment and purchase records, video watch progress, quiz and assessment answers, comments, notes, community posts, form and lead-capture entries, and technical data such as IP address and device information.
• Sensitive data: none intended. Customers should not use the Services to collect special categories of personal data.
• Frequency: continuous, for the length of the Customer's use of the Services.
• Nature and purpose: hosting, streaming, and delivering interactive video courses; tracking Learner progress; enabling quizzes, comments, notes, and community features; generating AI transcripts, chapters, and quizzes; and providing support.
• Duration: for the term of the Terms of Service plus the deletion period described in Section 10.
• Supervisory authority: the authority competent for the data exporter.

Annex 2: Security measures

• Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent).
• Role-based access controls, least-privilege access, and multi-factor authentication for administrative systems.
• Logical separation of each Customer's data.
• Regular backups and tested recovery procedures.
• Infrastructure monitoring, logging, and timely security patching.
• Vendor security review before engaging Subprocessors.
• A documented incident response process.

Annex 3: Subprocessors

The current list of authorized Subprocessors is maintained at wayflo.com/subprocessors.