Data Protection Addendum

This Data Protection Addendum (DPA) establishes the parties’ obligations for personal information processed in connection with the Services. It forms part of the Master Service Agreement or another written service agreement that expressly incorporates it (Agreement). The parties are Ilmiya, Inc. (Ilmiya) and the customer named in that Agreement (Customer). This DPA applies when Ilmiya handles personal information on Customer’s behalf.

Customer may be a school, university, tutoring center, other educational organization, or independent educator accepted under the Agreement. The person entering into the Agreement must have legal capacity and authority to bind Customer. Customer’s status and the purpose of each use determine which authorization requirements apply to learners.

1. Scope and application

This DPA sets out the core safeguards for Customer Data. Ilmiya serves learners in several countries, including the US, the UK, and countries in Europe and Africa. Each party must meet the data protection laws that apply to its activities, including the EU GDPR and UK data protection law where applicable. A service-support label or contract cannot remove those duties or an individual’s statutory rights.

The parties must document the relevant countries, processing locations, roles, and safeguards for Customer’s deployment. This applies to existing Services as well as a new or changed deployment. Customer must disclose requirements specific to its institution or use, including any mandatory localization rule. Ilmiya remains responsible for requirements that apply to its own activities.

This DPA does not itself incorporate EU Standard Contractual Clauses, a UK Addendum, or a UK International Data Transfer Agreement. A website visit or acceptance of this DPA does not establish a transfer mechanism. Required transfer arrangements must be documented and completed for the particular data flow as described in section 7.

If a required safeguard or lawful basis is missing, the parties must promptly restrict or stop the affected processing and agree a lawful remedy, return, or deletion. An incomplete review does not authorize processing that the law prohibits.

This DPA does not govern information Ilmiya handles for its own website enquiries, business contacts, or billing administration. The Global Privacy Policy explains those activities. It also does not authorize a partner to process information for Ilmiya; that requires a separate written arrangement describing the partner’s obligations.

2. Definitions

Capitalized terms not defined in this DPA have the meaning given in the Agreement. Controller, Processor, Data Subject, and processing have the meanings given by the law applicable to the relevant processing. For GDPR and UK GDPR processing, their respective statutory definitions apply. Personal Data refers to personal information, subject to any more specific definition the applicable law supplies. A contract label does not determine a party’s role where its actual activities establish another role.

Data Protection Legislation is another expression for Applicable Data Protection Law in this DPA. That law may include national or provincial requirements, such as Canada’s applicable federal and provincial privacy laws or Brazil’s General Data Protection Law, where their conditions apply. This definition does not represent that every service supports a use prohibited by a local requirement.

EU Standard Contractual Clauses (SCCs) means the applicable clauses adopted by the European Commission for a restricted transfer. UK Addendum and UK International Data Transfer Agreement refer to the corresponding approved UK transfer instruments. Defining an instrument does not incorporate or execute it; sections 1 and 7 govern any required transfer arrangement.

Personal information means information about an identified or identifiable person, including information protected as personal data, personal information, or an education record under applicable law.

Customer Data means information supplied to, collected through, or generated within the Services for Customer, including personal information in learning records, messages, recordings, and AI interactions.

Student Data means Customer Data about a current or former learner, including children and teens. A child’s voice recording, message, or identifiable AI response can be Student Data.

Applicable Data Protection Law means the privacy, data protection, education-record, and child-protection requirements that apply to the relevant party and processing. This includes applicable U.S. state student-privacy and consumer-privacy laws, the Family Educational Rights and Privacy Act (FERPA), the Children’s Online Privacy Protection Act and Rule (COPPA), the EU General Data Protection Regulation (GDPR), and UK data protection law when their respective conditions apply. A law’s inclusion here does not expand its statutory scope.

Education Records means records within the definition in FERPA where that law applies. Eligible Student has the meaning given in FERPA. The broader contractual protections for Student Data also apply to covered information that falls outside FERPA’s definition.

Subprocessor means a service provider Ilmiya engages to handle personal information on Customer’s behalf. An integration independently selected and contracted by Customer is addressed in section 7; its role depends on the actual arrangement.

Personal Data Breach means a security incident that causes accidental or unlawful loss, destruction, alteration, disclosure of, or access to personal information in Customer Data. An unsuccessful attack that does not compromise that information is not a Personal Data Breach.

3. Roles and processing details

Customer decides why personal information is processed and which authorized educational services to use. Ilmiya processes it on Customer’s documented instructions. If Customer acts for another institution, Customer must have that institution’s authority and pass its instructions to Ilmiya. These roles correspond to controller and processor, or processor and subprocessor, where those terms apply in law. The actual purpose and decisions determine the role. This DPA does not give Ilmiya permission to choose a separate purpose for Customer Data. If Ilmiya acts as a controller for any processing, it must meet the resulting duties, including its own lawful basis and notice, without reducing the restrictions in this DPA.

As between the parties, Customer retains control over Customer Data. This DPA transfers no ownership of that information to Ilmiya. Rights in student-created work remain with the student or other lawful rights holder, subject to Customer’s lawful authority and the limited service rights in the Agreement. Copies, derived records, transcripts, and identifiable AI outputs remain subject to the same protections. Ilmiya may process them only for the purposes authorized here.

Annex B describes the permitted data categories and the conditions attached to each. Annex C identifies the information that the parties must record for a particular deployment. The Order and any agreed processing schedule must specify material features, retention periods, locations, and restrictions needed for Customer’s deployment. Listing a feature here does not enable it or authorize collection beyond that scope. Faith-related activities, support records, messages, or recordings can reveal sensitive information even without a dedicated sensitive-data field. The parties must assess that possibility in existing deployments. Where Article 9 of the GDPR or UK GDPR applies, Customer must identify an applicable condition in addition to its Article 6 basis, and Ilmiya must do the same for any processing it controls. A general account approval or ordinary parental permission does not establish a special-category condition. Voice recordings are not automatically biometric special-category data; using technical processing for unique identification requires separate consideration.

4. Instructions and confidentiality

Processing Instructions

Ilmiya will process Customer Data only under the Agreement, this DPA, and Customer’s documented instructions, including authorized settings and service requests. If the law requires other processing, Ilmiya will tell Customer before processing unless the law prohibits notice. Ilmiya will promptly tell Customer if an instruction appears to breach applicable privacy law and will pause the affected instruction while the parties resolve it.

Ilmiya will limit staff access to what their work requires. People authorized to access Customer Data must be bound by confidentiality duties and receive appropriate privacy and security training.

Customer must provide the required notices, establish a lawful basis for its instructions, and obtain the institutional authorizations or individual consents required for the intended use. Section 6 governs learner accounts and school authorization. Ilmiya remains responsible for its own legal duties, including duties that cannot be delegated to Customer or a parent. Customer must promptly correct inaccurate instructions and notify Ilmiya when an authorization is withdrawn or no longer applies.

5. Permitted use and restrictions

Ilmiya will not sell Customer Data, use it for advertising, or disclose it for another company’s advertising. Ilmiya will not build learner profiles for purposes outside the education and administration Customer has authorized. Student Data must not be used to market unrelated products to a learner or family, identify prospective customers, or conduct independent commercial research. A customer’s access to the Services does not authorize Ilmiya to publish student work, images, or recordings in marketing materials.

Voice and AI features are optional. Learners may use the core learning Services without activating or using either. Customer must communicate the relevant choices and obtain any additional authorization or consent required for those features. A refusal to activate an optional feature does not authorize broader collection through another feature.

Ilmiya does not currently train models using Customer Data. Ilmiya will not use Customer Data to train or improve general-purpose or shared AI models, or permit its AI service providers to train their models with it. Processing a request to produce an answer is subject to this DPA even when it does not change a model’s weights. Any proposed customer-specific customization, including LoRA, requires a separate written opt-in describing its purpose, data, access, retention, and deletion; a lawful basis; and any additional notices and authorizations required by law. School authorization alone cannot authorize unrelated commercial use of a child’s information.

Ilmiya may use data that has been lawfully de-identified only where the Agreement permits the purpose. Removing names alone is insufficient. Ilmiya must take reasonable measures to prevent identification, must not attempt to identify people again, and must require any recipient to follow the same restrictions. Ilmiya may not use de-identification to evade restrictions that still apply to the underlying data.

6. Education records and children

The protections in this section supplement the general obligations in this DPA. They do not relieve either party of obligations imposed directly by education-record, child-protection, or other applicable law.

Institutional responsibility

Customer determines the educational purpose and the authorized users of its environment. It must have authority to provide the information and enable each feature, communicate the relevant notices to learners and families, and maintain evidence of the authorization or consent on which it relies. When an individual educator acts for an institution, that educator must have the institution’s permission to engage Ilmiya and direct the processing. Access to an institutional email address alone does not establish that authority.

Customer is responsible for providing the required notices, obtaining and verifying legally required consent, retaining appropriate records, and handling withdrawal. Ilmiya supplies direct notice and supporting resources. This DPA does not establish a routine Ilmiya service for collecting or manually reviewing each family’s form. Customer must retain records of the authority, scope, notice version and date, including later withdrawals or restrictions, and provide evidence securely where required by law or reasonably necessary to address an authorization issue. Each consent method must meet its applicable requirements, including operator receipt where required. Ilmiya retains duties imposed directly on it by law.

When Customer provisions or approves a learner account, Customer confirms that the required authority, notices, and permissions are in place for the enabled features. Customer must retain evidence and promptly communicate a withdrawal or restriction affecting the Services. The account declaration records Customer’s assurance; it does not itself supply a missing notice or legally required consent.

FERPA and school control

Where Customer relies on FERPA’s school official exception, Ilmiya performs the institutional function specified in the Agreement and remains under Customer’s direct control for the use and maintenance of Education Records. Ilmiya will use those records only for that function, permit access only to personnel with a legitimate educational need, and observe the applicable restrictions on redisclosure. Customer must satisfy the conditions for the exception, including its annual notice and school official criteria. A separate FERPA exception or consent must meet its own requirements.

Customer will identify the persons entitled to inspect, receive, or amend a learner’s records, including any lawful restriction on a parent’s access. Ilmiya will provide reasonable assistance under section 9. If a right transfers to an Eligible Student, Customer must update the access instructions accordingly. Ilmiya will not treat a parent’s historical access as continuing authority to receive every later record.

Ilmiya must not release Education Records to another institution, a reseller, or an independently selected integration merely because that recipient serves the same learner. Customer’s documented instruction and the applicable conditions for disclosure must first be satisfied. Ilmiya will maintain information reasonably needed to support any legally required disclosure record and provide it to Customer on request. The provisions on binding legal demands in section 9 continue to apply.

COPPA authorization

A school may authorize collection on a parent’s behalf only to the extent permitted by COPPA and the FTC’s school-authorization guidance. The authorized processing must serve the school’s educational purpose and remain within the notice provided. Ilmiya will supply the required direct notice before relying on that authorization and provide the school with access to information needed to inform families and exercise the applicable review, deletion, and further-collection rights.

Customer is responsible for ensuring that the authorizing person can act for the school and, where applicable, on behalf of parents. An independent educator, commercial tutoring center, or other organization cannot rely on the school-authorization route solely because its activities are educational. Where that route is unavailable, Customer must obtain the required verifiable parental consent before covered collection begins. Customer administers that process, subject to Ilmiya’s responsibilities as the operator. A contract cannot transfer those statutory responsibilities away from Ilmiya.

Ilmiya will not require a child to disclose more personal information than an activity reasonably needs. Additional collection, optional recording, or use outside the authorized educational purpose requires a fresh assessment and any further notice or consent required by law before the change takes effect. Material changes to the collection, use, or disclosure covered by consent must follow the applicable renewal requirements. School authorization cannot permit unrelated commercial use of a child’s information.

The School and Institution Consent page and the Children’s and Students’ Privacy Notice explain the associated notice and family-rights procedures. Those notices supplement this DPA and cannot expand its processing permissions.

U.S. state processor requirements

Where an applicable U.S. state privacy law treats Customer as a controller or business and Ilmiya as its processor, service provider, or contractor, Ilmiya will comply with the obligations that law assigns to that role. The following provisions apply where Customer discloses personal information to Ilmiya under the California Consumer Privacy Act, as amended, and its implementing regulations (CCPA). Terms used in this paragraph have their CCPA meanings.

Customer discloses that information only for the limited business purposes selected for its Services: administering authorized accounts and class membership; delivering the selected learning and assessment activities and maintaining their records; processing authorized communications and separately enabled voice or AI functions; and providing the support and security necessary for those activities. The parties must identify the applicable functions and information in the deployment particulars under Annex C. A reference to the overall commercial relationship does not authorize an additional purpose.

Ilmiya must not sell or share the information, retain, use, or disclose it outside those specified purposes or the direct business relationship with Customer, or combine it with information received from another person or collected through Ilmiya’s own interactions with an individual, except to the extent expressly permitted by the CCPA and authorized by this DPA. A statutory permission does not expand the processing rights granted elsewhere in this DPA. Ilmiya certifies that it understands these restrictions and will comply with them.

Ilmiya will provide the level of privacy protection the CCPA requires and assist Customer with applicable consumer requests, risk assessments, cybersecurity audits, and automated-decisionmaking obligations. Customer must promptly provide the requests and information Ilmiya needs to assist. Ilmiya will notify Customer promptly if it determines that it can no longer meet the applicable obligations.

Customer may take reasonable and appropriate steps to verify that Ilmiya’s use remains consistent with Customer’s CCPA obligations, and, upon notice, to stop and remedy unauthorized use. Section 12 governs practical arrangements for verification without restricting a right the law requires. Ilmiya must impose the applicable written protections on a Subprocessor handling this information. These provisions preserve the stronger restrictions, individual rights, and limits on use established elsewhere in this DPA.

Other child and student protections

For GDPR and UK GDPR processing, Customer must identify the lawful basis for each educational purpose and provide notices appropriate to the learners’ age and understanding. An account approval does not make consent the basis for every processing activity. COPPA authorization does not establish a GDPR basis. Where consent is the basis for an online service offered directly to a child, the parties must meet the relevant age and parental-responsibility requirements.

Customer must identify any additional student privacy, recording, accessibility, or parental-notice requirements that apply to its instructions. Ilmiya remains responsible for requirements applicable to its own activities. Any necessary state or regional addendum must be agreed before the affected use. This DPA does not represent that a single authorization satisfies every jurisdiction.

7. Subprocessors and international transfers

Data Location

Customer Data is currently hosted, stored and processed in the United States. Customers and users outside the United States transfer Customer Data there to use the Services. This is the standard processing location for the Services, including enabled AI and voice features. The Subprocessors and Service Providers register identifies the providers and their functions. A separate processing-country schedule is not required for this standard arrangement. Any additional processing country remains subject to the advance-notice and transfer-safeguard requirements below.

Subprocessors

Customer gives general authorization for the Subprocessors identified for its Services. Ilmiya will provide at least 30 days’ advance notice before a new or replacement Subprocessor starts processing Customer Data, or before adding a processing country. Notice will go to Customer’s designated contact; updating a webpage alone is insufficient.

Customer may object within that period on reasonable data protection grounds. The parties will work to resolve the concern before the affected processing begins. If they cannot, Customer may end the affected Services and receive a proportional refund of prepaid fees for the unused period. This remedy does not limit rights under mandatory law or remedies for Ilmiya’s breach of this DPA.

Ilmiya will assess each Subprocessor’s ability to protect the information and require a written agreement imposing the relevant protections in this DPA. Ilmiya will limit each provider’s access to the data needed for its function and use coded identifiers instead of direct student identifiers where practicable. Removing a name does not remove these duties where the information can still identify a person or be linked to their records. Ilmiya remains responsible to Customer for each Subprocessor’s performance of those duties.

The written Subprocessor protections must cover confidentiality, purpose limits, applicable security and breach duties, assistance with rights, and the return or deletion of Customer Data. A Subprocessor must not sell the information, use it for advertising, attempt to re-identify protected de-identified information, or retain it after its authorized purpose or the applicable deletion deadline. Ilmiya must apply these requirements to the Subprocessor’s relevant further processing arrangements.

A provider that Customer independently engages receives information only under Customer’s documented instruction and the permissions granted to that integration. Customer must assess that provider’s terms and authority to receive the information. Calling a service an integration does not change its role if Ilmiya has engaged it to process on Ilmiya’s behalf; in that case, the Subprocessor obligations apply. A reseller’s commercial role does not itself authorize access to Student Data.

International Transfers

For each restricted transfer, including relevant remote access and onward transfers, the responsible parties must establish a valid route under applicable law. Contractual safeguards must use an available instrument that fits the parties’ roles and the scope of the processing, with completed annexes and any required transfer risk assessment or UK data protection test. The parties must put any necessary additional protections in place. An EU mechanism does not automatically satisfy UK requirements. Any applicable adequacy route must cover the actual recipient and processing. Ilmiya will provide information reasonably needed to assess the transfer and will not make or continue an affected transfer without the required protection.

8. Security

Ilmiya will maintain safeguards appropriate to the sensitivity and volume of Customer Data and the risks of processing. The minimum safeguards appear in the annex below. Ilmiya will review them as risks and the Services change and will not materially reduce their overall protection during the service term.

The security program must address confidentiality, integrity, availability, and resilience, taking account of the state of technology, implementation costs, the nature and scope of processing, and the risks to individuals. Appropriate measures include pseudonymization where it can reduce exposure without preventing the authorized service, timely restoration after an incident, and regular assessment of whether the safeguards work. The Annex A requirements remain the minimum agreed controls. Customer may review their implementation through the information and audit procedures in section 12.

Customer must manage its users, permissions, and devices and promptly report suspected unauthorized access. These responsibilities do not reduce Ilmiya’s duties for the systems it controls.

9. Individual rights and regulatory assistance

Data Subject Requests

Ilmiya will promptly forward to Customer a request concerning Customer-controlled personal information and identify any known legal deadline. Customer will decide the response within its authority. Ilmiya will provide the information and reasonable assistance necessary for a timely response, including a secure copy, correction, restriction, or deletion where applicable. Ilmiya will respond directly where Customer instructs it or where Ilmiya has an independent legal obligation. The parties must use proportionate identity checks and protect information relating to other people.

For Education Records, this assistance includes locating the requested material, producing an intelligible copy, and applying an authorized correction or explanatory statement. Customer remains responsible for any required amendment decision or hearing. Ilmiya will preserve the records covered by a protected outstanding access request when notified, and will cooperate with an earlier response deadline that applicable law imposes. A learner’s withdrawal from the institution does not itself extinguish an applicable access right.

Customer may request an export of its covered records during the service term through the available functions or an authorized service request. Ilmiya will provide the export in a commonly used, reasonably accessible format through a secure channel. Where the records contain information about multiple learners, the parties must separate or redact the other learners’ information as required. A data-export right does not include access to Ilmiya’s source code or other customers’ records.

If Customer cannot act because it has ceased operations or no authorized contact can be reached, Ilmiya will assess requests under applicable law, verify the requester’s authority, and preserve the relevant rights without disclosing another person’s information. Ilmiya must not use Customer’s absence to deny a duty that applies directly to Ilmiya.

Legal Process and Regulators

Ilmiya will provide reasonable assistance with legally required privacy assessments, regulator consultations, and investigations concerning the Services, taking account of the processing and information available to it. Customer must assess whether its use requires a data protection impact assessment (DPIA), especially where children, sensitive information, profiling, or new AI features create a likely high risk. A required assessment must precede the affected processing and be reviewed when the risks change. If an existing use lacks a required assessment, the parties must address the gap promptly and restrict processing as necessary. Any required consultation about high risk that remains must take place before that processing proceeds. Ilmiya must separately assess and meet any DPIA duties for processing it controls. Any charge for additional assistance must be reasonable and agreed in advance. A fee dispute must not prevent legally required cooperation.

Each party must keep required processing records and assess whether its activities require a data protection officer or a local representative. A required appointment and publication of contact details cannot be replaced by this DPA or by the other party’s appointment. Ilmiya will assist with complaints about Customer-controlled information and handle complaints about its own processing under applicable law.

If Ilmiya receives a binding demand for Customer Data, it will check the demand’s validity, limit disclosure to what the law requires, and notify Customer before disclosure unless prohibited. Where appropriate, Ilmiya will challenge an unlawful demand and seek permission to notify Customer if notice is restricted.

10. Personal Data Breach response

Ilmiya will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Data, and in any event within 72 hours. A shorter deadline required by law or expressly agreed in an Order controls. The 72-hour limit is an outer limit, not permission to wait.

The first notice will include the information then available, including the nature and approximate timing of the breach, affected categories of information, the known or estimated number of people and records involved, likely consequences, protective measures taken or proposed, and a contact for follow-up. Ilmiya will identify material uncertainties and provide updates as the investigation progresses. Initial notice will not be delayed while the investigation establishes every fact.

The notice will distinguish the known or estimated date of the incident from the date Ilmiya became aware of it, and will state the date of the notice. Information supplied for Customer’s response must be understandable and sufficiently specific to support Customer’s legal notification duties, subject to the facts available at the time.

Ilmiya will preserve relevant evidence, document the investigation and remediation, and provide Customer with a reasonable incident summary when sufficient information is available. Customer must keep its security contact current, promptly notify Ilmiya of a suspected compromise affecting the Services, and cooperate with reasonable containment measures for systems it controls. Neither party may instruct the other to conceal a breach or delay a notice required by law.

Ilmiya will investigate, contain, and address the breach and reasonably assist Customer with its response and required notices. A notice does not by itself admit liability. Customer remains responsible for decisions it must make about notifying affected people or authorities, except where Ilmiya has its own legal duty to notify them.

11. Return, retention, and deletion

Retention instructions

Customer directs retention of its education and operational records during the service term. It may choose the longest period that remains necessary for its documented purpose and is permitted by applicable law. The applicable schedule must identify the purpose, categories, and deletion triggers or periods, including separate treatment of source audio, transcripts, messages, AI interactions, and backups. Customer must review whether continued retention is necessary. Ilmiya must not follow an instruction to retain children’s personal information indefinitely or beyond a period the law permits.

Customer should review and remove accounts that have been inactive for more than 12 months, unless continued access has a documented purpose. This is a recommendation for Customer administrators. It does not describe an automatic account-deletion feature or require deletion of education records that Customer must or may lawfully keep for a continuing purpose.

Deletion requests

Ilmiya will complete deletion within 30 calendar days after receiving a valid, sufficiently specific deletion request from an authorized Customer contact, or sooner when applicable law requires. Ilmiya will promptly identify any information needed to verify authority or clarify the scope. It will not use those checks to delay an otherwise valid request.

Deletion includes the requested information in active systems, relevant Subprocessors’ systems, and backup copies. A copy may be irreversibly rendered unreadable instead of physically erased, provided it can no longer be recovered or used. The limited legal-retention exception below applies. On request, Ilmiya will confirm completion in writing and identify any information it is legally required to retain.

Closing a person’s login or profile does not by itself delete every record about that person. Shared messages, submitted work, assessments, and other Customer-controlled records may remain under Customer’s lawful schedule even after that person’s account is closed. Customer may instruct Ilmiya to delete those records as well, subject to applicable law. This distinction does not override an individual’s legally enforceable right to deletion or allow Ilmiya to retain information after a valid instruction covering it. Customer remains responsible for copies it or its other authorized recipients control.

Expiration and termination

The following rules apply when an Order or Agreement expires or is terminated, including termination for a contract breach. Ilmiya will provide a 30-day period to export the affected Customer Data in a commonly used format, unless Customer requests earlier deletion or the law requires another result. Customer should complete its export during this period. Export uses a secure, lawful method; a hold requiring preservation alone does not prevent export.

Customer instructs Ilmiya to retain a restricted recovery copy for up to 12 months after the affected service ends, but only to the extent it is lawful and necessary for a documented transition or recovery purpose within the original authorized use. This can support completing a transfer of education records or restoring service at Customer’s request. The copy must be separated from ordinary product use, available only to authorized personnel for that purpose, and covered by this DPA. Retaining a recovery copy does not extend the subscription or guarantee self-service access or restoration after the export period.

Ilmiya will delete that copy and any remaining affected Customer Data no later than 12 months after service ends. An earlier valid Customer deletion request, the end of the documented need, or an earlier legal deadline controls. A child’s information must be deleted sooner when it is no longer reasonably necessary for the specific purpose for which it was collected. The 12-month limit does not authorize keeping every record for a full year.

Backups and legal holds

Backups remain subject to the same applicable deletion deadline, including the 30-day deadline for a valid Customer request and the 12-month outer limit after service ends. Pending deletion, they must be protected and unavailable for ordinary use. If a backup is restored, outstanding deletion instructions must be reapplied.

Ilmiya may retain a limited copy beyond an otherwise applicable deadline only where a binding legal obligation requires it, such as a valid preservation order or a duty to preserve education records while a protected access request is outstanding. It will restrict access and use to that obligation, identify the reason and expected period to Customer unless prohibited, review the need, and delete the copy promptly when the obligation ends. A payment dispute or the possibility of future usefulness alone does not extend retention.

A security incident does not itself start a new 12-month retention period or authorize destruction of evidence. Incident records follow their documented security purpose and any binding preservation requirement. Deleting data does not cancel fees or other obligations that remain payable under the Agreement.

12. Demonstrating compliance

Audits and Information

Ilmiya will provide information reasonably needed to show that it meets this DPA. This includes relevant security documents and summaries of independent assessments it holds. This clause does not claim any certification.

Ilmiya will maintain complete and accurate records reasonably necessary to demonstrate the processing covered by this DPA, including the instructions it implements and the safeguards applicable to that processing. Customer may submit a reasonable privacy or security questionnaire as part of the ordinary annual review. Information may be provided through relevant existing documentation when that documentation answers the request.

The parties should first use existing reports and written responses. Where further verification is reasonably required, Ilmiya will allow and contribute to a proportionate audit or inspection by Customer or a qualified auditor it appoints, subject to appropriate confidentiality and security safeguards. Ordinary audits require 30 days’ notice, take place during business hours, and are limited to once a year at Customer’s cost. These procedural conditions must not prevent Customer from obtaining information or conducting an inspection required by applicable law.

Those limits do not prevent an audit required by law or a regulator, or a proportionate audit following a Personal Data Breach or credible evidence of material noncompliance. The parties will agree suitable access without exposing other customers’ information. Audits must not interfere unnecessarily with the Services.

13. Contract priority and duration

Mandatory law takes priority. Any legally required transfer terms the parties later execute take priority within their stated scope. This DPA controls over the Agreement and public website notices for the processing and protection of personal information.

The Agreement’s financial liability terms apply to claims under this DPA, except where mandatory law or binding transfer terms prohibit a limit. Those terms do not remove Ilmiya’s duties to protect, return, or delete information, limit an individual’s nonwaivable rights, or restrict a regulator’s powers. Responsibility for a Subprocessor under this DPA does not create a separate uncapped indemnity.

This DPA starts when the Agreement incorporating it takes effect and continues until the covered information has been returned or deleted, including any permitted retention. Changes follow the Agreement’s amendment process. Ilmiya will give at least 30 days’ notice of a proposed material change, and a webpage update alone cannot expand processing instructions or remove an existing protection during the agreed term.

Obligations that by their nature must continue after expiration or termination survive for the period needed to give them effect. Confidentiality, permitted-use restrictions, required cooperation, and the protection and deletion of retained copies continue while either party holds covered information. Neither party may replace these provisions with standard clauses or another form by notice alone; the Agreement’s amendment process and any mandatory requirements must be met.

Any permitted assignment or transfer of the relevant business remains subject to this DPA. Ilmiya must bind a successor receiving Customer Data to the applicable obligations and must not treat the transaction as permission for a different use. Applicable notice, authorization, and international-transfer requirements continue to apply. If the proposed arrangement cannot lawfully preserve those protections, the affected processing must not proceed; the Agreement’s termination and data-return provisions apply.

Annex A: Security safeguards

Ilmiya will maintain a written security program appropriate to the nature of the Services and the sensitivity, volume, and risks of Customer Data. The following controls establish the minimum contractual requirements. The parties may agree additional measures in a deployment schedule. No certification or independent audit status is implied by this annex.

Customer will secure its accounts and devices, maintain appropriate user permissions, and promptly report a suspected compromise. Customer’s configuration choices do not relieve Ilmiya of the controls it must maintain for its own systems.

Annex B: Data and processing schedule

This schedule describes the categories permitted under the Agreement. The actual scope is limited to the Services ordered, the features Customer authorizes, and the fields necessary for their educational purpose. A listed category is not a representation that Ilmiya collects every example, and it does not enable an optional feature. Customer and Ilmiya must identify the applicable categories in the deployment record described in Annex C.

The data subjects are learners, parents or guardians, educators, institutional staff, and other authorized participants. Processing occurs for the service term and any limited export, recovery, or legal-retention period permitted by section 11. Depending on the selected function, processing may be continuous, event-driven, or initiated by an authorized user. Operations may include collection, organization, storage, retrieval, access, transmission, correction, analysis for an authorized feature, and deletion.

Customer must not supply categories that the Services cannot lawfully support. If Ilmiya discovers information outside the agreed scope, it will restrict unnecessary processing, notify Customer as appropriate, and seek instructions for secure return or deletion, subject to any binding legal duty. The fact that a user can enter information into a free-text field does not establish authority to process it.

Annex C: Deployment particulars

The Order or a separate written processing schedule must record the following particulars with enough detail to govern the deployment. They may be supplied in one document or in clearly identified incorporated documents. A material change to those particulars must follow the applicable instruction, notice, and authorization procedures before the changed processing begins.

This DPA provides a common global framework. Mandatory local rights and obligations apply where their legal conditions are met, without requiring a separate public policy for each jurisdiction. A supplemental term is needed only where applicable law, a required transfer instrument or an expressly accepted customer requirement calls for it.

Relationship to the Services

Ilmiya supplies curriculum and learning materials as well as the software and infrastructure selected by Customer. Those Services may operate under Customer’s branding. The same processing restrictions apply to the information used across that environment. A white-label presentation does not change the parties’ actual legal roles, the required operator notice, or the rights of learners and families.

Contact

Send notices and requests to legal@ilmiya.com or use our legal inquiry form. Customer must keep its designated security and legal contacts current so Ilmiya can deliver notices promptly.