Data Processing Agreement

This DPA is entered into between Playful Digits SRL ("Processor") and you, the customer who has accepted our Terms of use ("Controller"). It applies whenever the Processor processes personal data on the Controller's behalf in connection with the Service. Where you act in your capacity as parent or legal guardian, you are deemed the Controller for the personal data of the children on your Account.

The DPA enters into force on the date the Controller accepts the Terms of use and remains in force for as long as the Processor processes personal data on behalf of the Controller. Annex A lists the current subprocessors. Annex B describes the technical and organizational measures the Processor maintains. Annex C details the AI subprocessors and the specific data flows involved.

Where this DPA is in conflict with the Terms of use or the Privacy Policy, the DPA governs the processing of personal data described herein.

Capitalized terms used in this DPA have the meanings given in the GDPR (Regulation (EU) 2016/679). For convenience:

• Personal Data: any information relating to an identified or identifiable natural person, as defined in Art. 4(1) GDPR.
• Processing: any operation performed on Personal Data, as defined in Art. 4(2) GDPR.
• Data Subject: the natural person to whom Personal Data relates (in our context, the parent and the children registered on the parent's Account).
• Subprocessor: a third party engaged by the Processor to perform specific Processing activities on the Controller's behalf.
• Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data, as defined in Art. 4(12) GDPR.
• SCCs: the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021.

The Controller determines the purposes and means of the Processing of Personal Data and is responsible for the lawfulness of the Processing on which it instructs the Processor. The Processor processes Personal Data only on the Controller's documented instructions, including with regard to transfers, unless required to do otherwise by Union or Romanian law (in which case the Processor will inform the Controller of that legal requirement before Processing, unless the law prohibits the notification on important grounds of public interest).

The Controller's general instructions are set out in the Terms of use, the Privacy Policy, and this DPA, plus any specific instructions communicated to the Processor through the Service's administrative interfaces or by email to moc.htampulevel@lagel.

The subject matter of the Processing is the provision of the Service described in the Terms of use, including the Free Assessment, the AI-generated report, and the paid practice features. The duration of the Processing is the term of the Controller's subscription, plus any retention period required by law thereafter and any deletion-window described in the Privacy Policy.

The Processor will inform the Controller without undue delay if, in the Processor's opinion, an instruction infringes the GDPR or other Union or Romanian data-protection provisions.

The Processor shall:

• process Personal Data only on the Controller's documented instructions, including with regard to international transfers, unless required to do otherwise by applicable law;
• ensure that personnel authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
• implement and maintain the technical and organizational measures described in Annex B;
• assist the Controller, taking into account the nature of the Processing, in fulfilling the Controller's obligation to respond to data subject rights requests under the GDPR, including the rights set out in Articles 15 to 22;
• assist the Controller in ensuring compliance with the obligations under Articles 32 to 36 GDPR, taking into account the nature of the Processing and the information available to the Processor;
• at the Controller's choice, return or delete all Personal Data after the end of the provision of the Service, except where Union or Romanian law requires storage; and
• make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller, subject to the practical conditions in "Audits and inspections" below.

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the Processing, the Processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk. The current measures are described in Annex B and may be updated from time to time, provided that the level of security is not materially reduced.

The Controller acknowledges that the Service is provided on a multi-tenant infrastructure, and that the security measures described in Annex B are designed for such an environment.

The Controller grants the Processor a general authorization to engage Subprocessors for the purposes of providing the Service, subject to the conditions in this section.

The list of Subprocessors as of the "Last updated" date at the top of this DPA is set out in Annex A. The Processor will keep Annex A current; a current copy is also available to the Controller on request to moc.htampulevel@lagel. Where the addition or replacement of a Subprocessor materially affects how Personal Data is Processed, the Processor will additionally notify Controllers in advance by email or through a prominent notice on this DPA page.

The Controller may object to a new Subprocessor on reasonable data-protection grounds by contacting the Processor at moc.htampulevel@lagel. Where an objection cannot be resolved, the Controller may close the Account and obtain a pro-rated refund of any prepaid fees for the unused period.

The Processor imposes on each Subprocessor data-protection obligations equivalent in substance to those in this DPA, including the obligation to provide sufficient guarantees to implement appropriate technical and organizational measures. The Processor remains fully liable to the Controller for the performance of any Subprocessor's obligations.

The core production infrastructure (databases, APIs) is hosted within the European Union. Where Personal Data is transferred to a Subprocessor located outside the EEA, the Processor relies on the European Commission's 2021 Standard Contractual Clauses (Implementing Decision (EU) 2021/914), Module Two (controller to processor) where the Controller is established in the EEA, together with the supplementary technical and organizational measures described in Annex B.

For transfers to the United States, the Processor monitors the recipient's commitments under the EU–U.S. Data Privacy Framework (DPF) and equivalent successor frameworks, and takes those commitments into account in the transfer impact assessment. The Annex A entries identify, for each Subprocessor, the location of processing and the transfer mechanism applied.

The Processor will, where reasonably possible and taking into account the nature of the Processing, assist the Controller through appropriate technical and organizational measures in responding to requests by Data Subjects to exercise their rights under Chapter III of the GDPR (access, rectification, erasure, restriction, portability, objection, and the right not to be subject to a decision based solely on automated processing).

Where the Processor receives a Data Subject request directly, it will, without undue delay, forward the request to the Controller and not respond to the request itself, except on the Controller's instructions or as required by law.

The Processor will notify the Controller without undue delay, and in any event within seventy-two (72) hours, of becoming aware of a Personal Data Breach affecting Personal Data Processed under this DPA. The notification will, at a minimum:

• describe the nature of the breach, including the categories and approximate number of Data Subjects and records concerned;
• communicate the name and contact details of the Processor's data-protection point of contact;
• describe the likely consequences of the breach; and
• describe the measures taken or proposed to address the breach, including, where appropriate, measures to mitigate its possible adverse effects.

The Processor will assist the Controller in notifying the relevant supervisory authority and, where required, the affected Data Subjects.

The Processor will, on reasonable written request, make available to the Controller the information necessary to demonstrate compliance with Article 28 GDPR and this DPA. The Processor will satisfy this obligation in the first instance by providing:

• the Annex B summary of technical and organizational measures;
• current third-party attestations or summaries from the Processor or, where relevant, from Subprocessors; and
• written answers to specific data-protection questions raised by the Controller.

Where the materials above do not address a specific, material data-protection concern that the Controller has identified in writing, the Controller may request a Controller-led on-site audit, subject to all of the following:

• audits are limited to once per twelve (12) months, except where required by a supervisory authority or where there is reasonable evidence of a material breach of this DPA;
• audits are conducted on at least thirty (30) days' written notice, during normal business hours, in a way that does not unreasonably interfere with the Processor's operations or the privacy of other customers;
• the auditor enters into a confidentiality agreement with the Processor and is not a competitor of the Processor;
• the Controller bears all reasonable costs of the audit (including the Processor's reasonable internal costs of supporting it), except where the audit reveals a material non-compliance attributable to the Processor.

On termination of the Controller's subscription, or at any earlier point on the Controller's written request, the Processor will, at the Controller's choice, either delete or return all Personal Data Processed under this DPA, and delete existing copies, unless Union or Romanian law requires storage of the Personal Data (for example, accounting records subject to a ten-year retention). The Processor will provide written confirmation that this has been done.

Backups containing Personal Data continue to exist for the limited period described in the Privacy Policy and are then automatically rotated out and rendered unrecoverable. Records marked for deletion are re-deleted automatically if a backup is ever restored.

The liability of each party arising under or in connection with this DPA is subject to the limitations and exclusions set out in the Terms of use, except to the extent that such limitations or exclusions are not permitted by applicable law (including the GDPR).

The Processor may amend this DPA from time to time to reflect changes in its processing activities, applicable law, or Subprocessor list. Where an amendment materially affects the Controller's rights or obligations, the Processor will give at least thirty (30) days' notice before the amendment takes effect.

The following Subprocessors are currently engaged by the Processor. Each entry identifies the Subprocessor, the processing purpose, the location of processing, and the transfer mechanism applied for transfers outside the EEA.

The Processor maintains, at a minimum, the technical and organizational measures described below. The measures are reviewed periodically and may be updated to reflect improvements in the state of the art, provided that the level of security is not materially reduced.

The Processor uses third-party large-language-model services to generate the AI-written narrative report shared with parents after the Free Assessment, and to support limited internal content-generation tooling. The detail below supplements the general Subprocessor commitments in Annex A.