Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") is entered into by and between Breakout Learning Inc. ("Processor") and the Purchaser ("Controller") as part of the Sales Agreement. This DPA applies where Breakout Learning processes personal data on behalf of the Purchaser in relation to the products and services provided under the Sales Agreement. The provisions of this DPA are designed to ensure compliance with applicable data protection laws, including the General Data Protection Regulation (EU GDPR), the UK General Data Protection Regulation (UK GDPR), the California Consumer Privacy Act (CCPA), and other relevant laws.

1. Definitions

“Personal Data”: any information relating to an identified or identifiable natural person, as defined under applicable data protection laws.
“Processing”: any operation performed on Personal Data, such as collection, storage, retrieval, use, disclosure, and deletion.
“Data Subject”: the individual to whom the Personal Data relates.
“Controller”: the Purchaser, who determines the purposes and means of processing the Personal Data.
“Processor”: Breakout Learning, who processes Personal Data on behalf of the Controller.
“Subprocessor”: any third party engaged by Breakout Learning to process Personal Data.
“Affiliate”: any entity that directly or indirectly controls, is controlled by, or is under common control with a party, where control means ownership of more than fifty percent (50%) of the equity or voting rights.
“Data Protection Laws”: any applicable laws and regulations in relevant jurisdictions relating to the use or processing of Personal Data, including the EU General Data Protection Regulation (EU GDPR), the UK General Data Protection Regulation (UK GDPR), the California Consumer Privacy Act (CCPA), the Swiss Federal Act on Data Protection (nFADP), the Family Educational Rights and Privacy Act (FERPA), India’s Digital Personal Data Protection Act, 2023 (DPDP Act), the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and South Africa’s Protection of Personal Information Act, 2013 (POPIA).

2. Purpose of Data Processing

Breakout Learning will process Personal Data solely for the purpose of providing the products and services described in the Sales Agreement, in accordance with the Controller’s documented instructions and applicable Data Protection Laws.

The subject matter of the processing is the provision of the Services; its duration is the term of the Sales Agreement; its nature and purposes, and the categories of Personal Data and Data Subjects, are set out in Section 13.

3. Data Protection Impact Assessments (DPIA)

Breakout Learning will assist the Purchaser in conducting DPIAs where required, including assessing high-risk processing or new technologies. If risks cannot be mitigated, Breakout Learning will notify the Purchaser so they may determine next steps.

4. Data Processing Instructions

Breakout Learning will process Personal Data only in accordance with the Purchaser’s documented instructions, unless otherwise required by law.

Breakout Learning will inform the Purchaser without undue delay if, in its opinion, an instruction infringes Data Protection Laws. Where processing is required by law, Breakout Learning will inform the Purchaser of that legal requirement before processing, unless the law prohibits such information.

5. Subprocessors

Breakout Learning may engage subprocessors to support delivery of the Services.
A current list of authorized subprocessors is available upon request and will be kept up to date on Breakout Learning’s Trust Page.
Breakout Learning will provide the Purchaser with at least 30 days’ advance notice before authorizing any new subprocessor. The Purchaser may object on reasonable data protection grounds within this period.
Breakout Learning will ensure subprocessors are bound by data protection obligations no less protective than those in this DPA.

6. Security Measures

Breakout Learning will implement appropriate technical and organizational measures to ensure a level of security appropriate to risk, including but not limited to:

Encryption of Personal Data in transit and at rest.
Access controls to limit access to authorized personnel.
Regular backups and tested recovery procedures.
Monitoring and anomaly detection.
Independent SOC 2 Type 2 audits by Sensiba LLP covering the Security, Availability and Confidentiality Trust Services Criteria.

6.1 Personal Data Breach Notification

Breakout Learning will notify the Purchaser without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data breach affecting the Purchaser's Personal Data. The notification will describe the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed to address the breach and mitigate its effects, and a contact point for further information; where not all information is available at once, it will be provided in phases without undue further delay. Breakout Learning will cooperate with the Purchaser and assist it in meeting its own notification obligations to supervisory authorities and Data Subjects.

7. International Transfers of Personal Data

Personal Data is hosted in the United States on Google Cloud Platform (GCP).
Transfers from the EEA and UK are governed by the EU Standard Contractual Clauses (SCCs) and the UK Addendum or the UK International Data Transfer Agreement (IDTA), as applicable.
Breakout Learning will ensure appropriate safeguards for all international transfers.

7.1 Transfers Subject to Non-GDPR Data Protection Laws

Where Personal Data is transferred or made available outside the jurisdiction of origin and is subject to Data Protection Laws other than the EU GDPR or UK GDPR (including, without limitation, the Australian Privacy Principles and South Africa’s Protection of Personal Information Act), Breakout Learning implements reasonable and appropriate safeguards to protect such Personal Data. These safeguards include contractual obligations requiring recipients and subprocessors to provide a level of protection that is no less protective than that required under this DPA, together with appropriate technical and organizational measures.

8. Data Subject Rights and Assistance

Breakout Learning will notify the Purchaser without undue delay of any request it receives directly from a Data Subject concerning the Purchaser's Personal Data and will not respond to the request except on the Purchaser's documented instructions or where required by law. Taking into account the nature of the processing, Breakout Learning will assist the Purchaser by appropriate technical and organizational measures in fulfilling its obligation to respond to requests to exercise Data Subject rights, including access, rectification, erasure, restriction, portability and objection, within the timelines required by Data Protection Laws.

Breakout Learning will further assist the Purchaser in ensuring compliance with its obligations concerning security of processing, Personal Data breach notification, data protection impact assessments and prior consultation with supervisory authorities, taking into account the nature of the processing and the information available to Breakout Learning.

Information about how individuals may exercise their privacy rights, including the Data Privacy Request Form, is available in Breakout Learning's Privacy Policy.

9. Liability

Each party shall be liable for any breach of this DPA caused by its failure to comply with applicable data protection laws. Breakout Learning’s liability for breaches related to the processing of Personal Data is limited to the amount paid by the Purchaser for the related services.

10. Confidentiality

Breakout Learning will ensure all personnel authorized to process Personal Data are bound by confidentiality obligations consistent with this DPA and Data Protection Laws.

11. Audits and Inspections

The Purchaser may request audits or certifications to verify compliance. Breakout Learning will cooperate with reasonable audits conducted during normal business hours. Documentation is available via Breakout Learning’s Trust Page (https://trust.breakoutlearning.com).

12. Data Retention and Deletion

Breakout Learning will retain Personal Data only as long as necessary for the purposes outlined in the Sales Agreement or as required by law. Upon termination, Breakout Learning will retain Personal Data for a minimum of 30 days to allow the Purchaser to request data export. Personal Data will be deleted or returned within 30 days of termination unless the Purchaser requests earlier deletion or further retention is legally required.

Audio recordings of discussion sessions are retained for 30 days and then deleted automatically. Identifiable transcripts and AI-generated outputs are retained for the term of the Sales Agreement or until the Purchaser instructs deletion, and are deleted or returned in accordance with this Section. Breakout Learning may create and retain, without a fixed retention period, anonymized transcripts from which names, speaker identities and other identifying details have been removed and which no longer constitute Personal Data. Breakout Learning will delete anonymized transcripts derived from the Purchaser's sessions on the Purchaser's written request.

13. Types of Personal Data and Processing Activities

Categories of Personal Data Processed:

Email addresses and associated identifiers (name, username, device ID).
Platform usage data (login/logout, time spent, technical logs).
Discussion session content: per-participant audio recordings captured during a session; written transcripts derived from that audio and from text contributions, attributed to the speaking participant; and AI-generated participation assessments, evaluations, and discussion summaries derived from the transcripts.
Educational records, where provided by institutional customers under FERPA.

Processing Activities:

Collection during registration and platform use.
Storage in encrypted databases and storage buckets hosted on GCP (USA).
Use for account management, service delivery, customer support, and platform analytics.
Sharing only with authorized subprocessors as necessary.
Retention/Deletion aligned with Section 12.

14. Regional and Sector-Specific Compliance

14.1 United States (FERPA, CCPA/CPRA, Nevada)

Where Breakout Learning processes Personal Data subject to United States federal or state privacy laws, including the Family Educational Rights and Privacy Act (FERPA), the California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA), and applicable Nevada privacy laws, it does so in accordance with such laws, as applicable.

Where Breakout Learning processes education records subject to FERPA, it acts as a “school official” with a legitimate educational interest and processes such records only for authorized educational purposes and in accordance with the applicable agreement with the educational institution.

Where Breakout Learning processes personal information subject to the CCPA/CPRA on behalf of the Purchaser, it does so as a service provider and: (a) processes the personal information only for the business purpose of providing the Services under the Sales Agreement; (b) does not sell or share the personal information; (c) does not retain, use or disclose the personal information for any purpose, including any commercial purpose, other than the business purposes specified in the Sales Agreement, or outside the direct business relationship with the Purchaser; (d) does not combine the personal information with personal information received from other sources, except as permitted by the CCPA; (e) complies with the CCPA and provides the same level of privacy protection as the CCPA requires of businesses; (f) will notify the Purchaser if it determines that it can no longer meet its obligations under the CCPA; (g) grants the Purchaser the right to take reasonable and appropriate steps to ensure that Breakout Learning uses the personal information consistently with the Purchaser's obligations and to stop and remediate any unauthorized use; (h) flows down these obligations to any subcontractor that processes the personal information; and (i) cooperates with the Purchaser in responding to consumer requests. Comparable processor obligations apply where Breakout Learning processes personal data subject to the privacy laws of Texas, Virginia, Colorado, Connecticut or other U.S. states.

14.2 India (Digital Personal Data Protection Act, 2023)

Where Breakout Learning processes Personal Data relating to individuals in India, it does so in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), as applicable.

Breakout Learning designates its Data Protection Officer as its Grievance Officer for India and handles grievances and breach notifications in accordance with the DPDP Act.

14.3 Canada (Personal Information Protection and Electronic Documents Act)

Where Breakout Learning processes Personal Data relating to individuals in Canada, it does so in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), as applicable.

Breakout Learning implements appropriate safeguards and notification procedures where a breach poses a real risk of significant harm, as required under PIPEDA.

14.4 China (Personal Information Protection Law)

Where Breakout Learning processes Personal Data relating to individuals in mainland China, it does so in accordance with the Personal Information Protection Law of the People’s Republic of China (PIPL), as applicable.

Where required, cross-border transfers are conducted using lawful transfer mechanisms recognized under PIPL, and appropriate technical and organizational safeguards are applied.

14.5 United Kingdom, European Economic Area, and Switzerland

Where Breakout Learning processes Personal Data subject to the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), or the Swiss Federal Act on Data Protection (nFADP), it does so in accordance with such laws, as applicable.

Breakout Learning applies appropriate safeguards for international transfers, including the EU Standard Contractual Clauses and the UK International Data Transfer Agreement, where required.

14.6 Australia (Privacy Act 1988 and Australian Privacy Principles)

Where Breakout Learning processes Personal Data relating to individuals in Australia, it does so in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), as applicable.

Where Personal Data is transferred or made available outside Australia, Breakout Learning takes reasonable steps to ensure that recipients and subprocessors are subject to privacy and security obligations that provide a level of protection consistent with the requirements of the APPs, including through contractual obligations and appropriate technical and organizational measures.

14.7 South Africa (Protection of Personal Information Act, 2013)

Where Breakout Learning processes Personal Data relating to individuals in South Africa, it does so in accordance with the Protection of Personal Information Act, 2013 (POPIA), as applicable.

Where Personal Data is transferred or made available outside South Africa, Breakout Learning applies appropriate safeguards intended to ensure that such Personal Data is afforded a level of protection consistent with the requirements of POPIA, including through contractual obligations and appropriate technical and organizational measures.

14.8 Data Privacy Framework Participation

Breakout Learning participates in and has certified its compliance with:

The EU–U.S. Data Privacy Framework (EU–U.S. DPF)
The UK Extension to the EU–U.S. Data Privacy Framework
The Swiss–U.S. Data Privacy Framework (Swiss–U.S. DPF)

Our certification covers personal data other than human resources data, including data relating to students, faculty, institutional and corporate clients, and visitors. When we transfer personal data to third parties, we remain liable under the DPF Principles if those parties process such data inconsistently with the Principles.

14.9 Texas (TX-RAMP Level 2)

Breakout Learning holds a Texas Risk and Authorization Management Program (TX-RAMP) Level 2 certification issued by the Texas Department of Information Resources (DIR), covering the handling of moderate-impact data as required for Texas state agencies and institutions of higher education.

15. Governing Law and Dispute Resolution

This DPA is governed by the laws of the State of Texas and disputes shall be resolved per the Sales Agreement.

16. Indemnity

The Purchaser shall indemnify Breakout Learning from claims, losses, or damages arising from the Purchaser’s failure to comply with Data Protection Laws or its instructions under this DPA.