This International Data Transfer Agreement ("IDTA") is entered into as Appendix D to the Sales Agreement between Breakout Learning ("Processor") and the Purchaser ("Controller"), where the Data Exporter is subject to the UK General Data Protection Regulation ("UK GDPR").

This IDTA ensures that the international transfer of personal data from the United Kingdom to the United States is carried out in compliance with UK GDPR.

1. Scope and Incorporation

This IDTA is based on the UK Information Commissioner’s Office (ICO) International Data Transfer Addendum and incorporates the European Commission’s Standard Contractual Clauses ("SCCs") for international transfers (2021), Module Two (controller-to-processor), adapted for transfers subject to the UK GDPR. The Appendix to the SCCs published on the Breakout Learning Trust Center completes the description of the transfer and applies to this IDTA.

2. Parties

• Data Exporter (Controller): The Purchaser as identified in the Sales Agreement
• Data Importer (Processor): Breakout Learning Inc., 3309 Elm St #110-365, Dallas, TX 75226. Data Protection Officer: privacy@breakoutlearning.com

3. Description of the Transfer

• Data Subjects: Students, instructors, teaching assistants and institutional administrators associated with the Purchaser
• Categories of Personal Data: Name, email address, platform user identifier and role, course and section context (LTI 1.3); academic data including participation assessments and, where enabled, grades passed back to the LMS; discussion session content — per-participant session audio and, where the Purchaser has requested that its sessions be recorded, video (each retained 30 days), written transcripts attributed to the speaking participant and in-session text contributions (retained 30 days), and AI-generated participation assessments, evaluations and discussion summaries; usage data (activity logs, IP address, browser identifiers). Video is not otherwise recorded; no biometric identifiers are created. These categories correspond to Section 3 of the Processor’s Privacy Policy (breakoutlearning.com/legal/privacy-policy).
• Sensitive Data: None intended. Sensitive data disclosed orally by a participant during a session is captured in the transcript and protected by the safeguards in Section 4 of the SCC Appendix (purpose limitation, role-based logged access, no extraction or analysis, automatic deletion 30 days after the session).
• Nature of Processing: Capture and real-time transmission of session audio and, where requested, video; transcription of discussion session audio within the Processor’s Google Cloud Platform environment; AI-assisted analysis of assignment-scoped transcript text to produce participation assessments and summaries; provision of educational platform functionality; technical support and session repair
• Purpose of Processing: To deliver Breakout Learning services as per the Sales Agreement
• Frequency: Continuous during the License Duration
• Retention Period: As set forth in the Data Processing Agreement (DPA), Section 12: session audio, video (where recorded), transcripts and in-session text contributions deleted automatically 30 days after the session; AI-generated outputs and account records retained for the term of the Sales Agreement and deleted or returned within 30 days of termination; no anonymised copies of transcripts are created or retained

4. Technical and Organizational Safeguards

Breakout Learning ensures the protection of transferred data through:

• Encryption of personal data at rest (AES-256) and in transit (TLS 1.2+)
• Role-based access controls with MFA; instructor access to session content scoped to the instructor’s own courses; all access to session content logged
• Logging, alerting, and SOC 2 Type 2-audited security controls; application and security logs retained for 30 days and Google Cloud infrastructure audit logs for 400 days
• Automatic deletion of session audio, video (where recorded), transcripts and in-session text contributions 30 days after the session
• Vetting and contractual safeguards with all subprocessors

5. Subprocessors and Onward Transfers

The Data Importer may engage subprocessors to support the provision of services. The current subprocessors, with the purpose and location of each, are listed on the Breakout Learning Trust Center (trust.breakoutlearning.com, Legal → Subprocessors), which is the maintained list; Section 11 of the SCC Appendix mirrors it. Subprocessors are subject to equivalent safeguards under written agreements. The Data Exporter will be notified at least 30 days before any new subprocessor processes its personal data and may object as set out in the DPA.

6. Data Breach Notification and Cooperation

The Data Importer agrees to notify the Data Exporter of a personal data breach without undue delay and in any event within 72 hours of becoming aware of it, with the content required by UK GDPR Article 33(3), and to cooperate in managing any legal or regulatory notification obligations, consistent with Section 6.1 of the DPA.

7. Audit Rights

The Data Exporter may request documentation or conduct audits (virtual or on-site) to verify compliance with this IDTA. Such requests will be responded to in good faith within a reasonable timeframe.

8. Governing Law and Jurisdiction

This IDTA shall be governed by the laws of England and Wales. The parties submit to the jurisdiction of the courts of England and Wales for the resolution of any disputes.

9. Termination

This IDTA shall terminate automatically upon expiration or termination of the DPA or Sales Agreement. Personal data is then deleted or returned in accordance with Section 12 of the DPA. If the ICO updates or revokes current transfer mechanisms, the parties agree to collaborate in good faith to implement a compliant alternative.