Data Processing Agreement.

This Data Processing Agreement (“DPA”) is between Parcel Digital LLC, a Nevada limited liability company, at 5725 S Valley View Blvd Ste 5 PMB 879632, Las Vegas, Nevada 89118-3122, United States (“Parcel Digital LLC”, “we”, “us”) and the organization that has entered into a SaaS Agreement or Order Form with us for Axo (the “Customer”). It forms part of that agreement (the “Agreement”) and applies to the personal data we process for the Customer in providing Axo (the “Service”).

This DPA applies whenever we process Customer Personal Data on the Customer’s behalf. For the data of individuals who use Axo under their own account and their own plan, we are the controller and our Privacy Policy applies instead of this DPA. The Customer accepts this DPA by signing an Order Form that refers to it or by using the Service under the Agreement.

• Data Protection Laws means every law that applies to the processing of personal data under this DPA, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the United Kingdom GDPR and Data Protection Act 2018 (“UK GDPR”), the Swiss Federal Act on Data Protection (“FADP”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), and the consumer privacy laws of other United States states, each as amended.
• Customer Personal Data means personal data that the Customer or its Authorized Users provide to the Service, or that the Service collects about Authorized Users on the Customer’s behalf, as described in section 4.
• Authorized User means an individual the Customer allows to use the Service under the Agreement, such as an employee, student or member.
• Controller, processor, data subject, personal data, processing, personal data breach and supervisory authority have the meanings given in the GDPR. Business, service provider, sell, share and consumer have the meanings given in the CCPA.
• Subprocessor means a third party we engage to process Customer Personal Data on our behalf.
• Standard Contractual Clauses or SCCs means the clauses approved by the European Commission in Decision 2021/914 for the transfer of personal data to third countries, and UK Addendum means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
• Security Incident means a personal data breach affecting Customer Personal Data in our or a Subprocessor’s possession.

Between the parties, the Customer is the controller (or, where the Customer itself acts for another controller, a processor) of Customer Personal Data, and we are the processor. Under the CCPA, the Customer is the business and we are its service provider.

We will process Customer Personal Data only on the Customer’s documented instructions, including with regard to transfers, unless the law of the European Union, a Member State, the United Kingdom or the United States that applies to us requires otherwise, in which case we will tell the Customer of that requirement before processing unless that law forbids it. The Customer’s instructions are: the Agreement, this DPA, the Customer’s and its Authorized Users’ use of the Service’s features, and any further written instruction the Customer gives that is consistent with the Agreement. We will tell the Customer at once if we believe an instruction infringes Data Protection Laws, without any duty to review the law for the Customer.

The Customer is responsible for the lawfulness of the Customer Personal Data it provides, for having a legal basis for the processing, for giving Authorized Users the notices the law requires, and for the instructions it gives us.

Subject matter and duration

The processing of Customer Personal Data in providing the Service to the Customer, for the term of the Agreement and until deletion under section 14.

Nature and purpose

Hosting and storing data; generating, grading and narrating learning content from what Authorized Users ask for or add; synchronizing progress between devices; delivering notifications; enabling friends and shared Paths between Authorized Users who choose them; providing support; and keeping the Service secure. All of this is as described in the Service’s documentation and our Privacy Policy.

Categories of data subjects

The Customer’s Authorized Users, and, where they appear in material an Authorized User adds, people mentioned in that material.

Categories of personal data

• Identifiers: email address, name, username and account number, Apple or Google account identifier, the random account ID we use with RevenueCat.
• Profile and preference data: avatar choices, reason for learning, prior knowledge, daily goal, notification settings.
• Learning data: Paths and lesson content, answers, scores, review cards and mastery, XP, level, streak, badges, days learned.
• Content added by Authorized Users: topics, pasted text, documents, links, photos of pages, book names, and whatever personal data they contain.
• Social data: friendships, requests, nudges, kudos, Path invitations, results shared within a shared Path.
• Device and technical data: push token, platform and device model, app version, request logs with IP address.

Special categories

The Service is not designed for special categories of data (such as health, religion, ethnicity or biometrics), data about criminal convictions, or data about children under 13, and the Customer agrees not to provide them. Where an Authorized User adds material that happens to contain such data, the Customer is responsible for having a lawful basis for it.

We ensure that every person we authorize to process Customer Personal Data is bound by a duty of confidentiality, by contract or by law, and processes it only as instructed. We limit access to the people who need it to provide the Service or to meet a legal duty.

Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the risk to the rights and freedoms of individuals, we implement and maintain appropriate technical and organizational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. These include at least:

• Encryption in transit (TLS) between the app, our server and every Subprocessor, and encryption at rest by our hosting and database providers.
• Row-level access rules in the database, so each account can read and write only its own data and only the data a friend or Path-mate has agreed to share.
• Secret keys and model credentials kept on the server only, never in the app, and rotated when a person with access leaves.
• Least-privilege access to provider consoles, limited to the people who operate the Service, protected by multi-factor authentication.
• Separation of the generation layer from the account layer: requests to AI providers carry the learner’s content, never their name, email or account identifier.
• Logging of server errors and access, provider-managed backups, and a documented process for responding to Security Incidents.
• Account deletion that removes all account data in one step, offered to every Authorized User in the app.

We may update these measures from time to time, provided that an update does not materially lower the overall level of protection.

The Customer gives us general authorization to engage Subprocessors. The Subprocessors we use on the date at the top of this page are:

We will tell the Customer, by email to the address on the Order Form and by updating this page, at least 30 days before we add or replace a Subprocessor that will process Customer Personal Data. The Customer may object on reasonable grounds related to data protection within that period. If we cannot address the objection, the Customer may terminate the affected part of the Service, or the Agreement if the affected part is essential, and we will refund any prepaid fees for the period after termination. We impose on every Subprocessor, by written contract, data protection obligations at least as protective as those in this DPA, and we remain responsible to the Customer for each Subprocessor’s performance.

The Service lets every Authorized User see, correct and delete most of their own data directly in the app, including deleting their account. If we receive a request from an Authorized User or another data subject about Customer Personal Data, we will tell the Customer within five business days and will not respond to it ourselves except to say the request has been passed on, unless the law requires us to respond. Taking into account the nature of the processing, we will assist the Customer with appropriate technical and organizational measures, so far as possible, in meeting its obligation to respond to requests to exercise data subject rights.

Taking into account the nature of the processing and the information available to us, we will assist the Customer in meeting its obligations regarding security, Security Incident notifications, data protection impact assessments and prior consultation with supervisory authorities, by providing the information in this DPA and in our Privacy Policy and by answering reasonable written questions. Assistance that goes materially beyond this, or that the Customer’s own choices make necessary, may be charged at our then-current rates after we have told the Customer.

We will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident, at the email address on the Order Form. The notice will describe, so far as known at the time, the nature of the incident, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address it, and a point of contact; we will add information as it becomes available. We will take reasonable steps to contain and remedy the incident and will cooperate with the Customer’s investigation. A notice is not an admission of fault or liability.

We will make available to the Customer the information needed to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor the Customer mandates who is bound by confidentiality and is not our competitor.

An audit is first conducted by written questions, which we will answer within 30 days, together with the most recent third-party security reports or certifications our Subprocessors make available. An on-site or remote technical inspection may be requested once in any twelve-month period, or additionally after a Security Incident or when a supervisory authority requires it, on at least 30 days’ written notice, during business hours, in a way that does not unreasonably disrupt our business or expose other customers’ data, and at the Customer’s expense unless the audit reveals a material breach of this DPA.

We and our Subprocessors are in the United States, and Customer Personal Data is processed there. Where Data Protection Laws of the European Economic Area, the United Kingdom or Switzerland apply to a transfer of Customer Personal Data to us, the parties agree as follows.

• European Economic Area. The SCCs, Module Two (controller to processor), or Module Three (processor to processor) where the Customer is itself a processor, are incorporated into this DPA and are entered into by the parties as data exporter and data importer. The optional docking clause in Clause 7 does not apply. In Clause 9, Option 2 (general written authorization) applies with the 30-day notice period in section 7 of this DPA. The optional language in Clause 11 does not apply. In Clause 17, Option 1 applies and the clauses are governed by the law of Ireland. In Clause 18, disputes are resolved before the courts of Ireland. Annex I is completed by sections 1 and 4 of this DPA and the Order Form, Annex II by section 6, and Annex III by section 7.
• United Kingdom. The SCCs apply as modified by the UK Addendum, with Table 1 completed by the parties’ details in the Order Form and this DPA, Table 2 by the choices in the paragraph above, Table 3 by the annexes named above, and Table 4 allowing either party to end the Addendum as set out in its section 19.
• Switzerland. The SCCs apply with the amendments the Swiss Federal Data Protection and Information Commissioner requires: references to the GDPR are read as references to the FADP, the competent supervisory authority is the Swiss Commissioner, the governing law and forum are Switzerland where Swiss law so requires, and the clauses protect the data of legal entities until the FADP no longer does so.

If a court or authority holds that the mechanism above is no longer valid, the parties will cooperate in good faith to put in place a lawful alternative without undue delay, and we may suspend the affected transfer until then.

Where the CCPA or another United States state privacy law applies, we act as the Customer’s service provider or processor, and we certify that we understand and will comply with the following. We will not sell or share Customer Personal Data. We will not retain, use or disclose it for any purpose, including a commercial purpose, other than the business purposes specified in the Agreement, or outside the direct business relationship between the parties, except as that law permits. We will not combine it with personal data we receive from or on behalf of another person or collect from our own interaction with an individual, except as that law permits. We will comply with the obligations that law places on a service provider and provide the same level of privacy protection it requires. We will notify the Customer if we can no longer meet these obligations, and the Customer may take reasonable and appropriate steps to stop and remediate unauthorized use. We will not use Customer Personal Data to train AI models.

During the term, the Customer and its Authorized Users may export and delete Customer Personal Data through the Service and by written request. On termination or expiry of the Agreement, we will, at the Customer’s choice made within 30 days, return the Customer Personal Data in a common machine-readable format or delete it, and in either case delete the remaining copies within 30 days of that choice, except that copies may remain in provider backups for up to 90 days before being overwritten, and we may keep what the law requires us to keep, under the protections of this DPA, for as long as it requires. Content that the Service stores by content address and shares across accounts (documents, voice clips and Stream clips, which carry no account identifier) is deleted on written request that identifies the content. We will confirm deletion in writing on request.

Each party’s liability under or in connection with this DPA, including the SCCs, is subject to the exclusions and limits of liability in the Agreement, and the total liability of each party under the Agreement and this DPA together is subject to the single aggregate limit set out in the Agreement. Nothing in this section limits a party’s liability to data subjects under the SCCs or a liability that cannot be limited by law.

This DPA takes effect when the Customer accepts it as described in section 1 and lasts as long as we process Customer Personal Data. If there is a conflict, the SCCs prevail over this DPA, and this DPA prevails over the Agreement for matters of data protection. We may update this DPA to reflect changes in Data Protection Laws or in the Service by publishing the new version here and notifying the Customer; a change that materially reduces the Customer’s protections requires the Customer’s agreement.

Except where the SCCs require otherwise, this DPA is governed by the law that governs the Agreement, which is the law of the State of Nevada, and disputes are resolved as the Agreement provides.

Parcel Digital LLC, 5725 S Valley View Blvd Ste 5 PMB 879632, Las Vegas, Nevada 89118-3122, United States. Notices under this DPA, including Security Incident notices to us and Subprocessor objections, go to legal@getaxo.app. Our data protection contact is privacy@getaxo.app. We have not appointed a representative in the European Union or the United Kingdom.