Data Processing Agreement — United States

This Data Processing Agreement ("DPA") forms part of the Agreement between:

• Chalkie AI, Co., with offices at 68 Harrison Avenue, Boston, MA 02111, a United States subsidiary of Chalkie AI Ltd (a company registered in England and Wales, no. 15812522) ("Chalkie"); and
• the school, district or other educational agency on whose behalf the account holder uses the Service ("Customer").

Where this DPA is accepted through the Terms of Service or within the Service rather than signed, the Customer is the school, district or other educational agency on whose behalf the account holder uses the Service, and the account holder accepts this DPA on the Customer's behalf under clause 1.3 of the Terms of Service.

It governs the processing of personal data by Chalkie in connection with the Chalkie service (the "Service"). In this DPA, "Agreement" means Chalkie's Terms of Service together with any order form, quote or other contract under which the Customer uses the Service. Where the Agreement conflicts with this DPA on data protection, this DPA prevails.

1.1 Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" carry the meanings given by the data-protection law applicable to the Customer (including FERPA and, in New York, Education Law §2-d); where those laws leave a concept undefined, the definitions of the UK GDPR, under which the Chalkie group operates, apply.

1.2 Roles.

• For personal data that the Customer or its users submit to, or generate through, the Service, the Customer is the controller and Chalkie is the processor.
• Where teachers register for and use Chalkie accounts directly, Chalkie acts as an independent controller of that teacher account data, as described in Chalkie's Privacy Policy.
• Live Activities participation. Students never create accounts, and there is no cross-lesson student profile. When answering is enabled, Chalkie processes that lesson's display names, participant IDs, responses, scores and timestamps on the school's instructions so the teacher can run the activity and review results. Display names are generated automatically as nicknames, but students can edit them, so a display name may contain a student's real name (see clause 4).

2.1 Chalkie processes personal data only to provide the Service, and only on the Customer's documented instructions (including as set out in this DPA and the agreement), unless required otherwise by law (in which case Chalkie will notify the Customer where legally permitted).

2.2 Chalkie will not process personal data for any other purpose, and specifically will not sell personal data, use it for advertising or marketing to data subjects on behalf of third parties, or use it for any other commercial purpose beyond delivering the Service. Chalkie does not use Customer personal data or Customer content to train AI models.

2.3 The subject matter, duration, nature and purpose of processing, and the types of data and categories of data subject, are described in Annex A.

3.1 Confidentiality and training. Chalkie ensures that persons authorised to process the personal data are bound by confidentiality obligations and receive data-protection and security training before being given access, refreshed annually. On request, Chalkie provides written attestation of training completion.

3.2 Least access. Access to personal data is restricted to personnel who need it to deliver or support the Service, protected by multi-factor authentication, and logged (administrative access to user records is recorded in an audit log). Access is revoked on the day a person leaves Chalkie.

3.3 Assistance. Taking into account the nature of processing, Chalkie assists the Customer (by appropriate technical and organisational measures) in fulfilling the Customer's obligations to respond to data subject requests and to meet its security, breach-notification and impact-assessment duties.

4.1 Students never create Chalkie accounts, emails, passwords or school logins, and Chalkie does not build a student profile across lessons. The Service has no facility for school rosters or class lists.

4.2 When a teacher enables answering in Live Activities, Chalkie processes that lesson's display names, participant records, responses, scores and timestamps on the Customer's instructions so the teacher can review results during and after the lesson. Each student who joins is given an automatically generated nickname as their display name. Students can edit this display name, and a teacher may ask students to enter their own name, so a display name may identify a student. The teacher sees each display name alongside that student's responses and scores. Display names are visible to others in the session, and display names and scores are shown to other participants if the teacher enables the leaderboard. Those records stay so the teacher can review results during and after the lesson. Ending a session does not delete them, and there is no automatic deletion period. The teacher can delete a session's results in the Service. The Customer can also ask for return or deletion at any time under clause 7.2, and Chalkie deletes them on termination under clause 10.1. Deleted records may remain in encrypted database backups until those backups expire, within approximately 90 days. If a backup is restored, Chalkie re-applies any later deletion. Hosting and the real-time connection provider process the technical data needed to run the lesson (IP address, browser details, session and connection identifiers).

4.3 Content sent to Chalkie's AI sub-processors to generate resources comprises only curriculum parameters and teacher-authored instructions. Student answers are marked against the activity's answer key using fixed rules; they are not sent to any AI provider for assessment, and no student data is used to train AI models.

4.4 Because display names may contain real names, Chalkie treats all stored display names, responses and scores as student personal data, whether or not a student has changed their nickname. Chalkie does not request, and the Service is not designed to collect, sensitive education-record information from students. If such information is nonetheless submitted, Chalkie will assist the Customer with access, return or deletion.

4.5 The student-facing Live Activities pages carry no analytics, advertising, session-replay or tracking scripts, and set no tracking cookies on student devices.

4.6 The Customer may ask Chalkie, at hello@chalkie.ai, to switch off answering in Live Activities for its school accounts. While answering is switched off, students can still follow the teacher's lesson on their own devices, but no student responses, scores or display names are stored, and the processing described in clauses 4.2 to 4.4 does not take place.

4.7 Each Live Activities session is stored separately. A display name and participant ID apply to one session only, and the Service provides no means of linking a student's results across sessions. Any combining of results across sessions (for example, by a teacher exporting results and merging them outside the Service) happens outside Chalkie and under the Customer's control.

5.1 Chalkie implements appropriate technical and organisational measures to protect personal data (UK GDPR Article 32), described in Chalkie's Security Whitepaper and including, at minimum:

• Encryption of personal data in transit (TLS) and at rest (managed PostgreSQL with LUKS full-volume AES encryption, and AES-256-encrypted backups).
• Role-based access controls with multi-factor authentication on administrative systems, and an audit log of administrative access to user records.
• Hosting on managed infrastructure in the European Union (see clause 9), with encrypted cross-region backups.
• Logging, monitoring and alerting to support detection of and response to incidents.
• Independent penetration testing at least annually.

5.2 Chalkie maintains a written data security and privacy programme aligned to the NIST Cybersecurity Framework, reviewed at least annually.

6.1 The Customer provides general authorisation for Chalkie to engage sub-processors to deliver the Service. The sub-processors that handle Live Activities data are listed in Annex B. The full list of current sub-processors, the data each receives and their locations is set out in Chalkie's Subprocessor List, published in the Privacy Policy.

6.2 Chalkie engages sub-processors only under a written contract imposing the same data protection obligations as those set out in this DPA, and remains liable for its sub-processors' performance.

6.3 Chalkie maintains a public, current Subprocessor List (naming each sub-processor, the data it receives and its location). When a sub-processor is added, replaced or changes role, Chalkie emails the Customer and updates the list. The Customer may review the list at any time and raise data-protection concerns about a listed sub-processor, which the parties will discuss in good faith.

7.1 Chalkie assists the Customer in responding to data subjects exercising their rights, without undue delay and in time for the Customer to meet its own legal deadlines. For teacher account data held by Chalkie as controller, teachers may exercise rights directly with Chalkie (access, correction, deletion and marketing opt-out).

7.2 The teacher can delete a session's results in the Service. Other requests concerning Live Activities records (access, correction, return or deletion) are made by the Customer to hello@chalkie.ai. Chalkie fulfils them without undue delay and in time for the Customer to meet its own legal deadlines. Parents and eligible students make such requests through the Customer.

8.1 Chalkie notifies the Customer without undue delay, and in any event within 24 hours, after becoming aware of a personal data breach affecting the Customer's personal data.

8.2 The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point. Chalkie cooperates with the Customer's own notification obligations and with law enforcement.

9.1 Personal data, including Live Activities records, is hosted in the European Union (Amsterdam, Netherlands). Encrypted database backups of that data are stored in the United Kingdom (London). That transfer from the EEA to the United Kingdom is covered by the European Commission's adequacy decision for the United Kingdom. The Chalkie group is headquartered in the United Kingdom; the contracting entity under this DPA is its US subsidiary.

9.2 Where the provision of the Service requires a transfer of personal data across borders (including to the Customer and to the sub-processors listed in the Subprocessor List), such transfers are made under an appropriate transfer mechanism: for transfers from the UK, the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses; for transfers from the EEA, the EU Standard Contractual Clauses; and, where a receiving sub-processor is certified, the applicable Data Privacy Framework. If those transfer terms conflict with this DPA, they prevail.

10.1 On termination or expiry of the agreement, Chalkie will, at the Customer's choice, return or delete the personal data it processes on the Customer's behalf, and delete production copies, within 30 days, unless retention is required by law. Encrypted backups remain until they expire, within approximately 90 days. On request, Chalkie certifies deletion in writing.

10.2 Deletion of teacher account data follows Chalkie's Data Retention & Destruction Policy: identifying fields are irreversibly de-identified and third-party records (billing, email marketing) are removed; de-identified aggregate statistics may be retained and contain no personal data. Copies in encrypted backups age out within approximately 90 days.

10.3 Live Activities records. Live Activities display names, participant records, responses, scores and timestamps are kept so that teachers can return to a lesson's results later. They are not deleted when the session ends, and there is no automatic deletion period. The teacher can delete a session's results in the Service. The Customer can also ask Chalkie to delete a lesson's records at any time under clause 7.2, and Chalkie deletes them on termination under clause 10.1. Deleted records may remain in encrypted database backups until those backups expire, within approximately 90 days; if a backup is ever restored, Chalkie re-applies any deletions made after that backup was taken.

11.1 Chalkie makes available information reasonably necessary to demonstrate compliance with this DPA, including its Security Whitepaper, Subprocessor List, NIST CSF self-assessment and most recent penetration-test attestation.

11.2 Chalkie allows for and contributes to audits, including inspections, conducted by the Customer or an auditor it mandates, on reasonable prior notice and no more than once per year, except following a personal data breach affecting the Customer. Where available, up-to-date third-party reports or certifications will be provided to minimise operational disruption.

12.1 Term. This DPA runs for the duration of the agreement and the processing.

12.2 Governing law. This DPA is governed by the laws of the Customer's state, without prejudice to the mandatory data-protection laws applicable to the Customer.

12.3 Liability. Liability under this DPA is subject to the limitations in the underlying agreement, except where such limitation is not permitted by law.

12.4 Changes. Chalkie may update this DPA, provided the update does not reduce the protection given to Customer personal data. Chalkie emails the Customer when it updates this DPA, and when a change to the Service materially changes how Customer personal data is processed. If an update or change materially changes how Customer personal data is processed, the Customer may object and, if the objection cannot be resolved, may ask for the affected feature to be switched off for its accounts or terminate the affected part of the Service. Changes to sub-processors are handled under clause 6.3.

12.5 Survival. Chalkie's obligations under this DPA continue for as long as Chalkie or its sub-processors hold any Customer personal data, including after the Agreement ends.

12.6 Acceptance and signature. This DPA takes effect when the Customer, or an account holder acting on the Customer's behalf, accepts it electronically through the Terms of Service or within the Service, or when it is signed. It may be signed electronically and in counterparts, each of which is an original.

12.7 Entire agreement on data protection. From the date it is accepted, this DPA replaces any earlier version of the Chalkie Data Processing Agreement accepted by click-through or signed on Chalkie's standard terms. It does not replace an agreement on the Customer's, a state's or a consortium's own form (including a National Data Privacy Agreement or an Exhibit E), or any agreement containing terms the parties specifically negotiated; where such an agreement exists, it prevails over this DPA to the extent of any inconsistency.

12.8 Order of precedence. If there is a conflict between this DPA and the Terms of Service, this DPA prevails for the processing of personal data. If there is a conflict between this DPA and an agreement the Customer and Chalkie have separately signed, the signed agreement prevails.

This addendum forms part of this DPA. Section B applies where the Customer is subject to New York Education Law §2-d; section B-bis applies to other states.

A. FERPA

A.1 Where Chalkie receives personally identifiable information from student education records through school-directed Live Activities participation, Chalkie acts as a "school official" with a legitimate educational interest, performing a service the Customer would otherwise use its own staff for, and under the Customer's direct control with respect to the use and maintenance of that information. Chalkie uses that information only for the authorised purpose, and complies with the re-disclosure limitations of 34 CFR § 99.33.

B. New York Education Law §2-d

B.1 Chalkie agrees that it will:

• use Customer data only for the exclusive purposes of providing the Service;
• not sell, use or disclose Customer data for any marketing or commercial purpose;
• maintain a data security and privacy plan aligned to the NIST Cybersecurity Framework v1.1 (the Security Whitepaper serves as the plan and can be appended as an exhibit);
• ensure that any officer, employee or sub-processor with access to Customer data is trained on the federal and state laws governing its confidentiality before access is granted and annually thereafter, with written attestation provided to the Customer annually;
• ensure sub-processors are bound by obligations no less protective than this DPA;
• return or destroy Customer data on expiry as set out in clause 10, with destruction certified in writing within 30 days, in alignment with NIST SP 800-88;
• maintain cyber-liability insurance of not less than $2,000,000 per claim and in the aggregate (certificate of insurance available on request).

B.2 Breach notification. Chalkie notifies the Customer of any breach or unauthorised release of Customer data in the most expedient way possible and without unreasonable delay, and in any event within the 24 hours committed in clause 8.1, consistent with §2-d and NY General Business Law §899-aa, and cooperates with investigations. Where a breach is attributable to Chalkie, Chalkie bears the cost of legally required notifications.

B-bis. Other state student-privacy laws

B.3 Where the Customer's state has its own student-data privacy statute (for example, Louisiana R.S. 17:3913 to 17:3914), the commitments in B.1 and B.2 apply equally, with references to New York Education Law §2-d read as references to that statute. Where the state or district requires a specific data-privacy agreement or addendum (including a state version of the SDPC National Data Privacy Agreement), Chalkie will review and execute it in place of, or alongside, this Addendum.

C. Parents' Bill of Rights: supplemental information

C.1 Students do not create Chalkie accounts. Parent and eligible-student requests about Live Activities records go through the Customer; Chalkie assists the Customer under clause 7.2. For completeness, Chalkie confirms:

• Exclusive purposes: Customer data is used only to provide the Service (clause 2).
• Sub-processor protections: all sub-processors are bound by equivalent obligations (clause 6).
• Retention: Live Activities records are not deleted when the session ends, and there is no automatic deletion period. The teacher can delete a session's results in the Service. The Customer can ask for deletion sooner, or Chalkie deletes them when the agreement ends (clause 10.3).
• Return/destruction on expiry: as set out in clause 10, certified on request.
• Challenging accuracy: requests regarding a student's Live participation data are directed to the Customer; Chalkie assists. Requests regarding teacher data are facilitated within 30 days (clause 7).
• Storage and security: Customer data is hosted in the EU (encrypted in transit and at rest) with the safeguards in clause 5.

D. Live Activities participation (reaffirmed)

D.1 Chalkie does not create student accounts or a cross-lesson student profile. Clause 4 and Annex A describe the limited, school-directed Live Activities records, and clause 4.6 describes how the Customer can ask for answering to be switched off.

E. COPPA

E.1 Where students under 13 use Live Activities, Chalkie relies on the Customer's authorisation, given on behalf of parents for the educational purpose of the Service, under the Children's Online Privacy Protection Act. Chalkie uses personal information collected from those students only to provide the Service to the Customer, and for no commercial purpose.

E.2 The Customer is responsible for giving parents any notice it is required to give about its use of Live Activities, and may rely on clause 4 and Annex A for that purpose. On the Customer's request, Chalkie will provide the information the Customer needs to answer parents' questions, and will delete a student's Live records under clause 7.2.

For use where the DPA is signed rather than accepted electronically (clause 12.6). Agreed by the parties:

Chalkie — Name, title, date, signature.

Customer — Name, title, date, signature.

The sub-processors below handle Live Activities data. The full list of sub-processors for the Service is in Chalkie's Subprocessor List in the Privacy Policy.

No AI provider receives student data.