Effective Date: January 1, 2026

This Data Processing Addendum (this “Addendum”) is entered into between Customer and Graphical Playground (“GP” or “Graphical Playground”) and forms part of the Terms of Service or, where applicable, the SaaS Subscription Agreement (together, the “Agreement”) whenever Customer is an institutional or enterprise Customer acting as a controller of personal data that GP processes on Customer’s behalf through the Services. Capitalized terms not defined in this Addendum have the meaning given to them in the Agreement. In the event of a conflict between this Addendum and the Agreement regarding the processing of Customer Personal Data, this Addendum controls.

1. Definitions

1.1. “Data Protection Laws” means Regulation (EU) 2016/679 (the “GDPR”), the French Loi n° 78-17 du 6 janvier 1978, as amended, and any other data protection law applicable to the processing of Customer Personal Data under this Addendum.

1.2. “Customer Personal Data” means personal data that GP processes on Customer’s behalf as a processor in the course of providing the Services, such as the account, profile, and usage data of Customer’s Authorized Users.

1.3. “Controller,” “processor,” “data subject,” “personal data,” “processing,” and “personal data breach” have the meanings given to them in the GDPR. “Sub-processor” means a third party GP engages to process Customer Personal Data in providing the Services.

2. Roles of the Parties

2.1. Customer is the controller of Customer Personal Data, and GP is a processor acting on Customer’s behalf. Annex 1 to this Addendum describes the subject matter, duration, nature and purpose of processing, types of personal data, and categories of data subjects.

2.2. Customer will comply with its obligations as a controller under Data Protection Laws, including with respect to the instructions it gives GP and the lawful basis for collecting the Customer Personal Data it provides to or generates through the Services.

3. GP’s Obligations

3.1. GP will:

(a) process Customer Personal Data only on Customer’s documented instructions, including with respect to international transfers, unless required to do otherwise by European Union or member state law, in which case GP will inform Customer of that legal requirement before processing, unless the law prohibits such notice on important grounds of public interest;

(b) ensure that persons authorized to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

(c) implement the technical and organizational security measures described in Annex 2;

(d) engage sub-processors only as permitted under Section 4;

(e) taking into account the nature of the processing, assist Customer by appropriate technical and organizational measures, insofar as reasonably possible, in responding to requests from data subjects seeking to exercise their rights under Data Protection Laws;

(f) assist Customer, taking into account the nature of processing and the information available to GP, in complying with Customer’s obligations under Articles 32 to 36 of the GDPR, including security of processing, breach notification, and data protection impact assessments;

(g) at Customer’s election, delete or return all Customer Personal Data after the end of the provision of the relevant Services, and delete existing copies, unless applicable law requires GP to retain the data; and

(h) make available to Customer information reasonably necessary to demonstrate compliance with this Addendum and allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer, subject to Section 6.

4. Sub-processors

4.1. Customer provides GP with general written authorization to engage sub-processors to process Customer Personal Data, provided GP imposes data protection obligations on each sub-processor that are substantially the same as those set out in this Addendum. A current list of GP’s sub-processors, including the Infrastructure Providers identified in Section 1.3 of the Terms of Service, is maintained at graphical-playground.com/legal/subprocessors.

4.2. GP will give Customer at least thirty (30) days’ notice, by updating the list referenced in Section 4.1 and, where Customer has subscribed to update notifications, by email, before engaging a new sub-processor. Customer may object to a new sub-processor on reasonable data protection grounds within that period by contacting privacy@graphical-playground.com; if the parties cannot resolve the objection, Customer may terminate the affected Services as its exclusive remedy.

4.3. GP remains liable to Customer for the acts and omissions of its sub-processors to the same extent GP would be liable if performing the services of each sub-processor directly under this Addendum.

5. International Data Transfers

5.1. Where GP or a sub-processor transfers Customer Personal Data outside the European Economic Area, GP will ensure the transfer is subject to appropriate safeguards under Chapter V of the GDPR, including the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914, which are incorporated into this Addendum by reference for any such transfer.

6. Audits

6.1. GP will make available to Customer, upon written request no more than once per year, a summary of GP’s then-current security practices or a relevant third-party audit report, where available, in lieu of an on-site audit. If Customer reasonably demonstrates that such documentation is insufficient to verify GP’s compliance with this Addendum, Customer may conduct an on-site audit during normal business hours, on at least thirty (30) days’ written notice, no more than once per year, at Customer’s expense, and subject to confidentiality obligations no less protective than those in Section 4 of the Terms of Service.

7. Personal Data Breaches

7.1. GP will notify Customer without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a personal data breach affecting Customer Personal Data. GP’s notice will include the information reasonably available to GP that Customer needs to meet its own notification obligations under Articles 33 and 34 of the GDPR, and GP will cooperate with Customer’s reasonable requests for further information as the investigation progresses.

8. Data Subject Requests

8.1. If GP receives a request directly from a data subject to exercise a right under Data Protection Laws in relation to Customer Personal Data, GP will not respond to the request, other than to acknowledge receipt, unless legally required to do so, and will forward the request to Customer without undue delay.

9. Deletion or Return of Data

9.1. Upon termination or expiration of the Agreement, GP will make Customer Personal Data available for retrieval for thirty (30) days, consistent with Section 8.2(b) of the Terms of Service, after which GP will delete it, except to the extent applicable law requires GP to retain it.

10. Liability

10.1. Each party’s liability arising out of or related to this Addendum, whether in contract, tort, or under any other theory of liability, is subject to the limitations of liability set out in Section 7 of the Terms of Service, applied to this Addendum as if fully set out herein.

11. Term and Order of Precedence

11.1. This Addendum takes effect on the date Customer’s account is designated as an institutional or enterprise account and continues for as long as GP processes Customer Personal Data under the Agreement. This Addendum is governed by the same governing law and dispute resolution provisions as the Agreement, set out in Sections 9.10 and 9.11 of the Terms of Service.

12. Annex 1: Details of Processing

Subject matter: GP’s provision of the GP Platform to Customer’s Authorized Users.

Duration: For the term of the Agreement, plus the retrieval and deletion periods described in Section 9.1.

Nature and purpose of processing: Hosting, storage, and processing of account, profile, and usage data necessary to provision accounts, deliver courses and certification, operate cloud compilation and rendering infrastructure, and provide support.

Categories of data subjects: Customer’s Authorized Users, including students, instructors, and administrators.

Types of personal data: Name, email address, authentication credentials, profile information, course progress, Customer Content submitted for compilation or rendering, and technical usage data such as IP address and device information.

13. Annex 2: Technical and Organizational Security Measures

GP maintains security measures appropriate to the risk, including: encryption of personal data in transit and, where supported by GP’s Infrastructure Providers, at rest; role-based access controls and multi-factor authentication for administrative access to production systems; logging and monitoring of access to systems processing Customer Personal Data; regular backups; a documented vulnerability disclosure and remediation process under the Security Disclosure Policy; and contractual security obligations imposed on sub-processors consistent with Section 4.1.