DATA PROCESSING ADDENDUM

Version date: 4 November 2026. In force from: 4 November 2026.

This Data Processing Addendum(DPA) is entered between the partner identified in the Agreement (you or your) and Coassemble Pty Ltd ABN 92 616 882 047 (we, us or our), together the Parties and each a Party. This DPA is published at coassemble.com/dpa and is incorporated by reference under clause 15.2 of the Coassemble Embed Agreement between the Parties (Agreement) and forms part of the Agreement. In accordance with clause 15.2 of the Agreement, if there is a conflict between this DPA and the Agreement in relation to the processing of personal data, this DPA will prevail.

1Application

1.1This DPA applies to the extent that we process personal data which is subject to Regulation (EU) 2016/679 (Regulation), the UK GDPR and/or other applicable data protection and privacy laws (Applicable Data Protection Laws) on your behalf. Module One and the other provisions identified in clause 1.6 also apply to the extent that you transfer to us personal data which we process as an independent controller, as described in Annex I.B(2).

1.2Where a transfer of personal data from you to us is subject to the Regulation and requires appropriate safeguards under Article 46 of the Regulation, the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (Clauses), available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj, are incorporated into this DPA by reference and apply as follows:

(a) Module One (controller to controller) applies where you transfer to us the personal data described in Annex I.B(2), which we process as an independent controller;

(b) Module Two (controller to processor) applies where you act as controller and we act as your processor; and

(c) Module Three (processor to processor) applies where you act as processor on behalf of a third-party controller and we act as your sub-processor.

For each Module: (i) Clause 7 (Docking clause) applies; (ii) for Modules Two and Three, Option 2 (general written authorisation) in Clause 9(a) applies, with the notice period set out in clause 2.7; (iii) the optional wording in Clause 11(a) does not apply; (iv) for Clause 13, the competent supervisory authority is as set out in Annex I.C; (v) for Clause 17, the Clauses are governed by the law of France; (vi) for Clause 18(b), disputes will be resolved by the courts of France; and (vii) Annexes I and II of the Clauses are completed by Annexes I and II of this DPA, with Annex I.B(1) applying to Modules Two and Three and Annex I.B(2) applying to Module One.

1.3To the extent the Clauses apply, they are incorporated into and form part of this DPA. To the extent required by Article 28 of the Regulation or Article 28 of the UK GDPR, the applicable provisions of the Clauses will also apply to processing under this DPA irrespective of whether an international transfer takes place.

1.4With regard to the processing of personal data, the Parties acknowledge that:

(a)Annex I.B(1) describes the subject matter and details of the processing of personal data we carry out as processor or sub-processor, and Annex I.B(2) describes the personal data we process as an independent controller;

(b)where you process personal data as controller, you are the controller and data exporter and we are the processor and data importer;

(c)where you process personal data on behalf of a third-party controller, you are the processor and data exporter, and we are the sub-processor and data importer; and

(d)where we process the personal data described in Annex I.B(2), you and we are each independent controllers, you are the data exporter and we are the data importer.

1.5Where a transfer of personal data from you to us is subject to the UK GDPR and constitutes a restricted transfer requiring appropriate safeguards under Article 46 of the UK GDPR, the Clauses (applying Module One, Module Two or Module Three as set out in clause 1.2), as amended by the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A(1) of the Data Protection Act 2018 (UK Addendum), will apply to that transfer. The UK Addendum, as set out below under the heading “UK International Data Transfer Addendum”, is incorporated into and forms part of this DPA. If the UK Addendum is amended, replaced or superseded, the Parties will cooperate in good faith to put in place the replacement transfer mechanism.

1.6Where we act as controller, only this clause 1, Module One of the Clauses, the UK Addendum as it applies to Module One, Annex I (sections A, B(2) and C), Annex II, clauses 2.11 to 2.14 and the General clauses of this DPA apply. All other additional commercial clauses in clause 2 apply only where we act as processor or sub-processor. Our processing as controller of personal data outside the scope of the Clauses is governed by our Privacy Policy.

1.7Where this DPA uses terms which are defined in the Regulation, the UK GDPR or the Agreement, those terms will have the same meaning as in the Regulation, the UK GDPR or Agreement (as relevant). “UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018. References in this DPA (other than in the Clauses) to the Regulation include, where the UK GDPR applies, the UK GDPR.

2Additional Commercial Clauses

The additional commercial clauses set out here will apply to the Clauses below. These additional commercial clauses have been drafted on the basis of the express statement in clause 2 of the Clauses which states that the Clauses may be included in a wider contract and that the parties are free to add other clauses provided they do not contradict, directly or indirectly, the Clauses or prejudice the fundamental rights and freedoms of data subjects.

2.1You represent and warrant to us that Annex I.B has been accurately completed.

2.2In relation to clause 8.1 of the Clauses, you acknowledge and expressly agree that:

(a)the following is deemed to be your instruction regarding the processing of personal data by us. You instruct us to process the personal data:

(1)to provide the Services, and any related support in accordance with the Agreement and this DPA;

(2)as specified by you during your use of the Services and any related support;

(3)as documented in the Agreement;

(4)as documented in this DPA;

(5)in addition to any further documented instructions provided by you;

(b)an email is sufficient to meet the ‘documented’ requirement for instructions; and

(c)where you act as processor on behalf of a third-party controller, the instructions in this clause 2.2 include the instructions of the relevant controller as communicated to us by you, and you warrant that your instructions are consistent with them.

2.3In relation to clause 8.3 of the Clauses, the Parties agree that where a copy of the Clauses is to be provided to a data subject, only the Clauses forming part of this DPA and not the whole DPA will be provided to the data subject.

2.4In relation to clause 8.5 of the Clauses, you must notify us of your preference for deletion or return of personal data before the end of the Retention Period under clause 19.5(a) of the Agreement. If you do not notify us of your preference within this timeframe, you will be deemed to have requested deletion of the personal data and we will be entitled to delete such data without any Liability to you.

2.5For the purpose of security of processing under clause 8.6 of the Clauses, you acknowledge and expressly agree that:

(a)the regular checks of security measures referred to under clause 8.6(a) of the Clauses will be carried out annually;

(b)we may update our security measures, including the measures described in Annex II, at any time, provided that such updates and modifications do not result in the degradation of the overall security of our Services;

(c)except as expressly provided by the DPA and the Agreement, you are responsible for your secure use of our Services, including:

(1)assessing and using the Services so as to ensure an acceptable level of risk to the personal data you ask us to process;

(2)keeping your and your Personnel’s, Clients’ and End Users’ account credentials confidential and secure;

(3)protecting the personal data that you elect to store or transfer outside of the Services (and for which we will have no obligation); and

(d)our notification of, or response to, a personal data breach in accordance with clauses 8.6(c) and (d) of the Clauses, will not be construed as an acknowledgement by us of any fault or Liability with respect to the personal data breach; and

(e)without limiting clause 8.6(c) of the Clauses, we will notify you of any personal data breach concerning personal data processed on your behalf without undue delay and in any event within 72 hours after becoming aware of it.

2.6In relation to any audits requested under clause 8.9 of the Clauses:

(a)you agree that prior to conducting such an audit, you will request information from us (such as evidence of our relevant certifications) which you require for us to demonstrate our compliance with our obligations under Article 28 of the Regulation and these Clauses. Subject to our confidentiality obligations, we will promptly provide such information;

(b)if the information provided is not sufficient, you may conduct an audit and the Parties agree that the audit will be conducted in accordance with the following specifications:

(1)the audit will be subject to our obligations of confidentiality;

(2)you will not request an audit more than once annually unless there is evidence of non-compliance by us;

(3)you will request an audit by providing us reasonable written notice and 30 days is considered reasonable notice;

(4)if you choose to use an independent auditor, you will be responsible for ensuring the auditor signs an appropriate confidentiality agreement, in a form approved by us, and for paying their fees;

(5)for on-site audits, reasonable professional fees will be agreed with you to compensate us for any time required by our Personnel for the purpose of the audit, provided that such fees will not be payable where the audit identifies a material breach by us of this DPA or Applicable Data Protection Laws;

(6)prior to any on-site audit, you will work with us to agree the scope, time, duration and fees for that audit;

(7)you will only request access to information for the purpose of good faith fulfilment of your obligations under the Regulation;

(8)you will take all reasonable measures to limit any adverse impact on us; and

(9)if you discover any non-compliance during an audit, you will promptly notify us of the non-compliance and provide us with any information relevant to the non-compliance.

2.7In relation to clause 9 of the Clauses:

(a)the agreed list of sub-processors is set out in Annex I.B, and the most up-to-date list is maintained in our Trust Centre at https://trust.coassemble.com/;

(b)we will provide you with at least 14 days’ prior written notice of any intended addition or replacement of a sub-processor, including sufficient information to enable you to exercise your right to object, which we may give by publishing the change on our Trust Centre and notifying subscribers to our Trust Centre updates;

(c)any objection to a sub-processor must be in writing and on reasonable grounds;

(d)in response to any objection to a sub-processor by you, we will do one of the following, at our election:

(1)not appoint the proposed sub-processor;

(2)not disclose any personal data we process on your behalf to the proposed sub-processor;

(3)not disclose any personal data we process on your behalf to the proposed sub-processor until reasonable steps have been taken to address your objections, you have been informed of those reasonable steps and agreed to that sub-processor based on those reasonable steps; or

(4)inform you that you may terminate the Agreement immediately by providing written notice to us;

(e)you agree that the remedies described above in (1) through to (4) above are the only remedies available if you object to any proposed sub-processor; and

(f)where you act as processor on behalf of a third-party controller, our notice to you under clause 2.7(b) will be treated as notice to the relevant controller for the purposes of clause 9(a) of the Clauses (Module Three), and you will promptly pass that notice to the controller and communicate any objection from the controller to us.

2.8In relation to clause 10 of the Clauses:

(a)in notifying you of a data subject request under clause 10(a) and/or providing assistance under clause 10(b), you agree that we may do so via the provision of self-service features via the Platform, which you may be able to use, at no additional cost, to access, port, rectify, delete, object or restrict the use of personal data in connection with your obligations under the Regulation. If self-service is not available or is not sufficient, and it is appropriate to do so, we will provide further assistance in cooperation with you;

(b)you instruct us (and, where you act as processor, you confirm that the relevant controller has authorised us) to respond to a request from a data subject to acknowledge the request; and

(c)nothing in this DPA will restrict or prohibit us from responding to a request from a data subject where we act as controller, including under Module One.

2.9Any assistance we provide to you which either:

(a)extends beyond our obligations under the Regulation or this DPA; or

(b)is required due to your act or omission (or an act or omission of your Personnel) (e.g. a personal data breach caused by your Personnel failing to keep logins confidential) will be at your expense (on a time and materials basis).

2.10In relation to any requirement for certification to be provided by us under the Clauses, including under clauses 8.5 and 16(d), the Parties agree that we may provide such certification via email.

2.11In relation to clause 14 of the Clauses:

(a)you acknowledge that there are certain laws in Australia which may require that we handle personal data in a manner that varies from some of our obligations under the Clauses;

(b)you acknowledge and expressly agree that with respect to those laws and practices listed below, we have notified you of such laws and practices:

(1)noting the obligation in clause 10 of the Clauses in particular, under the Australian Privacy Act 1988 (Cth) we are obliged to respond to an access or correction request within a reasonable period of receiving the request and we are obliged to provide access to or correct personal information unless an exception applies. Where we act as a processor for you, we will notify you of a data subject request and, to the extent possible to do so and still meet our obligations under the Privacy Act, we will follow your instructions (or, where you act as processor, the relevant controller’s instructions as communicated to us by you). We will notify you if we believe we must action a request under the Privacy Act despite your instructions;

(2)noting the obligations in clauses 8.5 and 16(d) of the Clauses in particular, we have data retention obligations in respect of, (i) information which may be relevant in the event of future litigation (e.g. a copy of the contract); (ii) under the Australian Corporations Act 2001 (Cth), financial records (for at least 7 years) and company records and registers of members, charges and option holders (for at least 5 years); (iii) under the Australian Income Tax Assessment Act 1936 (Cth), documents relating to our income and expenditure (for at least 5 years); and (iv) anything we know may be required in evidence in a judicial proceeding under the relevant crimes acts in Australia, including without limitation, the Crimes Act 1914 (Cth); and

(3)noting the obligations in clauses 8.5, 14(a), 14(b)(ii) and 16(d) of the Clauses in particular, we may have data retention and disclosure obligations, or obligations to authorise access by authorities to personal data, under Australian national security laws. We will follow the process in clause 15 of the Clauses if we receive such a disclosure request from a public authority.

Having considered the laws and practices listed above, and because Australia is a democratic state with a legal system underpinned by the rule of law, an independent judiciary and effective administrative and judicial redress, the Parties have no reason to believe that those laws and practices prevent us from fulfilling our obligations under the Clauses.

2.12In addition to your termination rights in Clause 16 of the Clauses we will have similar termination rights. Accordingly, you agree that:

(a)you must promptly inform us if you are unable to comply with any part of this DPA, for whatever reason;

(b)in the event that you are in breach of this DPA or unable to comply with this DPA, you will suspend the transfer of personal data to us until compliance is again ensured or this DPA is terminated; and

(c)we may terminate this DPA if:

(1)you do not restore compliance within a reasonable time and in any event within one month of suspension;

(2)you are in substantial or persistent breach of this DPA; or

(3)you fail to comply with a binding decision of a competent court or supervisory authority regarding your obligations under this DPA.

2.13Subject to the requirements for the allocation of liability in clause 12 of the Clauses, each Party’s liability to the other Party, taken together in the aggregate, arising out of or related to this DPA (including the Clauses) will be subject to the exclusions and limitations of liability in the Agreement.

2.14Subject to clause 5 of the Clauses, nothing in this DPA reduces the Parties’ obligations under the Agreement and all clauses in the Agreement will continue to apply in full force and effect.

2.15AI processing: In relation to the AI-assisted features of the Services, the Parties agree that:

(a)we process on an inference-only basis, and neither we nor our AI sub-processors (Google and our AI gateway sub-processor) use your personal data, content, prompts or outputs to train or fine-tune any AI model;

(b)for region-locked deployments, Google, our AI sub-processor, caches inputs and outputs for up to 24 hours and retains prompts flagged for abuse review for up to 90 days, in each case within the processing region identified in Annex I.B; for US-hosted deployments, requests reach Google’s Gemini models through our AI gateway sub-processor identified in Annex I.B, with no regional guarantee, and our account with that sub-processor blocks model providers that train on or retain prompts;

(c)for region-locked deployments (United Kingdom, European Union and Australia), the AI processing location is fixed with no failover to another region or to another provider, so that a regional service failure causes the request to fail rather than being processed elsewhere. The AI gateway sub-processor identified in Annex I.B, which manages failover between the providers serving the same model, is used only for US-hosted deployments and is not used for region-locked deployments; and

(d)you may disable AI content generation, AI narration and AI translation for any individual tenant at any time through the corresponding embed configuration options, without any change on our part.

3General

3.1Execution: Execution of the Agreement by the Parties constitutes execution of this DPA, including the Clauses, the UK Addendum and their annexes, with effect from the Commencement Date of the Agreement. No separate signature of this DPA is required.

3.2Amendment: Other than as expressly permitted under this DPA, this DPA may only be amended by written instrument executed by the Parties.

3.3Updates: We may update this DPA by publishing a revised version, with its version date, at coassemble.com/dpa at least 14 days before it takes effect, and by notifying subscribers to our Trust Centre updates. Notice given in this way constitutes written notice for the purposes of this DPA and the Clauses. No update will materially reduce the protection of personal data under this DPA. If you object to an update on reasonable grounds within that 14-day period, the version in force before the update continues to apply to you until the matter is resolved. Each prior version of this DPA remains available at coassemble.com/dpa-index.

3.4Assignment: A Party must not assign or deal with the whole or any part of its rights or obligations under this DPA without the prior written consent of the other Party (such consent not to be unreasonably withheld).

3.5Severance: If a provision of this DPA is held to be void, invalid, illegal or unenforceable, that provision is to be read down as narrowly as necessary to allow it to be valid or enforceable, failing which, that provision (or that part of that provision) will be severed from this DPA without affecting the validity or enforceability of the remainder of that provision or the other provisions in this DPA.

3.6Governing law and disputes: Except as set out in this clause, this DPA is governed by the laws that govern the Agreement, and clause 21 of the Agreement applies to any dispute arising under this DPA. The Clauses are governed by the law specified in clause 17 of the Clauses, and disputes arising from them will be resolved as specified in clause 18 of the Clauses. Where the UK Addendum applies, the Clauses as amended by the UK Addendum are governed by the laws of England and Wales, and disputes arising from them will be resolved by the courts of England and Wales, in accordance with the UK Addendum. Nothing in this clause limits the rights of data subjects under the Clauses or the UK Addendum.

UK INTERNATIONAL DATA TRANSFER ADDENDUM

This UK International Data Transfer Addendum forms part of this DPA in accordance with clause 1.5. As permitted by Section 17 of the Mandatory Clauses, the Parties have agreed to set out the information required by Part 1 of the Approved Addendum in the format below.

Part 1: Tables

Table 1: Parties

Start date: the Commencement Date of the Agreement.

Exporter (who sends the Restricted Transfer): the partner identified in the Agreement, with the details set out in Annex I.A.

Importer (who receives the Restricted Transfer): Coassemble Pty Ltd (ABN 92 616 882 047), with the details set out in Annex I.A.

Key contacts: as set out in Annex I.A.

Signature: by executing the Agreement, each Party enters into and agrees to be bound by this Addendum, with the same effect as signing it.

Table 2: Selected SCCs, Modules and Selected Clauses

Addendum EU SCCs: the version of the Approved EU SCCs incorporated into this DPA by clause 1.2, including the Appendix Information, with the following modules and optional provisions in operation:

(a)Module One: in operation where the Exporter transfers the personal data described in Annex I.B(2), which the Importer processes as an independent controller. Clause 7 (Docking Clause): included. Clause 11 (Option): not used.

(b) Module Two: in operation where the Exporter acts as controller. Clause 7 (Docking Clause): included. Clause 11 (Option): not used. Clause 9(a): General Authorisation, with a time period of 14 days.

(c) Module Three: in operation where the Exporter acts as processor on behalf of a third-party controller. Clause 7 (Docking Clause): included. Clause 11 (Option): not used. Clause 9(a): General Authorisation, with a time period of 14 days.

Table 3: Appendix Information

Annex 1A (List of Parties): as set out in Annex I.A of this DPA.

Annex 1B (Description of Transfer): as set out in Annex I.B(1) (Modules Two and Three) and Annex I.B(2) (Module One) of this DPA.

Annex II (Technical and organisational measures): as set out in Annex II of this DPA.

Annex III (List of Sub-processors): not applicable, as General Authorisation applies under Clause 9(a).

Table 4: Ending this Addendum when the Approved Addendum Changes

Which Parties may end this Addendum as set out in Section 19: Importer and Exporter.

Part 2: Mandatory Clauses

Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.

EXECUTION

This DPA is executed by the Parties’ execution of the Agreement, as set out in the General clauses of this DPA. No separate signature is required.

APPENDIX I

ANNEX I

A.   LIST OF PARTIES

Data exporter(s):

1.Name: the partner identified in the Agreement

Contact person’s name, position and contact details:

The notices contact identified in the Agreement

Activities relevant to the data transferred under these Clauses: as outlined in section B of this Annex I.

Signature and date: execution of the Agreement by the Parties constitutes execution of these Clauses, including this Annex I, on the Commencement Date of the Agreement.

Role (controller/processor): Controller and/or Processor, as applicable to the relevant processing; Controller for the transfers described in section B(2) (Module One)

Data importer(s):

1.Name: Coassemble Pty Ltd (ABN 92 616 882 047)

Contact person’s name, position and contact details:

Coassemble Privacy Team

privacy@coassemble.com

PO Box 277

Clayfield QLD 4011

AUSTRALIA

Activities relevant to the data transferred under these Clauses: as outlined in section B of this Annex I.

Signature and date: execution of the Agreement by the Parties constitutes execution of these Clauses, including this Annex I, on the Commencement Date of the Agreement.

Role (controller/processor): Processor and/or Sub-Processor, as applicable to the relevant processing; Controller for the transfers described in section B(2) (Module One)

B(1). DESCRIPTION OF TRANSFER: MODULES TWO AND THREE

Categories of data subjects whose personal data is transferred

●Your personnel, clients and end users, including employees, contractors, learners, students and other individuals whose personal data is submitted to or otherwise processed through the Services.

Categories of personal data transferred

The categories below cover authorised users, meaning your personnel and the course authors and administrators of your clients, and learners. Learners in embedded courses are identified to us only by the pseudonymous identifier you supply, together with their learning activity and the technical data generated by their use of the Services, unless you choose to supply identifying details. Personal data may also be contained in content uploaded for course creation, at the discretion of the uploading author.

●a Data Subject’s name;

●a Data Subject’s work email address;

●images of a Data Subject where these are uploaded as a profile photograph;

●a Data Subject’s work department;

●a Data Subject’s learning activity, including course progress, assessment results, completion records and activity logs;

●technical data generated by use of the Services, including the client IP address and user agent recorded in server request logs;

●the name of the workspace associated with an authorised user; and

●billing contact and payment details for the entity paying for the account, processed by our payments sub-processor.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

The Services are not intended for the processing of special categories of personal data unless expressly agreed between the Parties and appropriate safeguards are implemented in accordance with Applicable Data Protection Laws.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

On a continuous basis, and at the discretion of the exporter or its authorised users and participants.

Nature of the processing

The nature of processing is as specified in the Agreement, this DPA and as further instructed by you or, where you act as processor, by the relevant controller as communicated to us by you.

Purpose(s) of the data transfer and further processing

The purpose of transfer and processing are as specified in the Agreement, this DPA and as further instructed by you or, where you act as processor, by the relevant controller as communicated to us by you.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

We will only retain personal data for as long as necessary to fulfil the purposes we are instructed to use it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider your instructions for its processing and deletion, our obligations to delete it after processing services are complete, the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of the personal data and the applicable legal requirements.

Where personal data is deleted through the Services, it is retained for the retention period that applies to your workspace, which is 30 days unless otherwise agreed, to allow restoration and is then permanently deleted. Permanent deletion removes the associated database records, the underlying files held in object storage and any video renditions. Personal data may persist in backups until those backups age out of our seven day point-in-time recovery window, and in server and database logs for approximately three months.

Where personal data has been irreversibly anonymised so that it no longer constitutes personal data under Applicable Data Protection Laws, we may retain and use that anonymised information in accordance with the Agreement.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

Current sub-processors are set out below. The most up-to-date list is maintained in our Trust Centre at https://trust.coassemble.com/subprocessors, and changes are subject to clause 2.7 of this DPA. The deployment that serves you is identified in the Agreement: US-hosted (the default), or a region-locked deployment in the United Kingdom, the European Union or Australia. Where a sub-processor’s location differs by deployment, the location for each deployment is set out below.

Transfer mechanism for each sub-processor

Where a transfer to a sub-processor is a restricted transfer, the mechanism relied on is as follows.

Sevalla (Kinsta Inc.), Amazon Web Services, Inc. (a covered entity of Amazon.com, Inc.), Google (Google LLC), Render, Segment (Twilio Inc.), Mixpanel, Inc., Stripe, LLC, Postmark (ActiveCampaign, LLC) and Sentry (listed as Sentry.io) each rely on their certification under the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework and the UK Extension to the EU-U.S. Data Privacy Framework. Each certification was verified as active on the Data Privacy Framework List maintained by the U.S. Department of Commerce on 16 October 2026. Sentry’s certification was verified as active on 2 November 2026.

ConvertAPI, UAB is established in the Republic of Lithuania. Transfers to it from the European Economic Area are not restricted transfers, and transfers from the United Kingdom are made in reliance on the United Kingdom adequacy regulations for the European Economic Area.

OpenRouter is not certified under the Data Privacy Framework. Transfers to it are made on the basis of the Standard Contractual Clauses together with the UK International Data Transfer Addendum. OpenRouter is used for US-hosted deployments only and is not used for region-locked deployments.

Better Stack is not certified under the Data Privacy Framework and receives no personal data, so no restricted transfer arises. Its ingest is in Germany, and in any event transfers from the United Kingdom to the European Economic Area are made in reliance on the United Kingdom adequacy regulations.

Where any sub-processor's Data Privacy Framework certification ceases to be active, transfers to that sub-processor will be made on the basis of the Standard Contractual Clauses together with the UK International Data Transfer Addendum.

B(2). DESCRIPTION OF TRANSFER: MODULE ONE (CONTROLLER TO CONTROLLER)

For Module One, this section B(2) is the Annex I.B referred to in the Clauses.

Categories of data subjects: your personnel and the personnel of your clients who are authorised users of the Services (including administrators and course authors), and your billing and notices contacts.

Categories of personal data: name; work email address; workspace name and role; account, sign-in and usage records associated with the authorised user’s account; communications with us, including support requests; and billing contact details for the entity paying for the account.

Sensitive data: none.

Frequency: continuous, for the term of the Agreement.

Nature and purposes of processing: administering accounts and access to the Services; billing and payment; providing support and service communications, including notices under the Agreement and this DPA; security, fraud prevention and abuse monitoring; analysing use of the Services to maintain and improve them; sending information about our products and services, where permitted by law; and complying with our legal obligations.

Retention: for as long as the account is active, and afterwards for as long as needed for the purposes above, including the retention obligations described in clause 2.11, after which the data is deleted or anonymised.

Recipients: our service providers acting as our processors for these purposes, including the providers listed in section B(1) for hosting, email delivery, billing and product analytics. Onward transfers are made in accordance with Clause 8.7 of the Clauses.

C. COMPETENT SUPERVISORY AUTHORITY

The competent supervisory authority is determined in accordance with Clause 13 of the Clauses, as follows:

(a)where you are established in an EU Member State: the supervisory authority responsible for ensuring your compliance with the Regulation as regards the data transfer;

(b)where you are not established in an EU Member State, but fall within the territorial scope of the Regulation under Article 3(2) and have appointed a representative under Article 27(1): the supervisory authority of the Member State in which your representative is established; and

(c)where you are not established in an EU Member State, but fall within the territorial scope of the Regulation under Article 3(2) without having to appoint a representative: the supervisory authority of the Member State in which the data subjects whose personal data is transferred are located or, where they are located in more than one Member State, the supervisory authority of one of those Member States that you notify to us in writing.

Where the UK Addendum applies, the competent supervisory authority is the Information Commissioner’s Office. On request, you will confirm to us in writing which supervisory authority is competent under this section C.

ANNEX II

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

●Measures of pseudonymisation and encryption of personal data

○All personal data is encrypted in transit and at rest

○When requested we NULL out user identity fields in the DB

●Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services

○Software Unit testing and Functional testing

○Third-party Penetration testing

○Monitoring services provided by our hosting providers (Render for US-hosted deployments and Sevalla for region-locked deployments), with Sentry for error tracking on US-hosted deployments only, and Better Stack for availability monitoring and alerting. Better Stack receives availability checks against public endpoints only, and does not receive application, database or request logs.

●Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident

○Daily database backups

○Point in time recovery for the last 7 days

●Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing

○Software Unit testing and Functional testing

○Third-party Penetration testing

●Measures for user identification and authorisation

○In platform:

■Email address and password, or sign-in with a Google, Microsoft or Slack work account, in which case authentication and any multi-factor policy are enforced by that provider. Sign-in through the customer's own enterprise identity provider is not currently offered.

■Security policy developed internally to allow users to restrict access to their content.

○Infrastructure

■Hosting providers (Render and Sevalla) — MFA required for internal access

●Measures for the protection of data during transmission

○TLS 1.2 or higher is used in transit, with ECDHE key exchange and forward secrecy.

○Card details are held by Stripe and are not stored on our systems; we store only a reference to the payment method.

●Measures for the protection of data during storage

○Data at rest is encrypted by the hosting provider using AES-256. Passwords are hashed using bcrypt (work factor 13) and are never stored in a reversible form

●Measures for ensuring physical security of locations at which personal data are processed

○For US-hosted deployments, applications and databases run on Render in Oregon, USA, with object storage on Amazon Web Services in N. Virginia, USA (us-east-1). For the United Kingdom deployment, applications and databases run on Sevalla in London, United Kingdom, with object storage on Amazon Web Services in London (eu-west-2). For the European Union deployment, applications and databases run on Sevalla in the European Union (currently Belgium), with object storage on Amazon Web Services in Ireland (eu-west-1). For the Australian deployment, applications and databases run on Sevalla in Sydney, Australia, with object storage on Amazon Web Services in Sydney (ap-southeast-2). The underlying cloud providers operate data centres certified to ISO 27001 and SOC 2 Type 2.

○Remote working environments are governed by a ‘working remotely’ policy that applies the same requirements as in the office, whereby devices are set with admin controls, and inactive sleep functionality. All team members who work with customer data are required to use 2FA on all 3rd party platforms.

○A full working from home policy training course is rolled out to new staff and existing staff.

●Measures for ensuring events logging

○Hosting provider internal access is audited

○Audit transaction logging internally to the application

○Server request logging retained internally

●Measures for internal IT and IT security governance and management

○Internal training course for all new team members and current team members on platform access and password management and IT processes.

○2 Factor Authentication required on all customer data platforms

○Platform offboarding operational process to ensure existing staff lose access to all platforms on cessation of employment.

○Platform administration limited to key positions with industry level requirements for password generation.

●Measures for certification/assurance of processes and products

○We have completed a SOC 2 Type 2 examination by an independent auditor.

●Measures for ensuring data minimisation

○Only the data required to provide the service is collected or processed. Learners in embedded courses are identified by a pseudonymous identifier supplied by the customer, not by name or email address, unless the customer chooses to provide more. Only course content is sent to the AI models; no account records, learner records or tracking data are included. Data is scoped per workspace throughout, and production and test environments run on separate databases, with no production data held in test. Employees and automated services are granted the minimum level of access required for the task.

●Measures for ensuring data quality

○Customers control their own content and can correct it at any time. AI-generated material is produced as a draft that the author reviews and edits before publication. Account holders can update their own details in the product. Learner tracking records are generated by the platform from actual activity rather than entered by hand, and can be corrected or deleted on request through the API.

●Measures for ensuring limited data retention

○Data is retained while the account is active, for as long as is necessary to provide the service. Data deleted through the Services is permanently removed automatically once the retention period that applies to the workspace has passed, which is 30 days after deletion unless otherwise agreed. Server request logs are retained for approximately three months. Database backups support point-in-time recovery for the previous seven days. On termination, data is retained for the retention period set out in the Agreement, during which we will return it to you on request, and is then deleted. Specific content can be deleted earlier at any time through the API or on request.

●Measures for ensuring accountability

○A clear escalation procedure exists to ensure accountability for all Coassemble team members and executives.

○A training course on the escalation process around data security and privacy that clearly outlines the steps to communicate any breach to the associated manager and then to the associated customer.

○Coassemble has a clearly articulated Terms of Service and Privacy policy that outlines the accountability for Coassemble Pty Ltd in relation to customer data. Please visit our website for access to both policies.

●Measures for allowing data portability and ensuring erasure

○Portability: courses can be exported as SCORM packages for use in any conforming LMS. Course content, learner tracking records and workspace data can also be retrieved in machine-readable form through the Embed API, which is how partners read data back into their own systems.

○Erasure: available to the customer directly through the API, without contacting us. A course (DELETE /course/:id), an end user and their records (DELETE /user/:identifier), a learner's tracking record for a course (DELETE /tracking), and an entire client tenant (DELETE /client/:identifier) can each be deleted.

○How a request is handled: a data subject contacts the customer, who is the controller or, where the customer acts as processor, passes the request to or from the relevant controller. The customer identifies the records and performs the deletion through the API, or asks us to. Requests to us are received through our support channel and actioned by an authorised engineer. Where a record must be retained but the individual identified in it must not, we null the identifying fields so that the record is retained in pseudonymised form.

○What deletion does: deletion through the API removes the content from the service and from all customer and end user access, and is reversible during the retention period that applies to the workspace, 30 days unless otherwise agreed, to protect against mistakes. Permanent removal from the database, from object storage and of any video renditions then happens automatically, without a request. Deleted data may persist in backups until those backups age out, within the seven day point-in-time recovery window, and in server and database logs for approximately three months.

●For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-)processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter

○Coassemble engages sub-processors under written contracts that impose data protection obligations consistent with Clause 9(b) of the Clauses. Coassemble assists the data exporter and, where Module Three applies, the controller through the self-service features described in this Annex, through its support channel, and by passing relevant requests and notifications to the data exporter without undue delay.

●Other: Principle of least access observed.

○Employees and automated software services are given the minimum level of access to data required to accomplish the necessary task.