Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Dojo Champ LLC ("Processor") and the customer school ("Controller"). It applies to personal information about the school's students, families, staff and leads that Dojo Champ processes for the school ("School Data"). The school is the controller (or "business"); Dojo Champ is the processor (or "service provider").

Dojo Champ processes School Data only to provide, secure and support the Service and as documented in the Agreement and the school's use of the Service, which are the school's complete instructions. We will not sell or share School Data, use it for our own advertising, or combine it with other data except as permitted for service providers by law. We will tell the school if we believe an instruction breaks the law.

• provide all notices and obtain all consents required by law, including parental consent for children and consent for health information and messaging;
• ensure it has the right to transfer School Data to us, including data imported from previous providers;
• respond to individuals' requests, with our reasonable help;
• configure staff access and permissions appropriately.

Personnel with access to School Data are bound by confidentiality obligations and access it only as needed for their role, including for support the school requests.

• encryption of data in transit (TLS) and at rest by our hosting providers;
• logical separation of each school's data with row level security;
• role based access, least privilege and multi factor authentication for administrative systems;
• payment card data handled by a PCI DSS compliant processor and not stored by us;
• logging, monitoring, backups and vulnerability management.

The school authorizes us to use subprocessors bound by written terms at least as protective as this DPA. Current subprocessors include:

• Supabase (database, authentication and storage, United States)
• Cloudflare (hosting and content delivery, global)
• Stripe (payment processing, United States)
• Telnyx (SMS delivery, United States)
• Resend (email delivery, United States)
• Google (analytics, maps and AI processing, United States)
• Sentry (error monitoring, United States)

We will update this list before adding a new subprocessor. A school may object on reasonable data protection grounds within 15 days by emailing support@dojochamp.com; if we cannot resolve the objection, the school may cancel the affected Service. We remain responsible for our subprocessors' performance under this DPA.

If we receive a request from a student, parent or other individual about School Data, we will direct them to the school and will not respond except as the school instructs or the law requires. We provide tools to view, correct, export and delete records, and reasonable help with data protection assessments and regulator inquiries.

We will notify the school without undue delay, and within 72 hours where feasible, after confirming a security breach affecting School Data, and provide information reasonably available to help the school meet its own notification duties. Notice is not an admission of fault.

After the subscription ends, the school may export School Data for 30 days. We then delete or de identify School Data within 90 days, except data in rolling backups until overwritten and data we must keep by law, which remains protected by this DPA.

On written request no more than once a year, we will answer reasonable security questionnaires and provide information needed to show compliance with this DPA. On-site audits require reasonable notice, confidentiality and are at the school's cost, unless required by a regulator.

School Data is processed in the United States. Where EEA, UK or Swiss law applies, the parties agree to the Standard Contractual Clauses (Module 2, controller to processor) and the UK Addendum, which are incorporated by reference, with this DPA supplying the required details.

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service. If this DPA conflicts with the Terms about personal data, this DPA controls.