Data Processing Agreement (DPA)

for the platform https://schoolmaker.co

Effective as of 9 June 2026

This Data Processing Agreement ("DPA") forms an annex to the Terms and Conditions — Coaches ("Coach Terms") and governs the processing of personal data carried out by Influence Systems Consulting Limited, trading as SchoolMaker.co ("ISCL" or "SchoolMaker.co"), registered office: Unit B 3/F Kai Wan Hse, 146 Tung Choi St, Mongkok, Hong Kong, email: support@schoolmaker.co, on behalf of the Coach, a natural or legal person acting as a professional, identified when subscribing to the platform (the "Coach" or "Data Controller").

Capitalized terms not defined in this DPA have the meaning given in the Coach Terms. Terms from Regulation (EU) 2016/679 ("GDPR") are used as defined in that regulation.

1. Purpose

In connection with the provision of the SchoolMaker platform (the "Software") and related services (the "Services"), ISCL acts as a processor within the meaning of Article 28 of the GDPR. The Coach acts as data controller for the personal data of its Users (members, learners, and anyone enrolled in its training space).

This DPA sets out the framework for such processing and ensures compliance with Article 28(3) and (4) of the GDPR. Annexes I and II form an integral part of this DPA. This DPA is without prejudice to the Data Controller's obligations under the GDPR.

2. ISCL's obligations

As processor, ISCL undertakes to:

• process personal data only for purposes related to the provision of the Services, as described in Annex I;
• not access or use data for purposes other than performing the Services or on the Coach's documented instructions;
• process data in accordance with the Coach's documented instructions; if ISCL believes an instruction violates the GDPR or other applicable data protection law, it will promptly inform the Coach;
• ensure that persons authorized to process data are bound by confidentiality or subject to an appropriate legal duty of confidentiality;
• implement data protection by design and by default in the development of its Services.

3. Coach's obligations

As data controller, the Coach undertakes to:

• provide ISCL only with data that is adequate, relevant, and limited to what is necessary for the purposes in Annex I;
• document in writing any specific instructions regarding processing by ISCL;
• have a valid legal basis for each processing activity entrusted to ISCL;
• inform data subjects in accordance with the GDPR, including through its own privacy policy;
• supervise processing and ensure compliance with its obligations toward data subjects.

4. Sub-processors

The Coach authorizes ISCL to engage the sub-processors listed in SchoolMaker.co's Privacy Policy (section on transfers and partners).

ISCL will inform the Coach of any addition or replacement of a sub-processor at least thirty (30) calendar days before implementation, by email to the contact designated under Section 8. The Coach may object in writing within that period. If the objection persists, the Parties will seek a good-faith solution or may terminate the Services in accordance with the Coach Terms.

ISCL undertakes to select only sub-processors providing sufficient guarantees under the GDPR and remains liable for the acts and omissions of each sub-processor.

5. International transfers

Where a sub-processor processes data outside the European Economic Area, ISCL ensures transfers are covered by a mechanism recognized under Chapter V of the GDPR, in particular the European Commission's Standard Contractual Clauses or an equivalent mechanism.

Core platform hosting data is stored within the European Union (notably Ireland for application infrastructure and primary storage, and Germany for video hosting), as stated in the Legal Notice.

6. Security measures

ISCL implements the technical and organizational measures described in Annex II, ensuring a level of security appropriate to the risk.

The Coach remains responsible for the security of its own systems, access credentials, and environments outside the Services provided by ISCL.

7. Personal data breach notification

In the event of a personal data breach affecting data processed on behalf of the Coach, ISCL will notify the Coach within a maximum of forty-eight (48) hours of becoming aware of it, at the address indicated in Section 8.

The notification will include, where possible:

• a description of the nature of the breach, including categories and approximate number of data subjects and records affected;
• contact details for obtaining further information;
• likely consequences and measures taken or proposed to address the breach.

If all information is not immediately available, ISCL will provide known details and supplement the notification as further information becomes available.

8. Contact point

The Coach designates a contact person for any DPA-related matter (data protection officer or other representative) by sending contact details to support@schoolmaker.co. If no designation is made, the Coach account holder will be deemed the contact point.

ISCL has appointed an external data protection officer: Maître Etienne Deshoulières, 121 boulevard de Sébastopol, 75002 Paris — contact@deshoulieres-avocats.com — https://www.deshoulieres-avocats.com/.

9. Documentation and audit

ISCL makes available to the Coach documentation reasonably necessary to demonstrate compliance with its obligations under this DPA.

The Coach may conduct one audit per year, directly or through an independent auditor, non-competing with ISCL and pre-approved by ISCL, limited to two (2) business days, subject to at least twenty (20) business days' prior written notice. The audit must not disrupt the provision of Services. Audit costs are borne by the Coach, unless the audit reveals a material breach attributable to ISCL.

10. Assistance to the Coach

ISCL will inform the Coach within seven (7) calendar days of any request received directly from a data subject regarding data processed on the Coach's behalf, and will not respond without the Coach's instructions.

ISCL will assist the Coach, to a reasonable extent and considering the nature of processing, in responding to data subject rights requests, conducting data protection impact assessments, and carrying out prior consultations with supervisory authorities, where such obligations fall on the Coach.

11. Term

This DPA takes effect upon acceptance of the Coach Terms and remains in force for the duration of the contractual relationship between the Parties.

12. Liability

Liability of the Parties under this DPA is governed by the liability provisions of the Coach Terms, subject to mandatory provisions of the GDPR.

13. Termination

The Coach may terminate the Services in accordance with the Coach Terms. ISCL may suspend or terminate access if, after notification, the Coach insists on instructions that violate the GDPR or applicable law.

14. Return and deletion of data

Upon termination of the Services, ISCL will, at the Coach's written choice sent to support@schoolmaker.co within thirty (30) days:

• either return the Coach's personal data in a commonly used format, then delete existing copies;
• or permanently delete or irreversibly anonymize the data within a maximum of six (6) months.

If no choice is expressed within the allotted period, ISCL will delete the data as per the second option above. Data ISCL is legally required to retain longer is not affected.

Annex I – Description of processing

Annex II – Security measures

ISCL implements in particular the following measures:

• Encryption: encryption of data in transit (TLS/HTTPS) and encryption at rest where applicable on hosting infrastructure.
• Hosting: core infrastructure hosted within the European Union (Ireland for application and primary storage; Germany for video hosting via Bunny.net).
• Access control: access to data limited to ISCL staff and providers strictly authorized, on a need-to-know basis.
• Authentication: secure authentication mechanisms for account and administration environment access.
• Backups: regular database backup procedures and restoration capability.
• Logging: retention of technical logs for incident detection and security analysis.
• Incident management: internal procedure for handling and notifying data breaches.
• Sub-processors: selection of providers with appropriate guarantees, bound contractually.

Version effective as of 9 June 2026