Data Processing Addendum

Version 1.0.0, in force since 2026-11-01.

This Data Processing Addendum (“DPA”) is between MIDDAG, LLC, a limited liability company registered in Delaware, United States (“MIDDAG”), and the organization that accepts the Terms of Service (“Customer”).

1. Scope and formation

1.1. This DPA forms part of the agreement between Customer and MIDDAG described in the Terms of Service (“Agreement”).

1.2. This DPA applies when MIDDAG processes Customer Personal Data on behalf of Customer in providing the services under the Agreement (“Services”).

1.3. This DPA applies to Business customers, as defined in the Terms of Service. When MIDDAG provides the Services to a Consumer, MIDDAG acts as controller, and the Privacy Policy applies instead of this DPA.

1.4. Customer accepts this DPA when it accepts the Terms of Service, and no separate signature is needed for this DPA to take effect.

1.5. A Customer that needs a signed copy of this DPA may ask for one at legal@middag.io.

2. Definitions

2.1. “Applicable Data Protection Laws” means all laws and regulations on privacy and the protection of personal data that apply to the processing of Customer Personal Data under the Agreement, including, where they apply, the GDPR and US State Privacy Laws.

2.2. “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation).

2.3. “US State Privacy Laws” means the comprehensive consumer privacy laws of the states of the United States, with their regulations, as amended from time to time.

2.4. “Customer Personal Data” means personal data that Customer, or its users, submit to the Services and that MIDDAG processes on behalf of Customer.

2.5. “Standard Contractual Clauses” means the standard contractual clauses for the transfer of personal data to third countries approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

2.6. “Subprocessor” means a third party that MIDDAG engages to process Customer Personal Data.

2.7. “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by MIDDAG or its Subprocessors.

2.8. “Controller”, “processor”, “data subject”, “personal data”, “processing”, “business”, “service provider”, “contractor”, “sell” and “share” have the meanings given to them in Applicable Data Protection Laws, and personal data includes personal information as defined in those laws.

2.9. Other capitalized terms not defined here have the meanings given to them in the Terms of Service.

3. Roles of the parties

3.1. Customer is the controller of Customer Personal Data, or a processor acting on behalf of its own controllers, and MIDDAG is a processor of Customer Personal Data.

3.2. Under US State Privacy Laws, Customer is a business and MIDDAG is a service provider or contractor.

3.3. When Customer acts as a processor on behalf of its own controllers, Customer warrants that its instructions to MIDDAG, including the engagement of Subprocessors, are authorized by those controllers.

3.4. Each party complies with the obligations that Applicable Data Protection Laws place on it.

3.5. Customer is responsible for the lawfulness of the collection of Customer Personal Data, for the accuracy of that data and for the legal basis of its processing, including any notice and consent that Applicable Data Protection Laws require.

3.6. MIDDAG processes personal data about Customer’s account, billing and business contacts as a controller, under the Privacy Policy, and that processing is outside this DPA.

4. Processing instructions

4.1. MIDDAG processes Customer Personal Data only on the documented instructions of Customer, unless a law to which MIDDAG is subject requires otherwise, in which case MIDDAG informs Customer of that legal requirement before processing, unless that law prohibits it.

4.2. The Agreement, this DPA and Customer’s use and configuration of the Services are Customer’s complete instructions at the time of acceptance.

4.3. Additional or changed instructions must be in writing, be consistent with the Agreement and be agreed by MIDDAG, and any extra cost of following them is charged as agreed between the parties.

4.4. MIDDAG informs Customer without undue delay if, in its opinion, an instruction infringes Applicable Data Protection Laws, and MIDDAG may suspend the processing affected by that instruction until Customer confirms or changes it.

4.5. Annex 1 describes the subject matter, nature, purpose and duration of the processing and the categories of data subjects and of personal data.

5. US State Privacy Laws

5.1. MIDDAG does not sell or share Customer Personal Data.

5.2. MIDDAG does not retain, use or disclose Customer Personal Data for any purpose other than the business purposes of providing the Services under the Agreement, including any commercial purpose, unless US State Privacy Laws allow it.

5.3. MIDDAG does not retain, use or disclose Customer Personal Data outside the direct business relationship between Customer and MIDDAG.

5.4. MIDDAG does not combine Customer Personal Data with personal data that it receives from or on behalf of another person, or that it collects from its own interactions with data subjects, unless US State Privacy Laws allow it.

5.5. MIDDAG provides the same level of privacy protection to Customer Personal Data that US State Privacy Laws require of Customer.

5.6. MIDDAG notifies Customer if it determines that it can no longer meet its obligations under US State Privacy Laws.

5.7. Customer may, on notice, take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data by MIDDAG.

5.8. MIDDAG certifies that it understands and will comply with the restrictions in this section.

6. Confidentiality and personnel

6.1. MIDDAG ensures that the persons it authorizes to process Customer Personal Data are bound by confidentiality obligations or are under an appropriate statutory duty of confidentiality.

6.2. MIDDAG limits access to Customer Personal Data to the persons who need it to provide, support and secure the Services.

7. Security

7.1. MIDDAG implements and maintains appropriate technical and organizational measures to protect Customer Personal Data against Personal Data Breaches, as described in Annex 2.

7.2. MIDDAG may update the measures of Annex 2 as technology and the Services evolve, provided that an update does not reduce the overall level of protection of Customer Personal Data.

7.3. Customer is responsible for the security of its accounts, credentials and configuration of the Services, and for the measures under its control described in the documentation of the Services.

8. Subprocessors

8.1. Customer gives MIDDAG a general authorization to engage Subprocessors to process Customer Personal Data.

8.2. The current Subprocessors are listed on the Subprocessors page, which forms part of this DPA.

8.3. MIDDAG engages each Subprocessor by a written agreement that imposes data protection obligations no less protective of Customer Personal Data than those in this DPA, to the extent applicable to the nature of the services that Subprocessor provides.

8.4. MIDDAG remains responsible to Customer for the performance of each Subprocessor’s data protection obligations, as Applicable Data Protection Laws require.

8.5. MIDDAG gives notice of a new or replaced Subprocessor 30 days before the effective date of the change.

8.6. MIDDAG gives that notice by e-mail sent through the MIDDAG Account to the account holder of Customer, and publishes the change on the Updates page.

8.7. Customer may object to a new or replaced Subprocessor on reasonable grounds related to the protection of personal data, by written notice to privacy@middag.io or through the form of the MIDDAG Account, received before the effective date of the change.

8.8. An objection received after the effective date of the change has no effect, and the absence of a timely objection is acceptance of the change.

8.9. On a timely objection, MIDDAG will discuss the objection with Customer in good faith and will offer, where reasonably possible, an alternative, such as a change in the configuration of the Services or in the use of the Services that avoids processing of Customer Personal Data by the objected Subprocessor.

8.10. If the parties do not reach a solution, Customer’s sole and exclusive remedy is to cancel the Services affected by the change, with effect at the end of the period already paid, without refund.

8.11. MIDDAG is not obliged to stop using a Subprocessor because of an objection.

8.12. When the change of a Subprocessor is required by law or by an authority, or is needed for the security of the Services, MIDDAG may make the change with notice as soon as possible, without the notice period of clause 8.5.

9. International transfers

9.1. MIDDAG is established in the United States, and Customer Personal Data may be processed in the United States and in the other locations shown on the Subprocessors page.

9.2. When Customer Personal Data subject to the GDPR is transferred to MIDDAG in a country that is not subject to an adequacy decision, the parties agree to the Standard Contractual Clauses, which are incorporated into this DPA by reference.

9.3. Module Two (controller to processor) applies when Customer is a controller, and Module Three (processor to processor) applies when Customer is a processor.

9.4. Customer is the data exporter, and MIDDAG is the data importer.

9.5. In Clause 7, the optional docking clause does not apply.

9.6. In Clause 9, option 2 (general written authorization) applies, and the time period for prior notice of changes of sub-processors is the period of clause 8.5 of this DPA.

9.7. In Clause 11, the optional language does not apply.

9.8. In Clause 13, the competent supervisory authority is determined as that clause provides for the situation of the data exporter.

9.9. In Clause 17, option 1 applies, and the Standard Contractual Clauses are governed by the law of Ireland.

9.10. In Clause 18, disputes are resolved before the courts of Ireland.

9.11. Annex I.A (list of parties) of the Standard Contractual Clauses is completed with the details of Customer and MIDDAG given in the Agreement, with Customer’s acceptance of the Agreement as its signature and MIDDAG’s publication of this DPA as its signature.

9.12. Annex I.B (description of transfer) is completed with Annex 1 of this DPA, Annex II (technical and organizational measures) with Annex 2 of this DPA, and Annex III (list of sub-processors) with the Subprocessors page.

9.13. If there is a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses prevail.

9.14. MIDDAG puts in place, with each Subprocessor that receives Customer Personal Data subject to the GDPR in a country that is not subject to an adequacy decision, a transfer mechanism recognized by the GDPR.

10. Assistance to Customer

10.1. Taking into account the nature of the processing, MIDDAG assists Customer, by appropriate technical and organizational measures, insofar as possible, in responding to requests of data subjects to exercise their rights under Applicable Data Protection Laws.

10.2. If MIDDAG receives a request from a data subject about Customer Personal Data, MIDDAG forwards the request to Customer without undue delay and does not respond to it, other than to tell the data subject to contact Customer, unless Customer authorizes MIDDAG to respond or the law requires it.

10.3. Taking into account the nature of the processing and the information available to MIDDAG, MIDDAG gives Customer reasonable assistance with its data protection impact assessments and prior consultations with supervisory authorities, when Applicable Data Protection Laws require them for the processing under this DPA.

10.4. MIDDAG may charge for assistance beyond the features of the Services and the information that MIDDAG makes generally available, unless Applicable Data Protection Laws require MIDDAG to give that assistance without charge.

11. Personal Data Breach

11.1. MIDDAG notifies Customer without undue delay after becoming aware of a Personal Data Breach.

11.2. The notice describes, to the extent the information is available to MIDDAG, the nature of the Personal Data Breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed to address it, and the contact point for more information.

11.3. Where MIDDAG cannot give all the information at the same time, it gives the information in phases without undue further delay.

11.4. MIDDAG takes reasonable steps to contain, investigate and mitigate the effects of a Personal Data Breach.

11.5. MIDDAG sends the notice to the account holder of Customer through the contact details registered in the MIDDAG Account, and Customer keeps those details current.

11.6. MIDDAG’s notice of, or response to, a Personal Data Breach is not an acknowledgement of fault or liability.

11.7. Customer may report a suspected security issue to security@middag.io.

12. Return and deletion

12.1. During the term of the Agreement, Customer may export Customer Personal Data through the features of the Services, or ask MIDDAG for an export at privacy@middag.io.

12.2. Customer instructs MIDDAG to keep Customer Personal Data after the Services are cancelled, including the automatic cancellation of expired Services under the Terms of Service, for the retention period below, so that Customer can reactivate the Services or export its data, and to delete Customer Personal Data at the end of that period.

12.3. The retention period after the Services are cancelled depends on the delivery type of the Service, as in the Terms of Service:

12.4. For Customer Personal Data, deletion at the end of the retention period applies to every delivery type, including those for which the Terms of Service provide for archiving at the end of retention.

12.5. Customer may ask in writing, at privacy@middag.io, for the deletion of Customer Personal Data before the end of the retention period, and MIDDAG deletes it within a reasonable time after the request.

12.6. MIDDAG may keep Customer Personal Data after the retention period only to the extent and for the period that a law to which MIDDAG is subject requires, and MIDDAG keeps that data confidential and processes it only for the purpose that law requires.

12.7. Customer Personal Data in backups is deleted as the backups expire in their normal cycle, and is protected under this DPA until then.

13. Audits and information

13.1. MIDDAG makes available to Customer, on request, the information necessary to demonstrate compliance with this DPA and with Article 28 of the GDPR, where it applies.

13.2. Customer first relies on the documentation, security information and summaries of reviews that MIDDAG makes available.

13.3. Where that information is not enough to demonstrate compliance, or where a supervisory authority requires it, MIDDAG allows for and contributes to audits, including inspections, by Customer or by an independent auditor mandated by Customer.

13.4. An audit takes place on reasonable prior written notice, at a date and with a scope agreed in advance, during business hours, without access to the data of other customers, under confidentiality obligations and in a way that does not disrupt the Services or put their security at risk.

13.5. Customer bears its own costs of an audit, and pays MIDDAG’s reasonable costs of supporting an audit beyond the information of clause 13.1, unless the audit reveals a material breach of this DPA by MIDDAG.

14. Liability

14.1. Each party’s liability arising out of or related to this DPA is subject to the limitations and exclusions of liability of the Terms of Service, to the extent Applicable Data Protection Laws allow.

14.2. Nothing in this DPA limits the rights of data subjects under the Standard Contractual Clauses or under Applicable Data Protection Laws.

15. Term, changes and precedence

15.1. This DPA stays in force as long as MIDDAG processes Customer Personal Data on behalf of Customer.

15.2. MIDDAG changes this DPA under the change rules of the Terms of Service, with notice 30 days before the effective date.

15.3. A change required by Applicable Data Protection Laws or by an authority, including the adoption of new or updated standard contractual clauses, takes effect for all Customers on its effective date, with notice as soon as possible.

15.4. On matters of data protection, this DPA prevails over the other parts of the Agreement.

15.5. If a provision of this DPA is held invalid, the rest of this DPA stays in force.

16. Governing law and disputes

16.1. Except as clause 9 provides for the Standard Contractual Clauses, this DPA is governed by the governing law of the Terms of Service, the law of the State of Delaware.

16.2. Except as clause 9 provides for the Standard Contractual Clauses, disputes arising out of or related to this DPA are resolved under the dispute resolution clause of the Terms of Service, first by the prior negotiation it describes and then before the courts of the State of Delaware, without arbitration.

17. Contact

17.1. Questions about this DPA and about the processing of Customer Personal Data: privacy@middag.io.

17.2. Legal notices: legal@middag.io, as described in the Terms of Service.

17.3. Security reports: security@middag.io.

Annex 1: Description of the processing

Subject matter. The processing of Customer Personal Data needed to provide the Services under the Agreement.

Duration. The term of the Agreement, plus the retention period of clause 12 and any period that the law requires.

Nature of the processing. Hosting, storage, backup, transmission, retrieval, organization, support, maintenance, monitoring, error tracking, security and deletion of Customer Personal Data, as needed to provide the Services.

Purpose. To provide, support, secure and maintain the Services for Customer, under the Agreement and Customer’s instructions.

Categories of data subjects. As determined by Customer’s use of the Services, which may include Customer’s personnel, users of the platforms that MIDDAG operates for Customer (such as learners and teachers) and visitors of Customer’s websites hosted by MIDDAG.

Categories of personal data. As determined by Customer’s use of the Services, which may include direct identifiers (such as name and user name), contact details (such as e-mail address), network identifiers (such as IP address and device data), learning records (such as enrollments, progress and grades) and free text that users enter.

Special categories of personal data. None intended. Customer does not submit special categories of personal data, or personal data relating to criminal convictions and offences, to the Services unless the parties agree it in writing and agree the additional safeguards needed.

Frequency of the transfer. Continuous, for the term of the Agreement.

Retention. As described in clause 12.

Transfers to Subprocessors. For the subject matter, nature and duration described in this Annex, and for the purposes shown on the Subprocessors page.

Annex 2: Technical and organizational security measures

MIDDAG maintains the measures below for the Services. The Security page describes how to report a vulnerability.

Governance. MIDDAG keeps written security and privacy policies, assigns the responsibility for information security and for personal data to named roles, and reviews those policies on a set schedule.

Access control. Access to systems that process Customer Personal Data is granted by role and on a need-to-know basis, uses individual accounts, and is reviewed periodically; administrative access is limited to a small number of persons and reviewed separately.

Authentication and secrets. Access to the systems of the Services requires authentication, credentials and secrets are kept in a dedicated secret store, and secrets are rotated on a set schedule.

Encryption. Customer Personal Data is encrypted in transit over public networks and encrypted at rest with encryption managed by the hosting provider.

Network security. Administrative interfaces are not exposed to the public internet, and inbound traffic reaches the Services only through approved entry points.

Logging and monitoring. Security-relevant events are logged, the logs are protected against change and kept for a set period, and alerts are handled by on-call personnel.

Vulnerability management. MIDDAG monitors security advisories for the software it uses and fixes vulnerabilities within time limits set by their severity.

Secure development. Changes to the Services go through version control, review and automated checks before release.

Backups and continuity. Customer Personal Data in the managed environments is backed up on a regular schedule, backups are encrypted, restores are tested periodically, and MIDDAG keeps a continuity plan.

Incident response. MIDDAG keeps an incident response plan that covers Personal Data Breaches, exercises it periodically and reviews incidents after they are closed.

Personnel. Persons with access to Customer Personal Data are bound by confidentiality and receive security and privacy training when they start and periodically after that.

Devices. Devices used to access the Services are protected by screen lock and kept up to date, and removable media is used only for encrypted backups.

Subprocessors. MIDDAG reviews its Subprocessors before engaging them and periodically after that, and binds them by written agreements under clause 8.

Data minimization in telemetry. Error and monitoring events sent to Subprocessors are masked to limit the personal data they carry.

Annex 3: Subprocessors

The list of Subprocessors is on the Subprocessors page.

Changelog

• 1.0.0 — 2026-11-01 — First version of the Data Processing Addendum of MIDDAG, LLC.