Data Processing Addendum

Scope and instructions

For customer-controlled personal data, customer acts as controller and J&P Global LLC as processor to the extent legally appropriate. Processing covers identity, class roster, gameplay, messages and assessments, for the contract term and documented deletion period. J&P Global LLC processes only on documented instructions, ensures confidentiality, applies appropriate Article 32 measures, assists with rights requests, DPIAs and breach notifications, and permits reasonable audit evidence.

Subprocessors and transfers

Subprocessors must be contractually bound to equivalent protections; material changes require prior notice and a reasonable objection process. The current subprocessors are listed in the Privacy Policy. EEA/UK transfers require signed SCCs/UK addendum where relevant. At termination, return or delete personal data unless law requires retention. The signed DPA includes the processing schedule, security annex, subprocessor register and transfer annexes.