Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the services agreement between ScholarSurge Media Inc., 202-15388 24th Avenue, Surrey, BC V4A 2J2, Canada ("Processor") and the school, college, university or academy using our services ("Controller").

It applies when ScholarSurge processes personal data on the Controller's behalf that is subject to the EU GDPR or UK GDPR.

• Subject matter: enrollment marketing, lead capture, follow-up and booking of admissions calls.
• Duration: the term of the services agreement, plus deletion or return as set out below.
• Data subjects: prospective families, parents, guardians and students who enquire with the Controller.
• Personal data: names, email addresses, phone numbers, enquiry and form answers, booking details, and ad interaction data.
• Special categories: none are intended. The Controller will not instruct us to collect them.

• Process personal data only on the Controller's documented instructions.
• Ensure everyone with access is bound by confidentiality.
• Apply appropriate technical and organisational security measures, including access controls, encryption in transit and least-privilege access.
• Notify the Controller without undue delay, and within 72 hours, of becoming aware of a personal data breach.
• Help the Controller respond to data subject requests and with impact assessments where required.
• Make available the information needed to demonstrate compliance and allow reasonable audits.

The Controller authorises the sub-processors below. We will give at least 30 days' notice of any new sub-processor, during which the Controller may object. Each sub-processor is bound by data protection terms no less protective than this DPA.

ScholarSurge is located in Canada, which the European Commission recognises as providing adequate protection. Onward transfers to sub-processors in the United States rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable).

At the end of the services, ScholarSurge will, at the Controller's choice, return or delete all personal data within 30 days, unless law requires us to keep it.

This DPA is signed together with the services agreement. To request a countersigned copy or ask a question, email privacy@scholarsurge.co.