Data Processing Addendum

"Personal Data" means information within Customer Data that identifies or is reasonably capable of being associated with an individual, including education records under FERPA.

"Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.

"Security Incident" means a confirmed unauthorized acquisition, access, use, or disclosure of Personal Data in Salus's possession.

"Subprocessor" means a third party engaged by Salus that Processes Personal Data on Salus's behalf.

"Privacy Laws" means the privacy and data protection laws applicable to Customer's use of the Services, including FERPA, applicable state student privacy laws, and applicable state consumer privacy statutes.

Customer determines the purposes and means of Processing Personal Data through the Services. Salus Processes Personal Data only on Customer's documented instructions.

Under FERPA, Customer designates Salus as a school official with a legitimate educational interest in the education records Salus Processes. Salus performs an institutional service for which Customer would otherwise use its own employees, remains under Customer's direct control with respect to the use and maintenance of those records, and will not redisclose them except as Customer directs or as required by law.

Under applicable state consumer privacy statutes, Salus acts as a service provider or processor. Salus will not sell Personal Data, will not share it for cross context behavioral advertising, will not retain, use, or disclose it for any purpose other than performing the Services or as otherwise permitted by law, and will not combine it with personal information Salus receives from another source except as permitted for a service provider.

Customer is responsible for providing any notice and obtaining any consent required for Salus to Process Personal Data, and for the accuracy and legality of the Personal Data it provides.

Salus Processes Personal Data to provide, maintain, secure, troubleshoot, and support the Services, and for no other purpose. This includes ingesting records from Source Systems, producing analyses and Outputs for Customer's review, maintaining the audit trail, publishing records Customer approves for publication, sending communications Customer configures, and responding to Customer's support requests.

Salus does not use Personal Data to train or fine tune foundation models, and does not use Personal Data to create or improve a model made available to any other customer. Salus's Subprocessors are contractually prohibited from doing so.

Configuration derived from Customer's own review decisions, such as institution specific classification guidance, is stored as data within Customer's environment and applied only to Customer.

Salus may generate aggregated and de-identified data about use of the Services and may use it to operate, secure, and improve the Services. Aggregated and de-identified data contains no Personal Data and may not be used in a way that identifies Customer, an Authorized User, or any individual, and Salus will not attempt to re-identify it.

Annex A describes the subject matter, duration, nature, categories of data subjects, and types of Personal Data Processed.

Salus limits access to Personal Data to personnel who require it to perform the Services, including support and troubleshooting, and who are bound by written confidentiality obligations.

Salus maintains role based access controls for its own personnel, reviews access periodically, revokes it promptly on role change or departure, and logs access to Customer environments.

Salus personnel receive security and privacy training at onboarding and on a recurring basis.

Salus maintains the technical and organizational measures described in Annex B, which are designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure or access. Salus will not materially reduce those measures during a subscription term.

Salus assesses its security program on an ongoing basis and engages independent third parties to test the Services.

Customer authorizes Salus to engage the Subprocessors listed in Annex C, and to engage additional Subprocessors in accordance with this Section.

Salus performs diligence on each Subprocessor before engagement and imposes data protection obligations no less protective than those in this DPA. Salus remains responsible for its Subprocessors' performance.

Salus will give Customer at least thirty days notice before adding or replacing a Subprocessor that Processes Personal Data. Customer may object on reasonable data protection grounds within that period, and the parties will work in good faith to resolve the objection. If they cannot, Customer may terminate the affected Order Form with a pro rata refund of prepaid, unused fees.

Customer administers requests from individuals to access, correct, delete, or restrict Personal Data. The Services provide functionality for Customer to locate, export, correct, and delete records.

If Salus receives a request directly from an individual, it will not respond substantively and will refer the individual to Customer, notifying Customer promptly unless prohibited by law.

Salus will provide reasonable assistance, at Customer's expense where the assistance is substantial, in responding to requests and in conducting a privacy impact assessment relating to the Services.

Salus will notify Customer without undue delay, and in any event within seventy-two hours, after confirming a Security Incident affecting Customer's Personal Data.

The notice will describe the nature of the incident, the categories and approximate volume of Personal Data involved, the likely consequences, and the measures taken or proposed, to the extent known. Salus will provide updates as the investigation progresses and will not delay notice to complete its investigation.

Salus will take reasonable steps to contain and remediate the incident and will provide the information Customer reasonably requires to meet its own notification obligations. Salus will not notify a regulator or affected individual on Customer's behalf without Customer's prior written direction, except where Salus is independently required to do so.

If Salus receives a subpoena, warrant, or other legal demand for Customer's Personal Data, it will, unless legally prohibited, notify Customer promptly, provide the information Customer needs to seek protective treatment, and disclose only what the demand requires.

Salus does not provide Personal Data to law enforcement voluntarily or absent valid legal process, except at Customer's direction.

Salus retains Personal Data for the subscription term and as instructed by Customer. Records subject to the Clery Act generally must be retained for seven years, and Customer determines the retention period that applies to its records.

On expiration or termination, Customer may export Personal Data through the Services for at least thirty days. After that period, Salus will delete Personal Data from its systems and from backups in accordance with its documented procedures and backup cycle, unless retention is required by law or Customer instructs otherwise in writing.

Salus will confirm deletion in writing on request.

On request, and no more than once per year unless required by a regulator or following a Security Incident, Salus will provide its current SOC 2 report, its completed HECVAT, a summary of its most recent penetration test, and reasonable responses to Customer's security and privacy questionnaires.

If those materials are not sufficient for Customer to verify compliance with this DPA, the parties will agree on the scope, timing, and cost of a further assessment, conducted on reasonable notice, during business hours, subject to confidentiality, and without access to other customers' data or to Salus systems in a manner that would compromise security.

Salus Processes and stores Personal Data in the United States. Salus will not transfer Personal Data outside the United States without Customer's prior written consent.

If Customer requires Salus to Process personal data subject to the GDPR or a comparable non-United States law, the parties will execute an appropriate transfer mechanism, including standard contractual clauses, before that Processing begins.

Criminal justice information subject to the FBI CJIS Security Policy, including criminal history record information and query returns from state or federal criminal justice systems, is outside the scope of this DPA unless the parties have executed a CJIS Security Addendum and configured the Services accordingly.

Customer will notify Salus before directing the Services to ingest such information, and will notify Salus if a connected Source System begins to carry it, so that the parties can put the appropriate agreement and configuration in place.

This DPA takes effect with the Platform Agreement and continues for as long as Salus Processes Personal Data. Sections that by their nature should survive do so.

Liability under this DPA is subject to the limitations in the Platform Agreement, including the enhanced cap that applies to a Security Incident caused by Salus's failure to meet its security obligations.

Where Customer is a public institution required by law or institutional policy to apply different terms on a matter addressed here, those terms control to the extent of the conflict.