Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement between FREE MONEY MAVEN LLC, doing business as Free Money Meister (“Free Money Meister,” “Processor,” “we,” “us,” or “our”), and the customer or organization that has entered into an agreement with Free Money Meister for the Services (“Customer” or “Controller”).

This DPA applies to the extent Free Money Meister Processes Personal Data on behalf of Customer in connection with the Services.

WHEREAS:

(A) Customer determines the purposes and means of Processing Customer Personal Data and acts as a Controller with respect to such Personal Data;

(B) Free Money Meister provides the Services to Customer and, to the extent it Processes Customer Personal Data on Customer's behalf, acts as a Processor;

(C) Free Money Meister may engage Subprocessors to Process Customer Personal Data in connection with providing the Services;

(D) The Parties wish to establish their respective rights and obligations concerning the Processing of Customer Personal Data and comply with applicable Data Protection Laws.

IT IS AGREED AS FOLLOWS:

1. Definitions and Interpretation

1.1 “Applicable Data Protection Laws” means all data protection and privacy laws applicable to the Processing of Customer Personal Data under this DPA, including, where applicable, the GDPR, UK GDPR, and applicable U.S. federal and state privacy laws.

1.2 “Customer Personal Data” means Personal Data Processed by Free Money Meister on behalf of Customer in connection with the Services.

1.3 “Controller” means the person or entity that determines the purposes and means of the Processing of Personal Data.

1.4 “Data Subject” means an identified or identifiable individual to whom Personal Data relates.

1.5 “GDPR” means Regulation (EU) 2016/679 (General Data Protection Regulation).

1.6 “Personal Data” means any information relating to an identified or identifiable individual, or otherwise defined as personal data, personal information, or a substantially similar term under Applicable Data Protection Laws.

1.7 “Personal Data Breach” means a breach of security resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.

1.8 “Process,” “Processes,” and “Processing” mean any operation or set of operations performed on Personal Data, whether or not by automated means.

1.9 “Processor” means a person or entity that Processes Personal Data on behalf of a Controller.

1.10 “Services” means the services provided by Free Money Meister to Customer under the applicable agreement between the Parties.

1.11 “Subprocessor” means a third party engaged by Free Money Meister to Process Customer Personal Data on behalf of Customer in connection with the Services.

1.12 “UK GDPR” means the GDPR as incorporated into the laws of the United Kingdom, as amended or replaced from time to time.

Capitalized terms not defined in this DPA will have the meanings given to them in the applicable agreement between Customer and Free Money Meister.

2. Processing of Customer Personal Data

2.1 Free Money Meister will Process Customer Personal Data only:

(a) on Customer's documented instructions;

(b) as necessary to provide the Services;

(c) as described in this DPA and the applicable agreement between the Parties; or

(d) as otherwise required by applicable law.

2.2 If applicable law requires Free Money Meister to Process Customer Personal Data other than on Customer's documented instructions, Free Money Meister will inform Customer of that legal requirement before Processing, unless applicable law prohibits such notice.

2.3 Customer instructs Free Money Meister to Process Customer Personal Data as reasonably necessary to provide, maintain, secure, and support the Services and to perform Free Money Meister's obligations under the applicable agreement.

2.4 Customer is responsible for ensuring that its instructions comply with Applicable Data Protection Laws and that it has all rights, permissions, notices, consents, and other lawful bases necessary to provide Customer Personal Data to Free Money Meister for Processing in accordance with this DPA.

2.5 Free Money Meister will promptly inform Customer if, in its reasonable opinion, an instruction from Customer infringes Applicable Data Protection Laws, unless prohibited from doing so by applicable law.

3. Processor Personnel

Free Money Meister will take reasonable steps to ensure that personnel authorized to Process Customer Personal Data are subject to appropriate confidentiality obligations and are provided access to Customer Personal Data only to the extent reasonably necessary to perform their duties in connection with the Services.

4. Security

4.1 Taking into account the state of the art, costs of implementation, and the nature, scope, context, and purposes of the Processing, as well as the risks to individuals, Free Money Meister will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

4.2 In determining appropriate security measures, Free Money Meister will consider the risks presented by the Processing, including risks arising from a Personal Data Breach.

4.3 Free Money Meister may update its technical and organizational measures from time to time, provided that such updates do not materially reduce the overall level of protection provided to Customer Personal Data.

5. Subprocessors

5.1 Customer provides Free Money Meister with general authorization to engage Subprocessors as necessary to provide the Services.

5.2 Free Money Meister will require each Subprocessor that Processes Customer Personal Data to enter into written obligations that provide an appropriate level of protection for Customer Personal Data consistent with Free Money Meister's obligations under this DPA, to the extent applicable to the services provided by that Subprocessor.

5.3 Free Money Meister remains responsible for the performance of its Subprocessors' data protection obligations to the extent required by Applicable Data Protection Laws.

5.4 Where required by Applicable Data Protection Laws, Free Money Meister will provide Customer with information concerning its Subprocessors and provide notice of intended material changes involving the addition or replacement of Subprocessors.

5.5 Where Applicable Data Protection Laws provide Customer with a right to object to a new Subprocessor, Customer may raise a reasonable objection based on legitimate data protection grounds. The Parties will work in good faith to address the objection.

6. Data Subject Rights

6.1 Taking into account the nature of the Processing, Free Money Meister will provide reasonable assistance to Customer, to the extent required by Applicable Data Protection Laws, in responding to requests from Data Subjects exercising their applicable privacy or data protection rights.

6.2 If Free Money Meister receives a request from a Data Subject relating to Customer Personal Data for which Customer is the Controller, Free Money Meister will, where appropriate:

(a) promptly notify Customer of the request; and

(b) not independently respond to the request except on Customer's documented instructions or as required by applicable law.

6.3 Customer is responsible for responding to Data Subject requests where Customer is the Controller.

7. Personal Data Breach

7.1 Free Money Meister will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

7.2 To the extent reasonably available, the notification will include information sufficient to assist Customer in meeting its applicable obligations regarding breach notification, investigation, and remediation.

7.3 Free Money Meister will take reasonable steps to investigate, mitigate, and remediate a Personal Data Breach within its control and will reasonably cooperate with Customer in connection with Customer's applicable legal obligations.

7.4 Notification of or response to a Personal Data Breach under this Section does not constitute an acknowledgment of fault or liability by Free Money Meister.

8. Data Protection Impact Assessments and Regulatory Consultation
Taking into account the nature of the Processing and information available to Free Money Meister, Free Money Meister will provide reasonable assistance to Customer with data protection impact assessments and consultations with supervisory authorities or other competent privacy regulators where such assistance is required under Applicable Data Protection Laws and relates to Free Money Meister's Processing of Customer Personal Data.

9. Deletion or Return of Customer Personal Data

Upon termination or expiration of the Services involving the Processing of Customer Personal Data, Free Money Meister will, at Customer's request and subject to applicable law, delete or return Customer Personal Data in accordance with the applicable agreement and Free Money Meister's applicable data retention practices.

Free Money Meister may retain Customer Personal Data to the extent required by applicable law or where data remains in secure backup or archival systems, provided that such retained Personal Data remains protected in accordance with this DPA and is not Processed for other purposes except as permitted or required by applicable law.

10. Compliance Information and Audits

10.1 Upon reasonable request, Free Money Meister will make available to Customer information reasonably necessary to demonstrate compliance with its obligations under this DPA and Applicable Data Protection Laws applicable to Free Money Meister's Processing of Customer Personal Data.

10.2 Where required by Applicable Data Protection Laws and where the information provided under Section 10.1 is insufficient to demonstrate compliance, Free Money Meister will allow for and reasonably contribute to an audit concerning its Processing of Customer Personal Data.

10.3 Audits will be subject to reasonable advance notice, confidentiality requirements, and reasonable limitations designed to avoid unnecessary disruption to Free Money Meister's operations or compromise the confidentiality, security, or privacy of other customers or third parties.

11. International Data Transfers

11.1 Free Money Meister and its Subprocessors may Process Customer Personal Data in countries other than the country in which Customer or the relevant Data Subjects are located, subject to Applicable Data Protection Laws.

11.2 Where Customer Personal Data is transferred from the European Economic Area, United Kingdom, Switzerland, or another jurisdiction that restricts international transfers of Personal Data to a country that has not been recognized as providing an adequate level of protection, the Parties will use an applicable lawful transfer mechanism as required by Applicable Data Protection Laws.

11.3 Where applicable, such mechanisms may include approved standard contractual clauses, applicable UK international data transfer mechanisms, adequacy decisions, or another legally recognized transfer mechanism.

11.4 The Parties will cooperate as reasonably necessary to implement any additional safeguards required under Applicable Data Protection Laws in connection with an international transfer of Customer Personal Data.

12. Details of Processing

The Processing of Customer Personal Data under this DPA is described as follows:

Subject Matter: Processing of Customer Personal Data as necessary to provide the Services to Customer.

Duration: For the duration of the applicable agreement and any additional period during which Free Money Meister Processes Customer Personal Data in accordance with the agreement, this DPA, or applicable law.

Nature and Purpose of Processing: Collection, recording, organization, storage, retrieval, consultation, use, transmission, support, security, deletion, and other Processing reasonably necessary to provide and maintain the Services.

Categories of Data Subjects: May include Customer's authorized users, students, learners, participants, employees, contractors, administrators, and other individuals whose Personal Data Customer submits to or makes available through the Services.

Categories of Personal Data: May include identification and contact information, account information, educational or course-related information, usage and activity information, communications, transaction-related information, and other Personal Data submitted by or on behalf of Customer through the Services.

Sensitive or Special Categories of Personal Data: Customer will not provide sensitive or special category Personal Data to Free Money Meister unless such Processing is supported by the Services, permitted under the applicable agreement, and conducted in accordance with Applicable Data Protection Laws.

13. General Terms

13.1 Confidentiality. Each Party will protect confidential information received from the other Party in connection with this DPA and will not use or disclose such information except as necessary to perform its obligations, with the other Party's authorization, or as required by applicable law.

13.2 Conflict. If there is a conflict between this DPA and the applicable agreement between Customer and Free Money Meister regarding the Processing or protection of Customer Personal Data, this DPA will control to the extent of that conflict.

13.3 Entire DPA. Except as modified by this DPA, the applicable agreement between the Parties remains in full force and effect.

13.4 Notices. Notices concerning this DPA will be provided using the contact information specified in the applicable agreement or through another method agreed upon by the Parties.