MUUD Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between MUUD SpA, Chilean tax ID (RUT) 77.634.166-5, Av. Presidente Kennedy 5600, Of. 507, Vitacura, Santiago, Chile, or, for customers in the United States, MUUD Inc. under Section 1.4 ("MUUD"), and the Institutional Customer (the "Customer") for the provision of the MUUD Services. The Customer accepts this DPA by signing an Order that references it or by accepting the MUUD Terms of Service. On request, MUUD will provide a countersigned copy.

1. Scope and Precedence

1.1 This DPA applies to all Customer Personal Data that MUUD processes on behalf of the Customer in providing the Services, for as long as MUUD processes it.

1.2 In case of conflict, the following order applies: (a) the Standard Contractual Clauses and the other transfer instruments in Section 8, for the matters they govern; (b) a data processing agreement or data annex signed by MUUD and the Customer, including the data annex of MUUD's standard contract for schools in Chile; (c) this DPA; (d) the Order; and (e) the Terms of Service.

1.3 This DPA does not apply to protected health information processed for healthcare providers in the United States, which is governed by a separate Business Associate Agreement.

1.4 Customers in the United States. For Orders with Institutional Customers in the United States, the processor and party to this DPA is MUUD Inc., a Delaware corporation wholly owned by MUUD SpA, and references to "MUUD" refer to MUUD Inc. MUUD SpA operates and supports the Services on behalf of MUUD Inc. as a Subprocessor listed in Annex III, under a written intercompany data processing agreement no less protective than this DPA, and MUUD Inc. remains fully liable to the Customer for MUUD SpA's performance.

2. Definitions

Terms not defined here have the meaning given in the MUUD Terms of Service (https://muud.app/terminos-y-condiciones) or in the Applicable Data Protection Laws.

"Customer Personal Data" means personal data within the Customer Data, including Student Data, that MUUD processes on behalf of the Customer.

"Controller", "processor", "data subject", "personal data breach" and "processing" have the meanings given in the GDPR, and include the equivalent concepts in other Applicable Data Protection Laws ("responsable" and "encargado" in Chile, Spain and Mexico; "controlador" and "operador" in Brazil; the educational agency or institution and the "school official" under FERPA).

"Subprocessor" means a third party engaged by MUUD that processes Customer Personal Data.

"Privacy Policy" means MUUD's Privacy Policy published at https://muud.app/politica-de-privacidad.

"Standard Contractual Clauses" or "SCCs" means the clauses approved by European Commission Implementing Decision (EU) 2021/914.

3. Roles and Instructions

3.1 The Customer is the controller and MUUD is the processor of Customer Personal Data. MUUD is an independent controller only for the data described as such in the Privacy Policy (customer contacts, billing, security and website data).

3.2 MUUD processes Customer Personal Data only on the Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by applicable law; in that case MUUD will inform the Customer before processing, unless the law prohibits it. The Customer's instructions are this DPA, the Order, the configuration the Customer chooses in the Services, and any further written instruction consistent with them.

3.3 MUUD will inform the Customer immediately if, in its opinion, an instruction infringes Applicable Data Protection Laws, and may suspend the affected processing until the instruction is confirmed or modified.

3.4 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex I.

4. Customer Obligations

4.1 The Customer is responsible for the lawfulness of the processing it instructs, including establishing a legal basis for each purpose, and, for sensitive data, a valid exception or condition under Applicable Data Protection Laws.

4.2 The Customer provides data subjects, and the parents or guardians of children, with the notices required by law, using where useful the template notices MUUD provides, and obtains, records and keeps any required consents or authorizations.

4.3 Student onboarding. Where students register with a course code, the App asks for the student's express consent to the processing of sensitive data before the first check-in; this consent complements, but does not replace, the consent of parents or guardians that the law requires for children below the applicable age, which the Customer obtains. Where the Customer creates accounts by bulk provisioning, the Customer verifies that the required consents have been obtained before sending the roster to MUUD, and makes the MUUD Terms of Service and Privacy Policy available to the users it provisions, and to the parents or guardians of students, before their first use of the Services.

4.4 The Customer designates the staff who may view indicators and alerts in the Services, keeps its user list up to date, and follows up alerts through its own qualified personnel and protocols.

4.5 The Customer does not upload to the Services data that is not necessary for the Services, such as health records, disciplinary files or government identification numbers.

5. MUUD's Commitments on Use of Data

5.1 MUUD processes Customer Personal Data only to provide, maintain, secure and support the Services for the Customer. MUUD does not: (a) sell, rent or trade it; (b) use it for advertising, marketing or behavioral targeting; (c) build profiles of data subjects except as necessary for the Services; (d) use it to train artificial intelligence models, and it contractually prohibits its AI Subprocessors from doing so; or (e) combine it with data from other sources.

5.2 Free text. The content of free-text entries and of conversations with the check-in assistant is never displayed to any user of the Customer. The Customer's designated staff see only the indicators and alerts derived from check-ins and aggregated group reports. Free-text entries and early-alert records are treated as sensitive data under Annex II.

5.3 De-identified data. MUUD may create de-identified and aggregated data from Customer Personal Data to evaluate and improve the Services and to report on wellbeing trends, provided that it cannot reasonably identify any individual or the Customer, that MUUD does not attempt to re-identify it, and that it is never used to train third-party AI models.

5.4 These commitments survive the termination of the agreement and continue to bind any successor of MUUD in a merger, acquisition or sale of assets.

6. Confidentiality and Security

6.1 MUUD grants access to Customer Personal Data only to personnel who need it to perform the Services, who are bound by written confidentiality obligations that survive the end of their engagement, and who receive privacy and security training. Access to student data is limited to a small number of named roles, recorded in MUUD's Records of Processing Activities.

6.2 MUUD implements and maintains the technical and organizational measures in Annex II, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, including the sensitivity of data about children. MUUD may update these measures provided that the overall level of protection is not reduced.

7. Subprocessors

7.1 General authorization. The Customer gives MUUD general authorization to engage Subprocessors. The Subprocessors authorized at the effective date are listed in Annex III, and the current list is published in Section 8 of the Privacy Policy.

7.2 Changes. MUUD will notify the Customer by email of any intended addition or replacement of a Subprocessor at least 30 days in advance. The Customer may object on reasonable data protection grounds within those 30 days. If MUUD cannot accommodate the objection, the Customer may terminate the affected Services without penalty and receive a pro-rata refund of prepaid unused fees. In an emergency affecting the security or continuity of the Services, MUUD may replace a Subprocessor with shorter notice, giving the reasons.

7.3 Flow-down. MUUD engages each Subprocessor under a written contract that imposes data protection obligations no less protective than those in this DPA, and remains fully liable to the Customer for the performance of each Subprocessor's obligations.

7.4 Authorized Distributors. An Authorized Distributor that resells the Services to the Customer does not access Customer Personal Data through the Services unless the Customer authorizes it in writing. In that case the distributor becomes a Subprocessor under this Section 7 before receiving access.

8. International Transfers

8.1 Location. Customer Personal Data is hosted in the United States. MUUD SpA is established in Chile, and its authorized personnel access Customer Personal Data remotely from Chile. MUUD will not transfer Customer Personal Data to any other country without complying with this Section and with Section 7.

8.2 EU/EEA. Where the Customer is subject to the GDPR, the Standard Contractual Clauses, Module Two (controller to processor), are incorporated into this DPA, with the Customer as data exporter and MUUD as data importer, and apply as follows: Clause 7 (docking clause) applies; in Clause 9, Option 2 (general written authorization) applies, with the notice period of Section 7.2; the optional language in Clause 11 does not apply; in Clause 13, the competent supervisory authority is that of the member state where the Customer is established; in Clauses 17 and 18, the governing law and courts are those of the member state where the Customer is established. Annexes I, II and III of this DPA complete the Annexes of the SCCs. MUUD has carried out a transfer impact assessment, which it will provide on request, and uses Module Three of the SCCs, or the EU-U.S. Data Privacy Framework where the Subprocessor is certified, for onward transfers.

8.3 United Kingdom. For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the Information Commissioner under section 119A of the Data Protection Act 2018, is incorporated, with Table 1 completed by the parties' details in this DPA, Table 2 by Section 8.2, Table 3 by Annexes I to III, and, in Table 4, both parties may end the Addendum as set out in its Section 19.

8.4 Switzerland. For transfers subject to the Swiss FADP, the SCCs apply as in Section 8.2 with these amendments: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers governed by the FADP; references to "member state" include Switzerland, so that data subjects in Switzerland can bring claims in their place of habitual residence; and references to the GDPR include the FADP.

8.5 Brazil. For transfers subject to the LGPD, the standard contractual clauses approved by Resolution CD/ANPD No. 19/2024 are incorporated, with the Customer as exporter (controlador) and MUUD as importer (operador), and prevail over this DPA for the matters they govern.

8.6 Chile. For transfers subject to Chilean law, this DPA constitutes the contract that ensures an adequate level of protection, including the obligations of Sections 5 to 13, and from December 1, 2026 it will be applied in accordance with Law No. 21.719 and any model clauses approved by the Agencia de Protección de Datos Personales.

8.7 Mexico. Communications of Customer Personal Data to MUUD and its Subprocessors are remisiones to encargados under the LFPDPPP. MUUD processes the data only under the Customer's instructions and its privacy notice, and does not transfer it to third parties.

9. Data Subject Requests

9.1 If MUUD receives a request from a data subject, a parent or guardian, or MUUD's representative DataRep, concerning Customer Personal Data, MUUD will forward it to the Customer within 5 business days and will not respond directly except to acknowledge receipt and redirect the requester, unless the Customer instructs otherwise.

9.2 Taking into account the nature of the processing, MUUD assists the Customer, through the Services and by appropriate technical and organizational measures, to respond to requests to exercise rights of access, rectification, erasure, restriction, objection, portability and the ARCO rights, within the deadlines of Applicable Data Protection Laws. MUUD carries out deletion or correction instructions within 5 business days, or within the shorter period the Customer requires to meet a legal deadline.

10. Personal Data Breaches

10.1 MUUD notifies the Customer without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting Customer Personal Data, by email to the Customer's designated contact.

10.2 The notice describes, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; and a contact point at MUUD. Information not available at first is provided in phases without undue delay.

10.3 MUUD cooperates with the Customer so that it can meet its obligations to notify supervisory authorities and data subjects, and does not notify them on the Customer's behalf or make public statements naming the Customer without its consent, unless the law requires it.

11. Impact Assessments and Prior Consultation

MUUD provides the Customer with the information reasonably necessary to carry out data protection impact assessments and, where required, prior consultations with supervisory authorities, including a description of the Services, the data flows, the Subprocessors and the security measures, and the results of MUUD's own impact assessment of the Services.

12. Audits

12.1 MUUD makes available to the Customer the information necessary to demonstrate compliance with this DPA, including completed security questionnaires, its policies and, when available, third-party audit reports such as SOC 2 reports, under confidentiality.

12.2 If that information is not sufficient to demonstrate compliance, or if a supervisory authority requires it, the Customer may carry out an audit, by itself or through an independent auditor bound by confidentiality, no more than once a year except after a personal data breach, with at least 30 days' notice, during business hours and without access to other customers' data. Because MUUD operates fully in the cloud, audits are carried out remotely by document review and interviews. The costs of the audit are borne by the Customer.

13. Return and Deletion

13.1 During the subscription, the Customer may request the deletion of any Customer Personal Data, which MUUD carries out under Section 9.2.

13.2 On termination or expiration of the Order, MUUD makes Customer Personal Data available for export in a commonly used, machine-readable format for 60 days, and deletes it from production systems within 90 days of termination, including rosters kept in restricted storage. Backups are overwritten in their ordinary rotation cycle and remain isolated from any active processing until then. MUUD certifies deletion in writing on request.

13.3 MUUD may keep Customer Personal Data after these periods only when the law requires it, in which case this DPA continues to apply to it and it is processed only for that purpose.

14. Jurisdiction-Specific Provisions

14.1 EU/EEA, United Kingdom and Switzerland. Sections 3 to 13 contain the terms required by GDPR Art. 28(3), UK GDPR Art. 28(3) and FADP Art. 9. MUUD's representative under GDPR Art. 27, UK GDPR Art. 27 and FADP Art. 14 is Data Protection Representative Limited (trading as DataRep), 77 Camden Street Lower, Dublin, D02 XE80, Ireland, datarequest@datarep.com. MUUD has not appointed a data protection officer, as recorded in its determination MUUD-PRIV-DET-002, available on request.

14.2 Spain. MUUD acts as encargado del tratamiento under GDPR Art. 28 and LOPDGDD Art. 33. Data of students under 14 is processed only with the consent of those with parental authority or on another legal basis established by the Customer under Spanish education law.

14.3 Brazil. MUUD acts as operador under the LGPD, processes Customer Personal Data according to the Customer's lawful instructions (LGPD Art. 39), and supports the Customer in complying with LGPD Art. 14 and the ECA Digital (Law No. 15.211/2025) with regard to children and adolescents. MUUD has not appointed an encarregado, as recorded in its determination MUUD-PRIV-DET-003, available on request.

14.4 Chile. MUUD acts as encargado del tratamiento under Law No. 19.628 and, from December 1, 2026, Law No. 21.719, and processes Customer Personal Data only under this contract of encargo, with the duties of confidentiality, security and deletion set out in it.

14.5 Mexico. MUUD acts as encargado under the LFPDPPP, processes Customer Personal Data only under the Customer's instructions, keeps it confidential, applies the security measures of Annex II, and deletes it at the end of the relationship under Section 13.

14.6 United States. Where the Customer is an educational agency or institution subject to FERPA, MUUD is a school official with a legitimate educational interest under 34 CFR 99.31(a)(1), under the Customer's direct control regarding the use and maintenance of education records, and does not re-disclose them except as directed by the Customer or permitted by FERPA. For students under 13, the Customer authorizes the collection of personal information under COPPA solely for the use and benefit of the school and for no other commercial purpose. MUUD complies with applicable state student privacy laws, including California's SOPIPA and Education Code Section 49073.1, Illinois' SOPPA and Washington's RCW 28A.604. Where a state law or the Customer requires a specific data privacy agreement, such as the Student Data Privacy Consortium's National Data Privacy Agreement, that agreement prevails over this DPA to the extent of any conflict.

15. Liability, Term and General Terms

15.1 Each party's liability under this DPA is subject to the limitations of the Order and the Terms of Service, except that no limitation applies to the rights of data subjects under the SCCs or other transfer instruments, or where mandatory law prohibits it.

15.2 This DPA remains in force while MUUD processes Customer Personal Data, including after the end of the Order until deletion under Section 13.

15.3 MUUD may update this DPA to reflect changes in law or in the Services, with at least 30 days' notice for material changes, which may not reduce the protection of Customer Personal Data. The Customer may object and terminate as provided in the Terms of Service.

15.4 Except for the matters governed by the SCCs or other transfer instruments, this DPA is governed by the law that governs the Order and, failing that, by the laws of Chile.

Annex I. Description of the Processing

A. Parties

B. Description of the processing

Annex II. Technical and Organizational Security Measures

Annex III. Authorized Subprocessors

Subprocessors authorized at the effective date of this DPA. Later changes are notified under Section 7.2 and reflected in Section 8 of the Privacy Policy, which is the current list.