Data Processing Addendum

"Customer Personal Data" means personal data contained in Customer Data that WingBook™ processes on Customer's behalf.

"Data Protection Law" means applicable privacy, data-protection, breach-notification, and consumer-data laws governing the processing covered by this DPA.

"Security Incident" means unauthorized acquisition of or access to Customer Personal Data that triggers notice or assistance obligations under applicable law or this DPA.

"Subprocessor" means a third party engaged by WingBook™ to process Customer Personal Data on WingBook™'s behalf.

For Customer Personal Data processed pursuant to Customer's instructions:

• Customer acts as the controller or party determining the purpose and means of processing; and
• WingBook™ acts as Customer's processor or service provider.

WingBook™ may separately act for its own business purposes regarding information such as subscription administration, business account records, security information, product telemetry, and support information as described in WingBook™'s Privacy Policy.

Customer instructs WingBook™ to process Customer Personal Data as reasonably necessary to:

• host Customer Data;
• provide WingBook™ functionality;
• authenticate users;
• administer permissions;
• operate scheduling and childcare-management workflows;
• process enabled documents;
• provide enabled health and safety functions;
• support Authorized Users;
• maintain and secure the Services;
• troubleshoot issues;
• provide customer support;
• perform Customer-configured integrations; and
• perform other documented instructions consistent with the parties' agreement.

WingBook™ will not process Customer Personal Data outside Customer's documented instructions except where permitted or required by applicable law.

Processing may include:

• collection;
• storage;
• organization;
• retrieval;
• display;
• transmission;
• analysis;
• document extraction;
• modification;
• reporting;
• support access;
• deletion; and
• other operations necessary to provide the Services.

The purpose of processing is to provide, maintain, secure, support, and improve the WingBook™ Services in accordance with the parties' agreement and applicable law.

Processing will continue for the duration of Customer's use of WingBook™ and for a limited period afterward as necessary to:

• permit export;
• complete deletion procedures;
• comply with law;
• maintain required business records;
• address security matters;
• resolve disputes; or
• establish or defend legal claims.

Customer Personal Data may concern:

• children;
• parents;
• guardians;
• emergency contacts;
• authorized pickup persons;
• provider owners;
• directors;
• administrators;
• teachers;
• employees;
• contractors; and
• other persons whose information Customer lawfully processes through WingBook™.

Depending on the Services used, Customer Personal Data may include:

• names;
• contact information;
• dates of birth;
• family relationships;
• account information;
• schedules;
• bookings;
• attendance;
• emergency contacts;
• authorized pickups;
• health information;
• allergies;
• medication information;
• immunization information;
• health assessments;
• treatment plans;
• uploaded documents;
• classroom observations;
• developmental observations;
• progress reports;
• employee information;
• communications;
• technical identifiers; and
• other childcare-related information submitted by Customer.

Customer is responsible for:

• determining whether it may lawfully process information through WingBook™;
• providing required privacy notices;
• obtaining required parental, guardian, employee, or other permissions;
• determining what information should be uploaded;
• assigning appropriate user permissions;
• maintaining legally required childcare records;
• responding to individuals whose rights Customer controls; and
• complying with applicable childcare and privacy requirements.

WingBook™ will ensure that persons authorized to process Customer Personal Data are subject to appropriate confidentiality obligations.

Access will be limited to persons with a legitimate need to perform their responsibilities.

WingBook™ will maintain reasonable administrative, technical, and organizational safeguards appropriate to:

• the nature of Customer Personal Data;
• the sensitivity of the information;
• WingBook™'s size and resources; and
• reasonably foreseeable risks.

Safeguards may include:

• authentication;
• role-based access controls;
• encrypted network connections;
• infrastructure encryption;
• restricted administrative access;
• audit logging;
• technical monitoring; and
• logical separation of Customer access.

No electronic service can guarantee absolute security.

Customer acknowledges that WingBook™ may process information concerning children and health-related information where Customer enables applicable features.

WingBook™ will not:

• sell identifiable child Customer Personal Data;
• use identifiable child health information for advertising;
• use identifiable Customer Personal Data for unrelated cross-customer marketing; or
• disclose sensitive Customer Personal Data except as permitted by Customer instructions, applicable law, or the parties' agreement.

Applicable law may permit WingBook™ to conduct proportionate internal research and product improvement while remaining a processor for such activity.

WingBook™ may use Customer Personal Data internally for development, testing, repair, security, and service improvement only to the extent reasonably necessary, proportionate, and legally permitted.

WingBook™ will use de-identified or aggregated information where reasonably practicable.

Taking into account the nature of processing, WingBook™ will reasonably assist Customer with legally required requests concerning:

• access;
• correction;
• deletion;
• portability;
• consent; and
• applicable opt-out rights.

If an individual contacts WingBook™ directly concerning provider-controlled information, WingBook™ may refer the individual to Customer.

WingBook™ will not independently delete Customer-controlled records where doing so would conflict with Customer's lawful instructions or legal obligations.

Taking into account the nature of the processing and information available to WingBook™, WingBook™ will provide information reasonably necessary to assist Customer in conducting legally required data protection assessments concerning use of WingBook™.

WingBook™ will notify Customer without unreasonable delay after WingBook™ discovers a Security Incident involving Customer Personal Data.

Where New Hampshire law or another applicable law requires more immediate notice, WingBook™ will provide notice consistent with that requirement.

WingBook™ will reasonably cooperate with Customer and provide available information concerning:

• the nature of the incident;
• categories of information affected;
• available information concerning affected individuals;
• remediation measures; and
• information reasonably necessary for Customer's legally required response.

Notification is not an admission of liability.

Customer generally authorizes WingBook™ to engage Subprocessors necessary to provide the Services.

WingBook™ will maintain a current Subprocessor list.

Before a new material Subprocessor is permitted to process Customer Personal Data, WingBook™ will:

• enter into a written agreement requiring appropriate data-protection obligations; and
• provide Customer a reasonable opportunity to object based on legitimate data-protection concerns.

Customer should submit an objection promptly after receiving or becoming aware of notice.

The parties will attempt in good faith to resolve a reasonable objection.

If WingBook™ cannot reasonably address the objection, Customer may terminate the materially affected Service and WingBook™ will refund any unused prepaid amount attributable solely to the terminated portion.

WingBook™ remains responsible for its obligations under this DPA when a Subprocessor processes Customer Personal Data on WingBook™'s behalf, subject to applicable law and the parties' agreed limitations of liability.

Upon reasonable request, WingBook™ will provide information in its possession reasonably necessary to demonstrate compliance with this DPA.

Customer may request a reasonable assessment of WingBook™'s relevant privacy and security controls.

Unless a Security Incident, regulator, or material compliance concern reasonably requires otherwise:

• assessments should not occur more than once in a 12-month period;
• assessments must avoid unreasonable disruption;
• Customer must protect WingBook™ Confidential Information; and
• Customer should use existing independent reports or documentation where reasonably sufficient.

WingBook™ may satisfy this obligation by providing a report prepared by a qualified independent assessor when such a report becomes available.

At Customer's direction at the end of the Services, WingBook™ will reasonably return or delete Customer Personal Data unless retention is required by law.

Absent a different written arrangement, Customer may request export for up to 60 days following termination or expiration.

Customer is responsible for exporting records it must maintain under childcare or other laws.

After the applicable export period, WingBook™ may delete or de-identify Customer Personal Data.

Residual information may remain temporarily in technical backups or systems until overwritten through normal deletion cycles, provided it remains protected and is not used for unrelated purposes.

Nothing in this DPA prevents WingBook™ from retaining and using information that has been properly de-identified so it is no longer reasonably associated with an identifiable individual.

WingBook™ will maintain de-identified information in accordance with applicable law.

When Customer enables AI-assisted functionality that requires Customer Personal Data, applicable AI providers may act as Subprocessors.

WingBook™ will use AI providers under arrangements intended to restrict use of Customer Data to provision of the applicable service.

WingBook™ currently does not opt Customer Data into training of general-purpose OpenAI models.

AI provider retention practices may vary depending on the API and configuration being used.

WingBook™ currently operates using United States-based technology infrastructure and service providers.

WingBook™ may modify infrastructure and service providers as the Services evolve, subject to applicable law and contractual obligations.

If this DPA conflicts with the WingBook™ Terms concerning processing of Customer Personal Data on Customer's behalf, this DPA controls.

This DPA remains effective while WingBook™ processes Customer Personal Data on behalf of Customer.