Controller–Processor
Agreement.

In this DPA the following definitions apply:

This DPA applies to all Personal Data processed by AerEthos (as Processor) on behalf of the school (as Controller) in connection with the provision of yearbook design, production, and Vision platform services, as set out in the school service agreement.

This DPA takes effect on the date the school service agreement is entered into (evidenced by payment of the school onboarding fee and written confirmation from AerEthos) and remains in force until:

• All Personal Data processed under this DPA has been deleted or returned to the Controller in accordance with §13; or
• The parties agree in writing that this DPA has terminated.

The obligations in this DPA survive termination of the service agreement to the extent that AerEthos continues to process or retain Personal Data belonging to the Controller.

The parties acknowledge and agree that in relation to Personal Data processed under this DPA:

• The school acts as Controller and determines the purposes and means of processing student and staff personal data.
• AerEthos acts as Processor and processes Personal Data only on the Controller's documented instructions, except where required to do otherwise by applicable law, in which case AerEthos shall inform the Controller of the relevant legal requirement before processing (unless prohibited by law).

AerEthos does not act as Controller in respect of student or staff personal data submitted through the yearbook process. AerEthos may act as an independent Controller in respect of its own business operations (communications with the school, billing records, security logs) — this processing is governed by AerEthos's Terms & Policies.

AerEthos shall process Personal Data only:

• On the documented instructions of the Controller, as set out in the service agreement and any subsequent written instructions;
• As necessary to deliver the yearbook and Vision platform services; and
• In compliance with applicable data protection law.

The Controller acknowledges that AerEthos's obligations under this DPA constitute the Controller's primary documented instructions for the purposes of Article 28(3)(a) GDPR. Additional instructions may be given in writing at any time; AerEthos will inform the Controller if, in its reasonable opinion, an instruction infringes GDPR or other applicable data protection law.

AerEthos shall not process Personal Data for any purpose other than the performance of the services without the Controller's prior written consent.

AerEthos shall ensure that all persons authorised to process Personal Data under this DPA:

• Are subject to binding confidentiality obligations (whether by contract or statutory duty);
• Process Personal Data only in accordance with the Controller's instructions and this DPA;
• Are informed of the confidential nature of the Personal Data and the applicable restrictions.

AerEthos shall not disclose Personal Data to any third party except as authorised by this DPA (sub-processors in accordance with §7), required by applicable law, or with the Controller's prior written consent.

These confidentiality obligations survive termination of the DPA indefinitely.

AerEthos shall implement and maintain appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include, at minimum:

The Controller provides general authorisation for AerEthos to engage the sub-processors listed below. AerEthos shall:

• Impose data protection obligations on each sub-processor equivalent to those set out in this DPA;
• Remain fully liable to the Controller for the performance of sub-processors' obligations;
• Notify the Controller of any intended addition or replacement of sub-processors with at least 30 days' advance notice, giving the Controller the opportunity to object;
• If the Controller reasonably objects to a new sub-processor and AerEthos cannot accommodate the objection, either party may terminate the service agreement on 30 days' notice without liability for the termination itself.

AerEthos will maintain an up-to-date sub-processor list and make it available to the Controller on request. Transfer Impact Assessments (TIAs) for US-based sub-processors are available on request.

The Controller is responsible for receiving and responding to data subject rights requests (access, rectification, erasure, restriction, portability, objection) from students, parents, and staff in accordance with Articles 15–22 GDPR.

AerEthos shall, upon receiving a data subject rights request directly (where a data subject contacts AerEthos rather than the school):

• Promptly redirect the data subject to the Controller (school) for handling;
• Notify the Controller of the request without undue delay;
• Provide reasonable assistance to the Controller in fulfilling the request, including by making available to the Controller the relevant Personal Data held by AerEthos.

AerEthos shall action confirmed erasure requests relating to Vision platform content within fourteen (14) days of receiving the Controller's written instruction to do so.

AerEthos shall notify the Controller without undue delay, and in any event within 24 hours of becoming aware of a personal data breach affecting Personal Data processed under this DPA.

The breach notification shall include, to the extent available at the time of notification:

• A description of the nature of the breach, including the categories and approximate number of data subjects and Personal Data records affected;
• The name and contact details of AerEthos's data protection contact;
• The likely consequences of the breach;
• The measures taken or proposed to address the breach and to mitigate its possible adverse effects.

Where all information cannot be provided simultaneously, AerEthos shall provide information in phases as it becomes available. The Controller remains responsible for notifying the Data Protection Commission under Article 33 GDPR (within 72 hours of becoming aware) and for notifying data subjects where required under Article 34 GDPR.

AerEthos shall provide reasonable assistance to the Controller in fulfilling its notification obligations. AerEthos shall maintain an internal breach register documenting all breaches and the actions taken, regardless of whether external notification is required.

AerEthos shall provide reasonable assistance to the Controller in carrying out Data Protection Impact Assessments (DPIAs) required under Article 35 GDPR where processing operations are likely to result in high risks to the rights and freedoms of data subjects.

In particular, AerEthos acknowledges that the Vision NFC platform — involving systematic processing of access metadata from minors — may require a DPIA in certain jurisdictions or where required by a school's own data protection policies. AerEthos has conducted an internal DPIA for the Vision platform and will share this with schools on request.

Where a school is required by its data protection officer (DPO) or supervisory authority to conduct a DPIA prior to deploying Vision, AerEthos undertakes to provide all reasonably requested technical documentation, including sub-processor details, data flows, retention periods, and security measures.

Where AerEthos transfers Personal Data to sub-processors located outside the European Economic Area (EEA), it does so only on the basis of one or more of the following transfer mechanisms:

• EU–U.S. Data Privacy Framework (DPF): where the recipient is a certified participant in the DPF. AerEthos verifies DPF certification prior to engaging US-based sub-processors and monitors certifications on an ongoing basis.
• Standard Contractual Clauses (SCCs) — Module 2 (Controller-to-Processor): European Commission Decision 2021/914/EU, incorporated by reference into contracts with each affected sub-processor. Where required, these are supplemented by Transfer Impact Assessments (TIAs) and additional technical safeguards (e.g. encryption at rest and in transit).

AerEthos shall promptly notify the Controller if it believes any instruction would result in an unlawful international transfer. Documentation of transfer mechanisms for each sub-processor is available on request.

Upon termination of the service agreement, or upon written request from the Controller, AerEthos shall:

• Securely delete or return all Personal Data processed under this DPA (other than Vision platform content — see below) within 30 days of the termination date or written request;
• Provide written certification to the Controller confirming the deletion has been completed;
• Instruct sub-processors to delete their copies of the relevant Personal Data within the same timeframe.

Exception — Vision platform content: Content hosted on the Vision platform is subject to the 30-year retention commitment in §12.3 and will not be deleted upon termination of the service agreement. If the Controller instructs removal of Vision content, AerEthos will action this within 14 days (§12.4).

Exception — legal retention obligations: AerEthos may retain billing and payment records, and other data subject to statutory retention obligations, for the periods required by applicable law notwithstanding this clause.

Each party's liability under this DPA shall be subject to the limitations and exclusions in the service agreement, to the maximum extent permitted by law.

AerEthos shall be liable for damage caused by processing that infringes GDPR where it has not complied with obligations specifically directed to processors, or where it has acted outside or contrary to the Controller's lawful instructions.

The Controller shall be liable for damage caused by processing that infringes GDPR where it has failed to comply with its obligations as Controller, including but not limited to: failure to ensure lawful basis for processing; failure to provide adequate privacy notices to data subjects; or failure to respond to data subject rights requests within the required timeframes.

Where both parties are responsible for damage caused by a breach, liability shall be apportioned between the parties according to their respective degree of fault.

This DPA and any dispute or claim arising from or in connection with it (including non-contractual disputes) shall be governed by and construed in accordance with the laws of Ireland, without prejudice to any mandatory provisions of the law of the Controller's country of establishment.

In the event of a dispute relating to the interpretation or application of this DPA, the parties shall first attempt to resolve the dispute by good-faith negotiation. If the dispute is not resolved within 30 days of written notice from either party, it shall be submitted to the exclusive jurisdiction of the Irish courts, except where mandatory consumer or employment law provides otherwise.

Nothing in this clause prevents either party from seeking urgent injunctive or other equitable relief from a court of competent jurisdiction in any applicable territory.