Data Processing Agreement

1. Definitions

For purposes of this Data Processing Agreement, “Zukeepr” means (a) Zukeepr US LLC, where the Daycare operates in the United States; or (b) ZuKeepr Inc., where the Daycare operates in Canada. The applicable entity is the contracting party under the Daycare Agreement.

ZuKeepr Inc. and Zukeepr US LLC are separate legal entities. Processing of personal information by one entity on behalf of the other will be subject to appropriate data protection arrangements and applicable disclosure requirements. This DPA is governed by the governing-law and jurisdiction provisions of the applicable Daycare Agreement. Nothing in this definition automatically transfers an existing DPA from one legal entity to another.

For the purposes of this DPA:

• "Personal Information" means any information that, alone or in combination with other information, identifies or could reasonably identify an individual, including parents and children whose information is exchanged through the Platform.
• "Process" or "Processing" means any operation performed on Personal Information, including collection, storage, use, modification, disclosure, transfer, retention, and deletion.
• "Controller" / "Business" / "Joint Controller" refers to the party (or parties) that determines the purposes and means of Processing Personal Information, as those terms are understood under Canadian privacy law (PIPEDA, BC PIPA), applicable U.S. state privacy law (controller, business), and equivalent privacy law.
• "Processor" / "Service Provider" refers to a party that Processes Personal Information on behalf of a Controller or Business, in accordance with that party's instructions and applicable law.
• "Subprocessor" means a third party engaged by a party to Process Personal Information on its behalf.
• "Data Subject" means an individual whose Personal Information is Processed under this DPA, including parents and children.
• "Privacy Law" means PIPEDA, the British Columbia Personal Information Protection Act, applicable U.S. state and federal privacy law (including COPPA), and any other privacy or data protection law applicable to the Processing of Personal Information under this DPA.
• "Security Incident" means any actual or reasonably suspected unauthorized access to, disclosure of, loss of, or alteration of Personal Information.

2. Scope and Roles

2.1 This DPA covers Personal Information about parents and children that is collected, stored, or transmitted through the Platform, including:

• Parent identity and contact information (name, email, phone number, address);
• Child identity and care information (name, date of birth, allergies, medical information, immunization records, emergency contacts, pick-up authorizations, language preferences);
• Application, enrollment, and communication records between parents and Daycares;
• Payment records relating to parent transactions (processed via Stripe).

2.2 Role of the Parties. For Personal Information exchanged through the Platform between Zukeepr and the Daycare:

• Under Canadian privacy law (including PIPEDA and the British Columbia Personal Information Protection Act), Zukeepr and the Daycare act as Joint Controllers, with independent obligations to the affected individuals;
• Under applicable U.S. state privacy law, Zukeepr and the Daycare may each act as a separate "controller" or "business," with shared or coordinated obligations where information is jointly determined;
• The actual role of each party in a specific transaction depends on the applicable Privacy Law in the jurisdiction of the affected Data Subject. The parties will cooperate in good faith to determine and honour the applicable role-based obligations.

2.3 To the extent that the Daycare uses the Platform to store or Process Daycare-controlled records that are not received from parents through Zukeepr's matching process (for example, internal attendance logs or family files), Zukeepr acts as a Processor or Service Provider to the Daycare for that data, and the Daycare is the Controller or Business. This DPA's Joint Controller / coordinated-Controller provisions do not apply to that Daycare-controlled data.

Daycare-controlled records may include records created by Daycare personnel in connection with an enrolled child's ongoing care, including photographs, sleep and rest records, meal records, attendance records, developmental or progress reports, and incident or illness records. Zukeepr Processes these records as a Processor or Service Provider on behalf of the Daycare and may make them available through the Platform to the authorized parent or legal guardian associated with that child, subject to applicable law.

3. Each Party's Responsibilities

3.1 Zukeepr's Responsibilities

Zukeepr will:

• Collect Personal Information from parents under a valid consent and notice framework, as described in the Privacy Policy and Children's Privacy Notice;
• Process Personal Information only for the purposes set out in those notices and for the operation of the Platform;
• Maintain appropriate physical, technical, and administrative safeguards consistent with Section 5;
• Make Personal Information available to the Daycare only at the appropriate stage of the application or enrollment process (the two-stage model: limited profile at application, full profile at enrollment acceptance);
• Honour parent requests to access, correct, or delete Personal Information collected by Zukeepr;
• Maintain a current list of Subprocessors, publicly available at zukeepr.com/subprocessors, and disclose material changes as set out in Section 6;
• Notify the Daycare of Security Incidents affecting Personal Information shared with the Daycare, as set out in Section 7.

3.2 Daycare's Responsibilities

The Daycare will:

• Use Personal Information received through the Platform solely for the purpose of providing childcare services to the enrolled family;
• Limit access to Personal Information to staff and contractors who have a legitimate need to know;
• Maintain appropriate physical, technical, and administrative safeguards consistent with Section 5;
• Comply with all applicable Privacy Law, including PIPEDA, the British Columbia Personal Information Protection Act, applicable U.S. state and federal privacy law, and any provincial or jurisdiction-specific childcare records retention requirements;
• Honour parent requests to access, correct, or delete Personal Information held by the Daycare, in coordination with Zukeepr where appropriate, and subject to the legal retention carveout in Section 10;
• Not disclose Personal Information to any third party except: (a) as required by law; (b) as necessary to provide childcare services (for example, sharing with the child's emergency contact or healthcare provider in a genuine emergency); or (c) with the parent's express consent;
• Notify Zukeepr of Security Incidents affecting Personal Information received through the Platform, as set out in Section 7.

4. Permitted and Prohibited Processing

4.1 The Daycare may Process Personal Information received through the Platform only for the following purposes:

• Reviewing applications and making enrollment decisions;
• Providing childcare services to enrolled families;
• Communicating with parents about their child's care;
• Creating, maintaining, and sharing care records with the enrolled child's authorized parent or legal guardian;
• Maintaining records as required by childcare licensing authorities;
• Complying with legal obligations.

4.2 The Daycare will not:

• Use Personal Information received through the Platform for marketing purposes unrelated to the care of an enrolled child;
• Sell, rent, or trade Personal Information;
• Disclose Personal Information to a competitor of Zukeepr or use it to attempt to divert parent users to off-Platform services in violation of the Daycare Agreement;
• Process Personal Information about children for advertising, profiling, or behavioural analytics.

5. Security Measures

5.1 Each party will implement and maintain appropriate technical and organizational security measures designed to protect Personal Information against unauthorized access, alteration, disclosure, or destruction. These measures include, at a minimum:

• Encryption of Personal Information in transit (TLS) and at rest where reasonably feasible;
• Access controls limiting access to authorized personnel with a legitimate need;
• Authentication mechanisms (passwords, multi-factor authentication where appropriate);
• Logging and monitoring of access to Personal Information;
• Regular review of security measures and prompt remediation of identified vulnerabilities;
• Staff training on Privacy Law obligations and information-handling practices.

5.2 Each party will keep its security measures up to date with evolving threats and industry best practices. Material changes in security posture that may affect the other party will be communicated reasonably in advance where feasible.

6. Subprocessors

6.1 Zukeepr maintains a complete, current list of Subprocessors at zukeepr.com/subprocessors, including the name, purpose, data jurisdiction, data categories, and last-updated date for each Subprocessor. By accepting this DPA, the Daycare authorizes Zukeepr's use of the Subprocessors listed on that page as of the date of acceptance.

6.2 As of the date of this DPA, Zukeepr's principal Subprocessors are summarized below:

6.3 Zukeepr requires Subprocessors to commit, by contract or equivalent, to data protection obligations consistent with this DPA. Zukeepr remains responsible for the Processing of Personal Information by its Subprocessors.

6.4 Zukeepr may update the list of Subprocessors from time to time. Material additions will be disclosed by updating the public Subprocessor page and, where the change is material, by email or in-app notice. The Daycare may object to new Subprocessors that materially change the risk profile of the Processing by contacting support@zukeepr.com; if the parties cannot reach a reasonable accommodation, the Daycare may terminate the Daycare Agreement for that reason.

7. Security Incident Notification

7.1 Each party will notify the other party of any Security Incident affecting Personal Information shared between them under this DPA as soon as feasible after becoming aware of the Security Incident and as required by applicable Privacy Law. Each party will use seventy-two (72) hours as an internal operational target for initial notification, recognizing that actual timing depends on the facts of the incident, ongoing investigation needs, and applicable law.

7.2 The notification will, to the extent then known, include:

• A description of the nature of the Security Incident;
• The categories and approximate number of Data Subjects and records affected;
• The likely consequences of the Security Incident;
• The measures taken or proposed to address the Security Incident and mitigate its effects;
• A point of contact for further information.

7.3 Each party will cooperate in good faith to investigate and remediate the Security Incident, including with respect to:

• Notifications to affected Data Subjects, where required by Privacy Law;
• Notifications to regulators, where required by Privacy Law;
• Public communications, where appropriate.

7.4 Each party will maintain reasonable records of Security Incidents affecting Personal Information under this DPA and make those records available to the other party upon reasonable request.

8. Data Subject Requests

8.1 Each party will assist the other in responding to requests from Data Subjects to exercise their rights under Privacy Law, including rights to access, correct, delete, restrict Processing of, or appeal decisions about Personal Information.

8.2 If a Data Subject submits a request to one party that relates to Processing carried out by the other party, the receiving party will forward the request to the appropriate party and notify the Data Subject of the referral.

8.3 Where a Data Subject request requires action by both parties (for example, a deletion request that affects both Zukeepr's records and the Daycare's records), the parties will coordinate to fulfill the request within the timelines required by Privacy Law, typically thirty (30) days from receipt.

8.4 Each party may charge a reasonable fee for assisting with the other party's response to Data Subject requests only where Privacy Law permits such a fee and where the requested assistance is substantial.

9. International Data Transfers

9.1 Zukeepr's primary infrastructure is hosted in AWS Canada Central (ca-central-1) and MongoDB Atlas in AWS Oregon (us-west-2), United States. Personal Information may be transferred to, or processed by, Subprocessors located in the United States or other jurisdictions, as identified in Section 6 and at zukeepr.com/subprocessors.

9.2 Where Personal Information is transferred outside of Canada, Zukeepr takes reasonable steps to ensure the Personal Information remains protected under safeguards comparable to those required by PIPEDA and applicable provincial Privacy Law, including contractual commitments from Subprocessors.

9.3 The Daycare acknowledges that, as a result of these transfers, Personal Information may become subject to lawful access requests by foreign authorities under the laws of the jurisdiction where the Subprocessor is located. This is disclosed to parents in the Privacy Policy.

10. Retention and Deletion

10.1 Each party will retain Personal Information only for as long as necessary for the purposes for which it was collected, as required by Privacy Law, or as required by other applicable law.

10.2 Zukeepr's retention timelines are set out in the Privacy Policy and Children's Privacy Notice. Retention periods applicable to Daycare-controlled care records stored through the Platform are described in the Privacy Policy, subject always to any longer period required by applicable law.

10.3 Mandatory Retention and Retention-Policy Periods. The parties distinguish between (a) mandatory retention — retention that applicable law, a childcare licensing requirement, legal process or an unresolved claim requires — and (b) retention under Zukeepr's retention policy, including the retention-policy periods for Daycare-controlled care records, incident records and payment records described in the Privacy Policy. Minimum periods under childcare licensing requirements vary by jurisdiction and may be shorter than Zukeepr's retention-policy periods; for example, the Texas Health and Human Services Commission Minimum Standards generally require incident and illness reports to be kept while the child is in care and for at least three months after the child's last day. The Daycare's retention practices for Personal Information received through the Platform must comply with applicable Privacy Law and childcare licensing requirements.

Where a parent requests deletion of Personal Information in a record the Daycare controls, the Daycare decides the request. Where the Daycare so instructs or this DPA otherwise permits, Zukeepr may deliver the Daycare's response to the parent on the Daycare's behalf. The Daycare will:

• Delete or anonymize the Personal Information to the extent it is not subject to mandatory retention and is not retained under a retention-policy period that applicable law permits;
• Where information is retained, limit Processing of the retained information to the purpose for which it is retained, restrict access, keep only the information reasonably necessary to preserve the integrity and meaning of the retained record, and delete or de-identify the information once the basis for retention expires.

A response to a deletion request that cannot be carried out in full — whether given by the Daycare, by Zukeepr on the Daycare's behalf, or by Zukeepr for records it controls — will:

• Identify the categories of records retained;
• State the reason for the retention;
• State the retention period or, where a fixed period is not practicable, the criteria used to determine it;
• State that the remaining information will be deleted or de-identified when the basis for retention expires; and
• Include any information about review or appeal of the decision that applicable law requires.

10.4 On termination of the Daycare Agreement, the Daycare will, within a reasonable period, securely delete or anonymize Personal Information received through the Platform, except for records the Daycare is required to retain by applicable law.

11. Audit and Demonstrable Compliance

11.1 Each party will, on reasonable request from the other party and no more than once per twelve (12) month period (except in the event of a Security Incident), provide reasonable information about its data protection practices relevant to this DPA. This may include security policies, summary results of internal or external audits, certifications, or written responses to specific reasonable questions.

11.2 Audits or inspections that require on-site access or that exceed reasonable information exchange must be agreed in advance and conducted in a manner that does not unreasonably disrupt the audited party's business.

12. Liability

12.1 The liability of the parties under this DPA is governed by the liability provisions of the Daycare Agreement, including any liability caps and exclusions, except that nothing in those provisions limits a party's liability for direct breaches of Privacy Law for which liability cannot be limited under applicable law.

13. Term and Termination

13.1 This DPA takes effect on the date the Daycare accepts the Daycare Agreement, and remains in force for as long as Zukeepr Processes Personal Information about parents and children on behalf of, or in joint controllership / coordinated controllership with, the Daycare.

13.2 On termination of the Daycare Agreement, this DPA terminates concurrently, except that Sections 5 (Security Measures), 7 (Security Incident Notification), 10 (Retention and Deletion), and 12 (Liability) survive to the extent necessary to address Personal Information retained, lawfully held, or subject to ongoing legal obligations.

14. Updates to This DPA

14.1 Zukeepr may update this DPA from time to time to reflect changes in Subprocessors, Privacy Law, or our data protection practices. Material changes will be communicated to Daycares via email or in-app notice at least thirty (30) days before they take effect.

14.2 Continued use of the Platform after the effective date of an updated DPA constitutes acceptance of the updated terms. A Daycare that does not agree to a material update may terminate the Daycare Agreement before the effective date in accordance with the Daycare Agreement's termination provisions.

15. Governing Law and Jurisdiction

This DPA is governed by the governing-law and jurisdiction provisions of the applicable Daycare Agreement (Section 20). Where the contracting party is Zukeepr US LLC, this DPA is governed by the laws of the State of Wyoming and applicable federal law of the United States, without regard to conflict-of-laws principles, and, subject to rights and remedies that cannot lawfully be restricted, disputes arising out of or relating to this DPA shall be brought in the state courts of competent jurisdiction in Wyoming or, where federal subject-matter jurisdiction exists, the United States District Court for the District of Wyoming. Where the contracting party is ZuKeepr Inc., this DPA is governed by the laws of British Columbia and the federal laws of Canada applicable therein and, subject to applicable non-waivable rights, disputes shall be brought before the courts of British Columbia sitting in Victoria.

Nothing in this section limits any consumer, privacy or other statutory right or remedy that cannot lawfully be waived, including the application of mandatory laws or the right to bring proceedings in another jurisdiction where applicable law requires or permits such proceedings notwithstanding this DPA. The parties will first attempt to resolve disputes through the informal dispute-resolution procedure established in the Daycare Agreement.

16. Contact

Questions about this DPA or data protection practices can be sent to:

ZuKeepr Inc.

914 Graythorpe Place, Victoria, BC V8X 4K5, Canada

Zukeepr US LLC

Business correspondence address: 30 N Gould St, Ste N, Sheridan, WY 82801, United States

support@zukeepr.com

zukeepr.com