Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Breakout Labs Oy, Business ID 3549465-3, Finland ("Breakout Labs"), and the customer receiving services from Breakout Labs ("Customer"), where Breakout Labs processes personal data on behalf of the Customer.

This DPA applies only to processing in which Breakout Labs acts as a processor or subprocessor. Processing for which Breakout Labs determines the purposes and means as a controller is outside the scope of this DPA and is described in the Breakout Labs Privacy Notice.

1. Scope and roles

1.1 This DPA applies to the extent that Breakout Labs processes personal data on behalf of the Customer in connection with services provided under an agreement, statement of work, order or other arrangement between the parties (the "Main Agreement").

1.2 Where the Customer acts as a controller, Breakout Labs acts as its processor.

1.3 Where the Customer acts as a processor on behalf of another controller, Breakout Labs acts as a subprocessor. The Customer confirms that it is authorised to appoint Breakout Labs and to provide the instructions contemplated by this DPA.

1.4 The subject matter, nature, purpose and duration of the processing, categories of data subjects and types of personal data are described in Appendix 1 and may be further specified in the Main Agreement or applicable statement of work.

1.5 If there is a conflict concerning the processing of personal data, this DPA prevails over the Main Agreement to the extent of that conflict. Otherwise, the Main Agreement remains unchanged.

2. Documented instructions

2.1 Breakout Labs will process personal data only on documented instructions from the Customer, including with regard to transfers of personal data to a third country or international organisation, unless processing is required by applicable Union or Member State law.

2.2 The Main Agreement, this DPA, applicable statements of work and other written instructions agreed by the parties constitute documented instructions.

2.3 If applicable law requires Breakout Labs to process personal data other than on the Customer's instructions, Breakout Labs will inform the Customer of that legal requirement before processing, unless the law prohibits such notification on important grounds of public interest.

2.4 Breakout Labs will promptly inform the Customer if, in its opinion, an instruction infringes applicable data protection law.

3. Confidentiality

3.1 Breakout Labs will ensure that persons authorised to process personal data are subject to appropriate confidentiality obligations.

3.2 Access to personal data will be limited to persons who require it for the provision, operation or support of the relevant services.

4. Security

4.1 Breakout Labs will implement and maintain appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the nature of the processing and the risks to individuals.

4.2 In determining appropriate measures, Breakout Labs will take into account the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the likelihood and severity of risks to the rights and freedoms of individuals.

4.3 Breakout Labs may update its technical and organisational measures as its services and practices evolve, provided that the overall level of protection is not materially reduced.

5. Personal data breaches

5.1 Breakout Labs will notify the Customer without undue delay after becoming aware of a personal data breach affecting personal data processed under this DPA.

5.2 Taking into account the nature of the processing and the information available to Breakout Labs, Breakout Labs will provide information reasonably required for the Customer to meet its obligations relating to the breach.

5.3 Breakout Labs will take reasonable steps to contain, investigate and mitigate the effects of the breach.

6. Subprocessors

6.1 The Customer provides Breakout Labs with general written authorisation to engage subprocessors to process personal data on the Customer's behalf.

6.2 Breakout Labs' current subprocessors are listed in Appendix 2.

6.3 Breakout Labs will impose data protection obligations on each subprocessor that provides a level of protection for personal data consistent with the obligations applicable to Breakout Labs under this DPA, as required by applicable data protection law.

6.4 Breakout Labs remains responsible to the Customer for the performance of its subprocessors' data protection obligations to the extent required by applicable data protection law.

6.5 Breakout Labs will inform affected Customers before adding or replacing a subprocessor that will process their personal data and provide a reasonable opportunity to object on legitimate data protection grounds.

6.6 If the Customer objects, the parties will work in good faith to seek a reasonable solution. This section does not create a termination right beyond any rights available under applicable law or the Main Agreement.

7. International transfers

7.1 Breakout Labs will ensure that transfers of personal data subject to Chapter V of the GDPR are made using a lawful transfer mechanism and appropriate safeguards as required by applicable data protection law.

7.2 Where applicable, this may include an adequacy decision, the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.

8. Data subject requests

8.1 Taking into account the nature of the processing, Breakout Labs will provide reasonable assistance to the Customer, through appropriate technical and organisational measures where possible, in responding to requests from individuals exercising their rights under applicable data protection law.

8.2 If Breakout Labs receives a request directly from an individual concerning personal data processed on behalf of the Customer, Breakout Labs will refer the individual to the Customer or otherwise inform the Customer, unless prohibited by law.

8.3 Breakout Labs will not independently respond to such a request on the Customer's behalf unless instructed or legally required to do so.

9. Compliance assistance

9.1 Taking into account the nature of processing and the information available to Breakout Labs, Breakout Labs will provide reasonable assistance to the Customer with its obligations concerning:

• security of processing;
• personal data breach notifications;
• data protection impact assessments; and
• prior consultation with supervisory authorities,

where those obligations relate to processing performed by Breakout Labs under this DPA.

10. Information and audits

10.1 Breakout Labs will make available to the Customer information reasonably necessary to demonstrate compliance with the obligations applicable to processors under Article 28 of the GDPR.

10.2 Where the information provided is not reasonably sufficient to demonstrate compliance, Breakout Labs will allow for and contribute to reasonable audits or inspections by the Customer or an independent auditor mandated by the Customer.

10.3 Audits must, where legally permitted:

• be conducted on reasonable prior notice;
• occur during normal business hours;
• avoid unreasonable disruption to Breakout Labs' operations;
• be limited to information and systems relevant to processing under this DPA; and
• protect the confidentiality, security and rights of Breakout Labs, its other customers and third parties.

10.4 The parties will cooperate in good faith to determine an appropriate audit method, taking into account available documentation, independent assessments and the nature and risk of the processing.

11. Return and deletion

11.1 At the end of the provision of services involving processing under this DPA, Breakout Labs will, at the Customer's choice, delete or return personal data processed on the Customer's behalf and delete remaining copies, unless applicable Union or Member State law requires continued storage.

11.2 Where personal data remains temporarily in backups or other systems from which immediate deletion is not reasonably possible, Breakout Labs will keep that data protected and will not actively process it except where required by law or for maintaining the integrity and security of those systems until it is deleted through the applicable retention lifecycle.

12. Customer responsibilities

12.1 The Customer is responsible for ensuring that:

• its instructions to Breakout Labs comply with applicable data protection law;
• it has a lawful basis and all necessary rights, notices and permissions for personal data provided to or processed through the services;
• where the Customer acts as a processor, its instructions are consistent with the instructions and requirements of the relevant controller; and
• its use of the services complies with applicable data protection law.

12.2 Nothing in this DPA relieves either party of its own obligations under applicable data protection law.

13. Term and changes

13.1 This DPA applies for as long as Breakout Labs processes personal data on behalf of the Customer under the Main Agreement.

13.2 The version of this DPA in effect when it becomes incorporated into the Main Agreement applies to that Main Agreement unless the parties agree otherwise.

13.3 Breakout Labs may publish updated versions of this DPA. An updated version does not automatically replace the version incorporated into an existing Main Agreement unless the parties have agreed to such replacement or a change is required by applicable law.

13.4 Appendix 2 may be updated separately from the versioned terms of this DPA in accordance with Section 6.

14. Relationship with the Main Agreement

14.1 Liability arising from this DPA is subject to the liability provisions of the Main Agreement, to the extent permitted by applicable law.

14.2 The governing law, dispute resolution and jurisdiction provisions of the Main Agreement also apply to this DPA.

Appendix 1: Details of Processing

1. Subject matter

Processing of personal data as necessary for Breakout Labs to provide training, enablement, learning environments, learner support, administration, reporting and related services on behalf of the Customer.

2. Duration

For the duration of the relevant services and thereafter only for the period necessary to return or delete personal data in accordance with this DPA and applicable law.

3. Nature and purpose of processing

Depending on the services purchased and the Customer's instructions, processing may include:

• administering learners and access to training and learning environments;
• delivering instructor-led and self-paced training;
• tracking participation, learning activity, progress and completion;
• providing learner and technical support;
• operating training environments, exercises and repositories;
• providing certificates and agreed customer reporting;
• processing recordings, transcripts and session chat where applicable; and
• other processing documented in the applicable statement of work or Customer instructions.

Not every activity listed above applies to every Customer or service.

4. Categories of data subjects

Depending on the services:

• Customer employees, contractors and other personnel participating in training or enablement;
• Customer personnel administering or coordinating the services; and
• other individuals whose personal data the Customer instructs Breakout Labs to process in connection with the services.

5. Types of personal data

Depending on the services and Customer instructions:

• name;
• business email address;
• employer or organisational affiliation;
• training registration and enrolment information;
• attendance and participation information;
• learning activity, progress and completion information;
• training environment and exercise activity;
• support communications;
• certificates and completion records;
• session contributions, recordings, transcripts and chat where applicable; and
• other personal data provided by the Customer or generated through use of the services in accordance with the Customer's instructions.

6. Special categories of personal data

The services are not designed to require special categories of personal data. The Customer will not instruct Breakout Labs to process special categories of personal data unless the parties have expressly agreed that such processing is necessary and appropriate safeguards have been established.

Appendix 2: Subprocessors

Current as of 25 September 2026

The Customer provides general authorisation for Breakout Labs to use the subprocessors below where they process personal data on behalf of the Customer.

Not every subprocessor is used for every Customer or service. The subprocessors involved depend on the services, learning environments and delivery setup agreed with the Customer.

Breakout Labs will maintain this list in accordance with Section 6.

Questions concerning subprocessors may be sent to privacy@breakout-labs.com.