Snapshot 30115
Normalized text
Scripts and page chrome removed; this is what change detection compares.
ZEEMEE
Data Privacy Addendum
This Data Privacy Addendum (this “DPA” or “Addendum”) amends and forms a part of the agreement to which
this DPA is appended (the “Agreement”) between the organization identified on the signature page (“College”)
and ZeeMee, Inc., a Delaware corporation with offices at 3000 El Camino Real, Suite 4-200, Palo Alto, CA 94306
USA (“ZEEMEE”), each a “Party” and collectively the “Parties.” In the event of a conflict between this
Addendum and any other agreement between the parties, this Addendum takes precedence, but only with respect
to the subject matter of this Addendum. College and ZEEMEE agree as follows:
1. Definitions. For purposes of this Addendum:
a. “Data Privacy Laws” means all applicable laws, regulations, and other legal or self-regulatory
requirements in any jurisdiction relating to privacy, data protection, data security, breach notification,
or the Processing of Personal Information, including without limitation, to the extent applicable, the
Family Educational Rights and Privacy Act (“FERPA”) (20 U.S.C. § 1232g; 34 CFR Part 99); the
California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”) as amended by the
California Privacy Rights Act (“CPRA”); the General Data Protection Regulation, Regulation (EU)
2016/679 (“GDPR”) the United Kingdom Data Protection Act (2018) (“UK 2018 Privacy Act”), and
the Swiss Federal Act on Data Protection (“Swiss FADP”). For the avoidance of doubt, if ZEEMEE’s
Processing activities involving Personal Information are not within the scope of a given Data Privacy
Law, such law is not applicable for purposes of this Addendum.
b. “Consumer” means an identified or identifiable natural person about whom Personal Information
relates.
c. “Personal Information” includes “personal data,” “personal information,” “personally identifiable
information,” and similar terms, and such terms shall have the same meaning as defined by applicable
Data Privacy Laws.
d. “Process” and “Processing” mean any operation or set of operations performed on Personal
Information or on sets of Personal Information, whether or not by automated means, such as
collection, recording, organization, creating, structuring, storage, adaptation or alteration, retrieval,
consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment
or combination, restriction, erasure, or destruction, and shall have the same meaning as defined by
applicable Data Privacy Laws.
e. “Security Breach” means any accidental or unlawful acquisition, destruction, loss, alteration,
unauthorized disclosure of, or access to, Personal Information.
f. “Standard Contractual Clauses” means one or both of the following, as the context requires:
1. For Personal Information subject to the UK Data Protection Law, the “International Data
Transfer Addendum” approved 2 February 2022 to the European Commission’s 2021
Standard Contractual Clauses; and
2. For Personal Information subject to the GDPR or the Swiss FADP, the “2021 Standard
Contractual Clauses,” defined as the clauses issued pursuant to the EU Commission
Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for
the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the
European Parliament and of the Council, available at
Rev. 20260901
http://data.europa.eu/eli/dec_impl/2021/914/oj and completed as described in the “Data
Transfers” section below.
2. Scope and Purposes of Processing.
ZEEMEE will Process Personal Information solely: (1) to fulfill its obligations to College under the
Agreement, including this Addendum; (2) pursuant to College’s instructions; and (3) in compliance with
Data Privacy Laws. College shall have sole responsibility for the accuracy, quality, and legality of
Personal Data it provides to ZEEMEE and the means by which College acquired Personal Data.
3. FERPA Acknowledgement.
The parties acknowledge and agree that with respect to Student Information governed by FERPA,
ZEEMEE operates under the “school official” exemption for outsourced institutional services or
functions, 34 CFR § 99.31(a)(1)(B), and ZEEMEE shall at all times in performance of the Agreement
comply with instructions from College regarding use and maintenance of records pertaining to Student
Information and applicable FERPA rules and regulations.
4. CCPA Acknowledgment.
The parties acknowledge and agree that ZEEMEE is a service provider for the purposes of the California
Consumer Privacy Act (the “CCPA”). ZEEMEE certifies that it understands the rules, restrictions,
requirements and definitions of the CCPA. ZEEMEE agrees to refrain from taking any action that would
cause any transfers of Personal Information to or from ZEEMEE to qualify as a “sale” of Personal
Information under the CCPA.
5. Personal Information Processing Requirements. ZEEMEE will:
a. Ensure that the persons it authorizes to Process the Personal Information have committed themselves
to confidentiality or are under an appropriate statutory obligation of confidentiality.
b. Assist College in the fulfilment of College’s obligations to respond to verifiable requests by
Consumers (or their lawful representatives) for exercising their rights under Data Privacy Laws (such
as rights to access or delete Personal Information).
c. Promptly notify College of (i) any third-party or Consumer complaints regarding the Processing of
Personal Information; or (ii) any government or Consumer requests for access to or information about
ZEEMEE’s Processing of Personal Information on College’s behalf, unless prohibited by Data
Privacy Laws. ZEEMEE will provide College with reasonable cooperation and assistance in relation
to any such request.
6. Data Security. ZEEMEE will implement appropriate administrative, technical, physical, and
organizational measures to protect Personal Information, as set forth in Exhibit A.
7. Security Breach. ZEEMEE will notify College without undue delay, and in no event later than seventy-
two (72) hours after discovery, of any Security Breach and will assist College in College’s compliance with
its Security Breach-related obligations, including without limitation, by:
a. Taking steps to mitigate the effects of the Security Breach and reduce the risk to Consumers whose
Personal Information was involved; and
b. Providing College with the following information, to the extent known:
i. The nature of the Security Breach, including, where possible, how the Security Breach
occurred, the categories and approximate number of Consumers concerned, and the
categories and approximate number of Personal Information records concerned;
2
ii. The likely consequences of the Security Breach; and
iii. Measures taken or proposed to be taken by ZEEMEE to address the Security Breach,
including, where appropriate, measures to mitigate its possible adverse effects.
8. Subcontractors.
a. College acknowledges and agrees that ZEEMEE may use ZEEMEE affiliates and other
subcontractors to Process Personal Information in accordance with the provisions within this
Addendum and Data Privacy Laws. Where ZEEMEE sub-contracts any of its rights or
obligations concerning Personal Information, including to any affiliate, ZEEMEE will take
steps to select and retain subcontractors that are capable of maintaining appropriate privacy
and security measures to protect Personal Information consistent with applicable Data
Privacy Laws.
b. ZEEMEE has provided a current list of ZEEMEE’s subprocessors listed herein as Exhibit
B, and College hereby consents to ZEEMEE’s use of such subprocessors. ZEEMEE will
maintain an up-to-date list of its subprocessors, and it will provide College with at least thirty
(30) days’ notice of any new subprocessor added to the list prior to transferring College
Personal Information to such a new subprocessor. In the event College objects to a new
subprocessor, ZEEMEE will not transfer College Personal Information to the new
subprocessor and will use reasonable efforts to make available to College a change in the
services or recommend a commercially reasonable change to, College’s use of the services
to avoid Processing of Personal Information by the objected-to subprocessor without
unreasonably burdening the College. College may, in its sole discretion, terminate the
Agreement at any time and by providing written notice to ZEEMEE in the event that it
objects to a subprocessor and ZEEMEE is unable to change the services to satisfy College.
9. Data Transfers.
a. College authorizes ZEEMEE to make international transfers of the Personal Information only
if (i) applicable Data Privacy Law for such transfers is respected and (ii) the transfer is
otherwise permitted by this DPA.
b. With respect to Personal Information transferred from the United Kingdom for which UK
Data Protection Law (and not the law in any European Economic Area (“EEA”) jurisdiction
or Switzerland) governs the international nature of the transfer, the 2021 Standard
Contractual Clauses along with the UK International Data Transfer Addendum form part of
this DPA and take precedence over the rest of this DPA to the extent of any conflict and shall
be deemed completed as follows:
● The “exporter” is College, and the exporter’s contact information is set forth below,
● The “importer” is ZEEMEE, and ZEEMEE’s contact information is set forth below.
● By entering into this DPA, the Parties are deemed to be signing the 2021 Standard
Contractual Clauses and their applicable Appendices.
c. With respect to Personal Information transferred from the EEA and Switzerland, the 2021
Standard Contractual Clauses form part of this DPA and take precedence over the rest of this
DPA to the extent of any conflict, and they will be deemed completed as follows:
● College acts as a controller and ZEEMEE acts as College’s processor with respect
to the Personal Information subject to the 2021 Standard Contractual Clauses, and
its Module 2 applies.
● Clause 7 (the optional docking clause) is included.
3
● Under Clause 9 (Use of sub-processors), the parties select Option 2 (General written
authorization). The initial list of sub-processors is set forth as indicated in Annex
II, Exhibit B of this DPA and ZEEMEE shall update that list and provide notice to
College at thirty (30) days in advance of any intended additions or replacements of
sub-processors.
● Under Clause 11 (Redress), the optional requirement that data subjects be permitted
to lodge a complaint with an independent dispute resolution body does not apply.
● Under Clause 17 (Governing law), the parties choose Option 1 (the law of an EU
Member State that allows for third-party beneficiary rights). The parties select the
laws of Ireland.
● Under Clause 18 (Choice of forum and jurisdiction), the parties select the courts of
Ireland.
● Annexes I and II of the 2021 Standard Contractual Clauses are set forth in Schedule
B of the DPA.
● Annex III of the 2021 Standard Contractual Clauses (List of subprocessors) is
inapplicable.
d. Additional Safeguards for the Transfer and Processing of Personal Information from the
EEA, Switzerland, and the United Kingdom. To the extent that ZEEMEE Processes Personal
Information of Data Subjects located in or subject to the applicable Data Privacy Laws of
the EEA, Switzerland, or the United Kingdom, ZEEMEE agrees to the following safeguards
to protect such data to an equivalent level as applicable Data Privacy Laws:
● ZEEMEE and College shall encrypt all transfers of the Personal Information
between them, and ZEEMEE shall encrypt any onward transfers it makes of such
personal data, to prevent the acquisition of such data by unauthorized third parties.
● ZEEMEE will use all reasonably available legal mechanisms to challenge any
demands for data access through national security process it receives as well as any
non-disclosure provisions attached thereto.
● At 12-month intervals or more often if required by applicable Data Privacy Law,
ZEEMEE shall create a transparency report that it will make available to College
upon request, indicating the types of binding legal demands for the Personal
Information it has received, including national security orders and directives, which
shall encompass any process issued under FISA Section 702.
● ZEEMEE will promptly notify College if ZEEMEE can no longer comply with the
applicable Standard Contractual Clauses or the clauses in this Section. ZEEMEE
shall not be required to provide College with specific information about why it can
no longer comply, if providing such information is prohibited by applicable law.
Such notice shall entitle College to terminate the Agreement (or, at College’s
option, affected statements of work, order forms, and like documents thereunder)
and receive a prompt pro-rata refund of any prepaid amounts thereunder. This is
without prejudice to College’s other rights and remedies with respect to a breach of
the Agreement.
10. Audits. ZEEMEE will make available to College all information necessary to demonstrate compliance
with this Addendum and will allow for and contribute to audits conducted by College or another auditor
mandated by College, provided that, such audit shall occur nor more than once every twelve (12) calendar
months, upon reasonable prior written notice, and to the extent ZEEMEE’s personnel are required to
cooperate thereupon, during ZEEMEE’s normal business hours.
11. Return or Destruction of Personal Information. Except to the extent required otherwise by Data Privacy
Laws, ZEEMEE will, at the choice of College, return to College and/or securely destroy all Personal
Information upon (a) written request of College or (b) termination of the Addendum. Except to the extent
4
prohibited by Data Privacy Laws, ZEEMEE will inform College if it is not able to return or delete the
Personal Information.
12. Term; Survival. The term of this Addendum shall commence as of the Effective Date and will continue
until terminated by the parties upon a 30-day prior written notice or until the underlying Addendum
between the parties has been terminated. The provisions of this Addendum shall survive the termination
or expiration of this Addendum for so long as ZEEMEE or its subcontractors Process the Personal
Information.
Schedule A
Appendix 1 to the 2021 Standard Contractual Clauses
This Appendix forms part of the Standard Contractual Clauses.
Data exporter
The data exporter is (please specify briefly your activities relevant to the transfer): College, who is engaging ZEEMEE
for the purposes described in the Agreement and any relevant Statements of Work.
Data importer
The data importer is (please specify briefly activities relevant to the transfer): ZEEMEE, who will process the Personal
Information for the purposes described in the Agreement as instructed by College.
Data subjects
The personal data transferred concern the following categories of data subjects (please specify):
Data subjects located in the EEA, UK, or Switzerland whose information is provided from College to ZEEMEE for
processing pursuant to the Agreement and this DPA.
Categories of data
The personal data transferred concern the following categories of data (please specify):
Any categories of personal data provided by College to ZEEMEE regarding data subjects in the EEA, UK, or
Switzerland whose information is provided from College to ZEEMEE for processing pursuant to the Agreement and
this DPA.
Special categories of data (if appropriate)
The personal data transferred concern the following special categories of data (please specify):
College does not require data subjects to provide special category information (e.g., genetic, biometric and health
data, personal data revealing racial and ethnic origin, political opinions, religious or ideological convictions or trade
union membership, sex life, or sexual orientation), but data subjects may optionally provide information falling within
that category, and if they do College is responsible for ensuring that the Processing of Personal Information as
provided to ZEEMEE by College under this DPA is lawful.
Processing operations (including subject matter, nature, purpose and duration of Processing)
The personal data transferred will be subject to the following basic processing activities (please specify):
All Processing activities set forth in the Agreement as instructed by College.
Appendix 2 to the 2021 Standard Contractual Clauses
This Appendix forms part of the Standard Contractual Clauses.
5
Description of the technical and organizational security measures implemented by the data importer in
accordance with Clauses 4(d) and 5(c) (or document/legislation attached):
See Exhibit A.
Schedule B
Annexes I and II of the 2021 Standard Contractual Clauses
ANNEX I
A. List of Parties
Data exporter:
Name: The College, as defined in the Agreement between College and ZEEMEE under which data will be processed
on behalf of itself and its Affiliates.
Address: The College's address, as set out in the Agreement.
Contact person’s name, position and contact details: The College's contact details, as set out in the Order Form.
Activities relevant to the data transferred under these Clauses: Processing of Personal Data in connection with
College's use of the Company Services under the Company College Terms of Service.
Role (controller/processor): Controller.
Data importer(s): ZEEMEE
Name: ZeeMee, Inc.
Address: 3000 El Camino Real, Suite 4-200, Palo Alto, CA 94306 USA.
Contact person’s name, position and contact details: Privacy Lead, [email protected]
Activities relevant to the data transferred under these Clauses: The processing activities as described in the
Agreement as instructed by the College
Role (controller/processor): Processor
B. Description of Transfer
Categories of Data Subjects whose Personal Data is Transferred
College may submit Personal Data in the course of using the Services, the extent of which is determined and controlled
by College in College’s sole discretion, and which may include, but is not limited to Personal Data relating to the
following categories of Data Subjects:
College prospective applicants, and authorized personnel assigned to use the Services for College including
employees, contractors, temporary staff, and subcontractors.
Categories of Personal Data Transferred
College may submit Personal Data to the Services, the extent of which is determined and controlled by College in its
sole discretion, and which may include but is not limited to the following categories of Personal Data:
a. Contact Information.
b. Any other Personal Data submitted by, sent to, or received by College or its authorized users via the Services.
Sensitive Data transferred and applied restrictions or safeguards
The parties do not anticipate the transfer of sensitive data (e.g., for example, social security numbers, financial account
information, precise geolocation data, or genetic data). Company is not responsible for processing any sensitive data
unless and until mutually agreed by the parties.
Frequency of the transfer
Continuous
6
Purpose of the transfer and further processing
We will Process Personal Data as necessary to provide the Services pursuant to the Agreement, as further specified in
the Order Form, and as further instructed by you in your use of the Services.
Period for which Personal Data will be retained
Subject to the data retention requirements of the Agreement, we will Process Personal Data for the duration of the
Agreement, unless otherwise agreed in writing.
Competent Supervisory Authority
For the purposes of the EU Standard Contractual Clauses, the supervisory authority that shall act as competent
supervisory authority is either (i) where College is established in an EU Member State, the supervisory authority
responsible for ensuring College's compliance with the GDPR; (ii) where College is not established in an EU Member
State but falls within the extra-territorial scope of the GDPR and has appointed a representative, the supervisory
authority of the EU Member State in which College's representative is established; or (iii) where College is not
established in an EU Member State but falls within the extra-territorial scope of the GDPR without having to appoint
a representative, the supervisory authority of the EU Member State in which the Data Subjects are predominantly
located. In relation to Personal Data that is subject to the UK GDPR or Swiss DPA, the competent supervisory
authority is the UK Information Commissioner or the Swiss Federal Data Protection and Information Commissioner
(as applicable).
7
ANNEX II - TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND
ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Description of the technical and organisational measures implemented by the data importer(s) (including any
relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and
purpose of the processing, and the risks for the rights and freedoms of natural persons.
Exhibit A
ZEEMEE will implement and maintain the following administrative, technical, physical, and organizational security
measures for the Processing of Personal Information:
ZEEMEE’s Information Security Program includes specific security requirements for its personnel and all
subcontractors or agents who have access to Personal Information (“Data Personnel”). ZEEMEE’s security
requirements covers the following areas:
1. Information Security Policies and Standards. ZEEMEE will maintain written information security policies,
standards and procedures addressing administrative, technical, and physical security controls and
procedures. These policies, standards, and procedures shall be kept up to date, and revised whenever
relevant changes are made to the information systems that use or store Personal Information.
2. Physical Security. ZEEMEE will maintain commercially reasonable security systems at all ZEEMEE sites
at which an information system that uses or stores Personal Information is located (“Processing
Locations”) that include reasonably restricting access to such Processing Locations, and implementing
measures to detect, prevent, and respond to intrusions.
3. Organizational Security. ZEEMEE will maintain information security policies and procedures addressing
data disposal, data minimization, data classification, and incident response protocols.
4. Network Security. ZEEMEE maintains commercially reasonable information security policies and
procedures addressing network security.
5. Access Control. ZEEMEE agrees that: (1) only authorized ZEEMEE staff can grant, modify or revoke
access to an information system that Processes Personal Information; and (2) it will implement
commercially reasonable physical and technical safeguards to create and protect passwords.
6. Virus and Malware Controls. ZEEMEE protects Personal Information from malicious code and will install
and maintain protection software on any system that handles Personal Information.
7. Personnel. ZEEMEE has implemented and maintains a security awareness program to train employees
about their security obligations. Data Personnel follow established security policies and procedures.
Disciplinary process is applied if Data Personnel fail to adhere to relevant policies and procedures.
8. Subcontractor security. ZEEMEE shall only select and contract with subcontractors that are capable of
maintaining appropriate security safeguards that are no less onerous than those contained in the Addendum
and this Exhibit.
9. Business Continuity. ZEEMEE implements disaster recovery and business resumption plans that are kept
up to date and revised on a regular basis. ZEEMEE also adjusts its Information Security Program in light
of new laws and circumstances, including as ZEEMEE’s business and Processing change.
8
Exhibit B
Current Subprocessors (9/1/2026)
SUBPROCESSOR LOCATION SERVICES
Amazon AWS United States Hosting services
Amplitude, Inc. United States Data analytics
Anthropic PBC United States AI services
Betterstack United States SaaS-delivered log management and
analytics service
Bitrise, Ltd. United Kingdom Hosted mobile app development tools
CDNetworks, Inc. United States Content delivery network
Cursor Data, Inc. United States AI development tool
dbt Labs, Inc United States Data analytics
Elasticsearch United States Search capabilities
Embed.ly United States Rich media embedding and analytics
Files.com United States SFTP platform for secure file transfer
Data storage for .csv files provided by
schools
Filestack, Inc. United States File uploading API developer service
Functional Software, Inc. United States Error and Performance Monitoring
(DBA Sentry)
Google, Inc. United States Communications, analytics, storage
Heroku United States Platform-as-a-Service
Holistics Software Pte Ltd United States & Singapore Data analytics
Intercom, Inc. United States Customer support communications
Microsoft Corporation United States Applications and Storage
Mixpanel, Inc. United States Data analytics event analysis
New Relic United States App logs and analytics
OpenAI Inc. United States AI services
9
Posit United States Data analytics tools
PromptLayer (Magniv, Inc.) United States AI development tool
Pusher Limited United Kingdom API service for adding real-time bi-
directional communication
Redis United States Redis Cloud for data storage
Rollbar, Inc. United States Developer tool for debugging
Segment.io, Inc. United States Data transport infrastructure
SendinBlue SAS France Marketing communications platform
Slack Technologies United States Internal communications
Slick Innovations, LLC United States User text communication platform
Technolutions (Slate CRM) United States Data transfer API for partners on Slate
CRM
The Rocket Science Group United States Marketing communication automation
(Mailchimp) platform
TrackJS LLC United States Error tracking for web applications
Twilio, Inc. United States OTP provider for user account login
Typeform, SL Spain Survey platform
X.commerce, Inc. (RJ Metrics) United States Data infrastructure and analytics
10