PART A — GENERAL PROVISIONS

This General Data Processing Agreement ("DPA") forms part of the agreement, order form, statement of work, service terms, framework agreement or other agreement governing the provision of the Services (the "Agreement") between Academic Software BVBA, a private limited company incorporated in Belgium and part of Signpost Group, acting through Academic Software and, where applicable, its regional brands asknet and Ilona ("Academic Software " or the "Processor"), and the customer identified in the Agreement (the "Customer" or the "Controller").

The purpose of this DPA is to set out the data protection terms that apply where Academic Software processes Personal Data on behalf of the Customer in connection with the Services. This DPA is intended to satisfy Article 28(3) GDPR and the corresponding requirements of Applicable Data Protection Laws.

A.1 Introduction and applicability

A.1.1. This DPA applies only to the Processing of Personal Data by Academic Software as Processor on behalf of the Customer as Controller in connection with the Services. It does not apply to processing activities for which Academic Software the purposes and means of processing as Controller, such as sales, account management, billing, finance, legal administration and general business contact management. Such Controller activities are governed by the applicable Academic Software privacy notice.

A.1.2. This DPA is incorporated into and forms part of the Agreement. By entering into the Agreement, using the Services, or otherwise accepting the applicable service terms that refer to this DPA, the Customer accepts this DPA for the relevant Processing operations. Any different or additional data processing terms proposed by the Customer apply only if expressly accepted in writing by Academic Software.

A.1.3. This public version is designed for publication and therefore contains a high-level description of the Services, categories of Personal Data, categories of Data Subjects, Processing purposes, Technical and Organisational Measures, sub-processor governance and international transfer safeguards.

A.2 Definitions

A.2.1. Capitalised terms used but not defined in this DPA have the meaning given to them in the GDPR or, where applicable, in the Agreement.

A.2.2. "Applicable Data Protection Laws" means the GDPR, the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, and any other EU, EEA, Member State or, where applicable, UK data protection and privacy laws that apply to the Processing under this DPA.

A.2.3. "Customer Content" means any data, files, records, prompts, support information, configuration information, assessment data, usage information or other content submitted to, uploaded to, generated in, transmitted through or otherwise processed in the Services by or on behalf of the Customer or its Authorised Users.

A.2.4. "Data Subject" means an identified or identifiable natural person whose Personal Data is processed under this DPA.

A.2.5. "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

A.2.6. "Personal Data", "Process", "Processing", "Controller", "Processor", "Sub-processor", "Personal Data Breach" and "Supervisory Authority" have the meaning given to those terms in the GDPR (article 4).

A.2.7. "Services" means the products, platforms and services provided by Academic Software, asknet and/or Ilona to the Customer under the Agreement, including software distribution platforms, procurement portals, license management, platform configuration, identity and MDM integrations, customer support, the MILA AI platform, Sovelluskirjasto.fi and related implementation, support and compliance services, as further described in Annex 1.

A.2.8. "Authorised Users" means students, academic staff, administrative staff, institutional representatives, support contacts or other end users authorised by the Customer to access or use the Services.

A.3 Roles of the Parties

A.3.1. For the Processing of Personal Data of Authorised Users and other Data Subjects in the Services on behalf of the Customer, the Customer acts as Controller and Academic Software acts as Processor.

A.3.2. The Customer determines the purposes and means of Processing, including which Authorised Users may access the Services, which software titles, digital resources, AI tools or compliance tools are made available, and what Customer Content is submitted to the Services.

A.3.3. Academic Software processes Personal Data only on documented instructions from the Customer, unless Academic Software is required to do so by Union or Member State law to which it is subject. In such case, Academic Software will inform the Customer of the legal requirement before Processing, unless the law prohibits such information on important grounds of public interest.

A.3.4. Where Academic Software processes personal data for its own purposes, including customer relationship management, contracting, invoicing, payment follow-up, legal compliance and general communications, Academic Software acts as Controller. Such processing is outside the scope of this DPA, except where expressly stated otherwise in Annex 1 for transparency.

A.4 Subject matter and documented instructions

A.4.1. The subject matter, duration, nature and purpose of the Processing, the types of Personal Data and the categories of Data Subjects are set out in Annex 1.

A.4.2. The Customer instructs Academic Software to Process Personal Data to provide, configure, operate, secure, monitor, support, maintain and improve the Services, to comply with the Agreement, to perform the Processing activities described in Annex 1, and to comply with any further documented instructions agreed by the Parties.

A.4.3. The Agreement, this DPA, the Customer configuration of the Services, Customer administrator actions, support requests, agreed service documentation and other written communications from the Customer constitute documented instructions for the purposes of this DPA.

A.4.4. Academic Software will promptly inform the Customer if, in its reasonable opinion, an instruction infringes Applicable Data Protection Laws. Academic Software may suspend the execution of such instruction until the Customer has confirmed, amended or withdrawn the instruction.

A.4.5. Academic Software will not sell Personal Data processed under this DPA. Academic Software will not use Personal Data processed as Processor for advertising, profiling or purposes unrelated to the Services, unless expressly documented in the Agreement and permitted by Applicable Data Protection Laws.

A.4.6. For AI-related Services, Customer Content such as prompts, uploaded materials and outputs may be processed for inference and service delivery purposes. Academic Software will not knowingly use Personal Data processed as Processor to train general-purpose AI models for Academic Software independent purposes, unless expressly agreed in writing and subject to appropriate safeguards.

PART B — OBLIGATIONS

B.1 Controller obligations

B.1.1. The Customer is responsible for complying with its obligations as Controller under Applicable Data Protection Laws.

B.1.2. Without limiting clause B.1.1, the Customer is responsible for:

• ensuring that it has a valid legal basis for the Processing of Personal Data in the Services;
• providing Data Subjects with the transparency information required by Articles 13 and 14 GDPR;
• ensuring that Personal Data provided to Academic Software is accurate, relevant, limited to what is necessary and lawfully obtained;
• determining and documenting access rights, user roles, institutional policies and permitted use of the Services;
• responding to Data Subject requests, with assistance from Academic Software where required under this DPA;
• ensuring that no special categories of Personal Data, criminal offence data or other highly sensitive data are submitted to the Services unless such Processing has been specifically assessed and agreed in writing; and
• ensuring that Authorised Users receive appropriate instructions, including acceptable use instructions for AI-related Services where relevant.

B.1.3. The Customer acknowledges that the Services are designed primarily for educational institutions and related organisations. The Customer remains responsible for assessing whether the Services, their configuration and the Customer Content are appropriate for the Customer's intended use.

B.2 Processor obligations

B.2.1. Academic Software will Process Personal Data only in accordance with this DPA, the Agreement and the Customer's documented instructions.

B.2.2. Academic Software will ensure that persons authorised to Process Personal Data are subject to appropriate confidentiality obligations and receive appropriate information security and data protection awareness training.

B.2.3. Academic Software will implement and maintain appropriate Technical and Organisational Measures as described in Annex 2, taking into account the state of the art, costs of implementation, the nature, scope, context and purposes of Processing and the risks to the rights and freedoms of natural persons.

B.2.4. Academic Software will provide reasonable assistance to the Customer for the fulfilment of the Customer's obligations under Applicable Data Protection Laws, taking into account the nature of the Processing and the information available to Academic Software.

B.2.5. Academic Software will maintain records of Processing activities where required by Applicable Data Protection Laws and will cooperate with Supervisory Authorities to the extent required by law.

B.3 Confidentiality and personnel

B.3.1. Academic Software will ensure that its employees, contractors and other personnel who have access to Personal Data are bound by contractual or statutory confidentiality obligations.

B.3.2. Access to Personal Data will be limited to personnel who require access for the provision, support, security, administration or maintenance of the Services, applying the least-privilege principle.

B.3.3. Academic Software will maintain appropriate internal policies and procedures covering information security, acceptable use, access management, incident reporting and data protection responsibilities.

PART C — SECURITY, SUB-PROCESSING AND TRANSFERS

C.1 Security measures

C.1.1. Academic Software will implement and maintain appropriate Technical and Organisational Measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access.

C.1.2. The Technical and Organisational Measures include, as appropriate, measures relating to access control, encryption, data minimisation, system confidentiality, integrity, availability and resilience, backup and recovery, incident response, supplier management, personnel training and periodic review, as summarised in Annex 2.

C.1.3. Academic Software may update or replace Technical and Organisational Measures from time to time, provided that such updates do not materially reduce the overall level of protection for Personal Data.

C.1.4. Academic Software maintains ISO 9001:2015 certification (certified by Bureau Veritas, certificate BE014597, valid 2025–2028) for its quality management system and ISO 27001:2022 (certified by Brand Compliance, certificate BE23211, valid 2026–2029) certification for its information security management system, as indicated in Annex 2 and subject to the applicable scope statements.

C.2 Sub-processors

C.2.1. Academic Software will maintain a list of Sub-processors used for the Services, including their role and, where relevant, the country of processing. The current list is made available in Annex 3, at the published sub-processor URL, or upon request via privacy@signpost.eu.

C.2.2. Academic Software will impose written data protection obligations on each Sub-processor that are substantially equivalent to those imposed on Academic Software under this DPA, to the extent applicable to the nature of the services provided by the Sub-processor.

C.2.3. Academic Software remains responsible to the Customer for the performance of its Sub-processors' data protection obligations, subject to the liability provisions of the Agreement and this DPA.

C.2.4. Academic Software will inform the Customer of any intended addition or replacement of a Sub-processor by updating the published list, sending notice or otherwise making the information available through the agreed notification mechanism. The Customer may object on reasonable data protection grounds within the objection period specified in the Agreement or, if no period is specified, within fifteen (15) calendar days after notice.

C.2.5. If the Customer objects to a new Sub-processor on reasonable data protection grounds, Academic Software will use commercially reasonable efforts to address the objection.

C.3 International data transfers

C.3.1. Academic Software's primary Processing infrastructure for the Services is located within the EEA, unless otherwise stated in Annex 1, Annex 3 or the Agreement.

C.3.2. Where Personal Data is transferred to or accessed from a country outside the EEA that is not subject to an adequacy decision, Academic Software will ensure that appropriate safeguards are in place in accordance with Chapter V GDPR, such as Standard Contractual Clauses adopted by the European Commission, an adequacy decision where applicable, supplementary measures where required, and transfer impact assessments where appropriate.

C.3.3. The Customer authorises international transfers that are necessary for the provision of the Services and that are described in the Sub-processor list or otherwise documented in accordance with this DPA.

PART D — ASSISTANCE, RIGHTS AND BREACHES

D.1 Assistance to the Controller

D.1.1 Taking into account the nature of the Processing and the information available to Academic Software, Academic Software will reasonably assist the Customer in complying with the Customer's obligations under Articles 32 to 36 GDPR, including obligations relating to security of processing, Personal Data Breach notifications, data protection impact assessments and prior consultation with Supervisory Authorities where required.

D.1.2. Academic Software will provide assistance through Service functionality, documentation, support channels, security information, audit reports, certificates, contractual commitments and other reasonable measures.

D.1.3. Assistance that is not included in the standard Services and that requires substantial additional work may be subject to reasonable fees, unless the assistance is required due to Academic Software's breach of this DPA.

D.2 Data Subject requests

D.2.1. If Academic Software receives a request from a Data Subject relating to Personal Data processed on behalf of the Customer, Academic Software will, where the request clearly relates to the Customer's Personal Data, promptly inform the Customer or direct the Data Subject to the Customer, unless Academic Software is legally required to respond directly.

D.2.2. Academic Software will not independently respond to Data Subject requests concerning Personal Data processed as Processor, except to acknowledge receipt, direct the Data Subject to the Customer, comply with the Customer's documented instructions, or comply with applicable law.

D.2.3. Taking into account the nature of the Processing, Academic Software will assist the Customer through appropriate technical and organisational measures, insofar as possible, to enable the Customer to respond to requests for access, rectification, erasure, restriction, portability, objection and other rights under Applicable Data Protection Laws (article 15-22 GDPR).

D.3 Personal Data Breaches

D.3.1. Academic Software will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data processed on behalf of the Customer. Where feasible, Academic Software will aim to provide the initial notification within forty-eight (48) hours after awareness.

D.3.2. The notification will include, to the extent available:

D.3.3. Academic Software may provide information in phases where not all information is available at the same time.

D.3.4. Academic Software will take reasonable steps to investigate, contain, remediate and mitigate the Personal Data Breach. The Customer is responsible for determining whether notification to a Supervisory Authority or Data Subjects is required, unless Applicable Data Protection Laws impose a direct obligation on Academic Software.

D.3.5. A notification under this clause does not constitute an acknowledgement of fault or liability.

PART E — AUDIT, COMPLIANCE AND TRANSPARENCY

E.1 Audit and Compliance information

E.1.1. Academic Software will make available information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR.

E.1.2. The Customer may request an audit of Academic Software 's compliance with this DPA where the information made available under clause E.1 is insufficient to demonstrate compliance and where the audit is required by Applicable Data Protection Laws.

E.1.3. Any audit must be conducted on reasonable prior written notice, during normal business hours, by the Customer or an independent auditor who is bound by confidentiality obligations, and in a manner that does not unreasonably interfere with Academic Software's business, security, confidentiality or services to other customers.

E.1.4. Unless otherwise required by law, audits are limited to once per calendar year. The Customer bears the costs of the audit, unless the audit reveals a material breach of this DPA by Academic Software, in which case Academic Software will bear reasonable audit costs directly attributable to the breach.

E.1.5. Academic Software may refuse access to information, systems or premises where such access would compromise security, confidentiality, the rights of other customers, trade secrets, legal privilege or the integrity of Academic Software's systems. In such case, Academic Software will offer a reasonable alternative method to demonstrate compliance where possible.

E.2 Changes to this DPA and service changes

E.2.1. Academic Software may update this public DPA from time to time to reflect legal, technical, organisational or service changes, provided that no update materially reduces the level of protection for Personal Data processed on behalf of the Customer.

E.2.2. Material changes will be notified through the agreed notification mechanism, the website, customer portal, email or other appropriate channel. The latest version of this DPA will be made available through Academic Software's website or upon request.

E.2.3. If the Customer reasonably believes that a material change affects its compliance with data protection laws, it may object in writing within the applicable objection period. The Parties will then seek a reasonable solution.

PART F — RETURN, DELETION AND RETENTION

F.1 Return and Deletion of Personal Data

F.1.1. Upon termination or expiry of the Services, Academic Software will, at the Customer's choice and subject to the functionality of the Services, return or delete Personal Data processed on behalf of the Customer, unless Union or Member State law requires storage of the Personal Data.

F.1.2. The Customer must exercise any available export functionality before termination or within the agreed post-termination access period. After that period, Academic Software may delete Personal Data from active systems in accordance with its deletion procedures and Data Retention Policy.

F.1.3. Residual copies in backups or logs will be protected against unauthorised access and will be deleted or overwritten in accordance with Academic Software 's normal backup and retention cycles, unless retention is required by law.

F.1.4. Upon request, Academic Software will provide written confirmation of deletion where technically and operationally feasible, subject to legal retention obligations and backup limitations.

PART G — LIABILITY, TERM AND LEGAL PROVISIONS

G.1 Liability

G.1.1. Each Party is liable for breaches of this DPA and Applicable Data Protection Laws in accordance with the GDPR, Applicable Data Protection Laws and the Agreement.

G.1.2. Subject to mandatory law, the limitations and exclusions of liability in the Agreement apply to this DPA.

G.1.3. Nothing in this DPA limits a Party's liability to Data Subjects where such limitation is prohibited by Applicable Data Protection Laws.

G.2 Term and termination

G.2.1. This DPA takes effect when the Agreement becomes effective or when Academic Software first Processes Personal Data on behalf of the Customer, whichever occurs first.

G.2.2. This DPA remains in force for as long as Academic Software Processes Personal Data on behalf of the Customer.

G.2.3. Termination or expiry of the Agreement automatically terminates this DPA, except for provisions that must survive to give effect to their purpose, including confidentiality, audit records, return and deletion, international transfer safeguards, liability and governing law.

G.3 Order of precedence

G.3.1. In the event of conflict between this DPA and the Agreement, this DPA prevails with respect to the Processing of Personal Data as Processor, unless the Agreement expressly states that a specific provision is intended to prevail over this DPA.

G.3.2. In the event of conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses prevail for the relevant international transfer.

G.3.3. Service-specific data protection terms, security addenda or product documentation may supplement this DPA. They prevail only to the extent they provide more specific terms for the relevant Service and do not reduce the level of protection required by this DPA.

G.4 Governing law and jurisdiction

G.4.1. This DPA is governed by Belgian law, unless mandatory Applicable Data Protection Laws require otherwise.

G.4.2. All disputes arising out of or in connection with this DPA fall within the exclusive jurisdiction of the competent courts of the judicial district where Academic Software has its registered office, unless the Agreement provides for another competent forum or mandatory law requires otherwise.

G.4.3. If any provision of this DPA is found to be invalid, void or unenforceable, the remaining provisions remain in full force. The Parties will replace the affected provision with a valid and enforceable provision that most closely reflects the original intent and legal effect.

PART H – CONTACT DETAILS OF DPO

• CRANIUM NV
• privacy@signpost.eu

Annex 1 – Description of Processing Activities

This Annex describes the Processing of Personal Data by Academic Software as Processor in connection with the Services. It is designed to satisfy the information requirements under Article 28(3) GDPR. Service-specific details may be further specified in the Agreement, order form, statement of work, service documentation, customer configuration or other documented instructions.

A.1.1 Processor identity and service overview

A.1.2 Services coverd

A.1.3 Subject matter and duration

A.1.4 Nature and purpose of Processing

A.1.5 Categories of Data Subjects and Personal Data

A.1.6 Special categories of Personal Data

A.1.6.1. Academic Software does not intentionally require or request special categories of Personal Data within the meaning of Article 9 GDPR or personal data relating to criminal convictions and offences within the meaning of Article 10 GDPR for the standard Services.

A.1.6.2. The Customer is responsible for ensuring that such data is not submitted to the Services unless the Parties have specifically agreed the relevant Processing in writing, appropriate legal bases and safeguards are in place, and any required data protection impact assessment has been completed.

A.1.6.3. Because AI prompts, uploaded materials, support tickets or assessment content may be controlled by Authorised Users, the Customer should provide appropriate user instructions and internal policies to prevent unnecessary submission of special category data or confidential information.

A.1.7 Retention

A.1.8 Processing activities

The standard Processing activities for the Services include: consulting Personal Data for support and administration; storing Personal Data in hosted systems; transmitting Personal Data between platforms, integrations and Sub-processors; updating or modifying Personal Data through user management and support processes; testing configurations using appropriate safeguards; and deleting, anonymising or returning Personal Data in accordance with documented instructions.