In connection with the use of AEC Academia:

• The Customer (language school, educational institution, training center, or other organization using the Service) acts as the Data Controller of the personal data it collects, stores, and manages within the Service.

• ATL Software LLC acts as a Data Processor and processes personal data solely on behalf of and under the instructions of the Customer.

The Customer retains ownership and responsibility for all data stored within AEC Academia.

Where applicable, the processing of personal data on behalf of Customers is further governed by the AEC Academia Data Processing Addendum (DPA), available through the AEC Academia Trust Center.

Depending on how the Customer uses the Service, the following categories of personal data may be processed:

• Student identification and contact information;

• Teacher and instructor identification and contact information;

• Administrative staff information;

• Prospect and contact information;

• Billing and financial information;

• Academic and administrative records;

• Enrollment, course, class, and scheduling information;

• Files and documents uploaded by the Customer;

• User account and authentication information.

In some cases, personal data relating to minors may be processed where the Customer uses the Service to manage educational programs involving minors.

Personal data is processed solely for the purpose of:

• Providing and operating the Service;

• Supporting the Customer’s educational and administrative activities;

• Managing user authentication and access control;

• Delivering customer support;

• Maintaining, securing, and improving the Service;

• Performing backups and disaster recovery operations;

• Complying with applicable legal obligations.

ATL Software LLC does not use Customer data for advertising purposes.

ATL Software LLC does not sell Customer data to third parties.

ATL Software LLC does not use Customer data to train artificial intelligence models, machine learning systems, or similar technologies.

Data processed through AEC Academia is hosted using infrastructure and service providers selected by ATL Software LLC.

The primary subprocessors used in connection with the Service are identified in the Subprocessor List available within the AEC Academia Trust Center.

Depending on operational and architectural requirements, Customer data may be hosted in Canada, France, Singapore, or other locations operated by approved service providers.

ATL Software LLC may transfer personal data internationally as necessary to provide the Service. Appropriate contractual, organizational, and technical safeguards are implemented where required by applicable data protection laws.

ATL Software LLC implements appropriate technical and organizational measures designed to protect personal data against:

• Unauthorized access;

• Unauthorized disclosure;

• Alteration;

• Accidental loss;

• Destruction.

Additional information regarding security controls and practices is available in the Security Overview document available within the AEC Academia Trust Center.

Access to Customer data by authorized ATL Software LLC personnel is limited to situations where such access is necessary to:

• Provide technical support requested by the Customer;

• Maintain and operate the Service;

• Investigate and resolve technical incidents;

• Protect the security, availability, and integrity of the Service.

Authorized personnel are subject to appropriate confidentiality obligations. Access is granted on a needto-know basis and limited to personnel whose duties require such access.

Customer data remains available throughout the term of the applicable service agreement.

Following termination of the Service, Customer data is generally retained for a period of thirty (30) days to allow the Customer to retrieve its information, unless otherwise agreed between the parties or required by applicable law.

After this retention period, Customer data is deleted in accordance with ATL Software LLC’s internal data management procedures.

Requests relating to data subject rights, including access, correction, deletion, restriction, objection, or data portability, should generally be directed to the Customer acting as Data Controller.

If ATL Software LLC receives a request directly concerning personal data processed on behalf of a Customer, ATL Software LLC may refer the request to the relevant Customer for handling in accordance with applicable data protection laws.

For questions regarding privacy, data protection, or the processing of personal data within AEC Academia, please contact:

ATL Software LLC

Email: [email protected]