DPA

This Data Processing Agreement ("DPA") is incorporated into each Agreement between Articulate Global, LLC (together with its Affiliates, "Articulate") and the customer ("Customer", "you", "your") for Articulate's provision of the Services, as defined below. Customer enters into this DPA on behalf of itself and any of its Affiliates that it permits to use the Services pursuant to the Agreement ("Authorized Affiliate"). Articulate and Customer are each referred to individually as a "party" and collectively as the "parties".

1. Definitions

For purposes of this DPA, capitalized terms have the meanings set forth below. Other capitalized terms have the meaning set forth in the Agreement.

1.1 "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with a party to this DPA.

1.2 "Agreement" means the underlying agreement(s) entered into by Articulate and Customer in writing for Articulate's provision of Services to Customer.

1.3 "Applicable Law" means all laws, regulations and other legal requirements applicable to either (i) Articulate in its role as provider of the Services or (ii) you. This may include, for example, the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"); equivalent requirements in the United Kingdom including the UK General Data Protection Regulation and the Data Protection Act 2018 ("UK Data Protection Law"); the California Consumer Privacy Act and associated regulations ("CCPA"), and the California Privacy Rights Act and its implementing related regulations when effective ("CPRA"); the Personal Information Protection and Electronic Documents Act, SC 2000, c.5 ("PIPEDA"); Australia's Privacy Act 1988 and the Australian Privacy Principles (the "Privacy Act"); the Virginia Consumer Data Protection Act when effective ("VCDPA"); the Utah Consumer Privacy Act when effective ("UCPA"), and the Colorado Privacy Act and related regulations when effective ("CPA"). Each party is responsible only for the Applicable Law applicable to it.

1.4 "Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data.

1.5 "Customer Content" (or "Your Content") refers to all content and information that Customer, an Authorized Affiliate, or a User uploads, imports, or develops in or to the Services, or that Articulate otherwise receives by or through the Services from Customer, an Authorized Affiliate, or a User.

1.6 "Data Subject" means an identified or identifiable natural person. Where the CCPA or CPRA apply, the term also includes an identified or identifiable household.

1.7 "Personal Data" means (i) any information relating to an identified or identifiable individual, within the meaning of the GDPR (regardless of whether the GDPR applies); (ii) "personal data" within the meaning of the VCDPA and CPA (regardless of whether they apply); (iii) "personal information" within the meaning of PIPEDA, the CCPA, the CPRA, and the Privacy Act (regardless of whether they apply); and (iv) any analogous term as defined in Applicable Law.

1.8 "Personal Data Breach" means the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.

1.9 "Process" and "Processing" mean any operation or set of operations performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, creating, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

1.10 "Processor" means a natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of the Controller.

1.11 "Services" means Articulate's software-as-a-service offering as set forth in a price quote (i.e., Articulate 360, Rise, or both), or other services identified in a price quote.

1.12 "Standard Contractual Clauses" and "2021 SCCs" mean the clauses issued pursuant to the EU Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj and completed as described in the "Data Transfers" section below.

1.13 "Subprocessor" means any subcontractor engaged by Articulate for the Processing of Personal Data.

1.14 "Trust & Compliance Documentation" means the documentation regarding privacy, data security, and Subprocessor information applicable to the specific Services purchased by Customer, as may be updated periodically, and accessible via Articulate's website at https://www.articulate.com/trust/ and https://www.articulate.com/trust/gdpr/

1.15 "UK SCC Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (available as of the Effective Date at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-data-transfer-agreement-and-guidance/), completed as set forth in the "Data Transfers" section below.

1.16 "User" means an individual or individuals that Customer permits to access and use the Services.

2. Scope and Relationship of the Parties

2.1 This DPA applies only to the Personal Data in Customer Content.

2.2 For such Personal Data, you are (or you represent that you are acting with full authority on behalf of) the Controller, and Articulate is your Processor.

2.3 If you are acting on behalf of a third-party Controller (or on behalf of intermediaries such as other Processors of the Controller), to the extent legally permissible:

3. Your Instructions to Articulate

3.1 Articulate will Process the Personal Data only as described in the Agreement, unless obligated to do otherwise by Applicable Law. In such case, Articulate shall inform you of that legal requirement before the Processing unless legally prohibited from doing so.

3.2 The details of the Processing are set forth in Attachment 1 to this DPA.

3.3 The Agreement, including this DPA, along with your configuration of any settings or options in the Services, constitute your complete and final instructions to Articulate regarding the Processing of Personal Data, including for purposes of the Standard Contractual Clauses, if they apply.

3.4 You will comply with Applicable Law relevant to your use of the Services, including by obtaining any consents and providing any notices required under Applicable Law for Articulate to provide the Services. You will ensure that you are entitled to transfer the Personal Data to Articulate so that Articulate and its Subprocessors may lawfully Process the Personal Data in accordance with this DPA.

3.5 You shall not instruct Articulate to Process Personal Data in violation of Applicable Law. Articulate shall promptly inform you if, in Articulate's opinion, an instruction from you infringes Applicable Law.

4. Data Use Limitation

4.1 Articulate will not "sell" Personal Data as such term is defined under the CCPA (regardless of whether the CCPA applies), VCDPA, or the CPA, and will not "share" Personal Data within the meaning of the CPRA (regardless of whether the CPRA applies). Articulate will not retain, use, or disclose Personal Data outside of the direct business relationship between Customer and Articulate.

4.2 In the case of a legal obligation to provide Personal Data to a third party, to the extent legally permitted: (i) Articulate will promptly provide Customer a reasonable opportunity to contest the legal obligation or to seek protection for the disclosure and (ii) Articulate, after consultation with Customer, will disclose only the minimum amount of Personal Data necessary to comply with the legal obligation.

4.3 Articulate will comply with any applicable restrictions under the CPRA on combining Personal Data in Customer Content with Personal Data that Articulate receives from, or on behalf of, another person or persons, or that Articulate collects from any interaction between it and a Data Subject.

5. Subprocessors

5.1 Articulate may engage Subprocessors to Process Personal Data in connection with providing the Services, in compliance with Applicable Law. Prior to a Subprocessor's Processing of Personal Data, Articulate will impose contractual obligations on the Subprocessor that are substantially the same as those imposed on Articulate under this DPA. Articulate is liable for its Subprocessors' performance to the same extent Articulate is liable for its own performance under the Agreement.

5.2 A current list of Subprocessors is available below.  Articulate will promptly (and in any event, thirty (30) days before a new Subprocessor is scheduled to begin Processing Personal Data) provide notice to Customers by updating the aforementioned subprocessor list(s) regarding any such new Subprocessor prior to its Processing of Personal Data, unless exigent circumstances (such as the failure of an existing Subprocessor) require their earlier Processing of Personal Data.

Third-Party Subprocessor	Purpose	Applicable Service	Products	Data Center Subprocessor Locations
Ada	Chatbot	Provides chat support services	Articulate 360	USA
Amazon Web Services, Inc.	Hosting & Infrastructure	Provides on-demand cloud computing platforms and APIs	Articulate 360 Rise	USA EU
Browserless	Web automation	Generates customer-requested screenshots, PDFs, and certificates	Articulate 360 Rise	USA
BugSnag	Monitoring Services	Troubleshoots problems with product services	Articulate 360 Rise	USA
Datadog	Analytics	Troubleshoots problems with product services	Articulate 360 Rise	USA
ElevenLabs	Optional AI Voice Generation	Converts text to speech	Articulate 360	USA
Intercom	Support Services	Provides in-app announcements and product tours	Articulate 360 Rise	USA
Looker Data Sciences	Analytics	Provides organizational business intelligence	Articulate 360 Rise	USA
Okta, Inc.	Authentication Services	Validates if a customer is authorized to sign in	Articulate 360 Rise	USA
OpenAI	Optional AI Services	Powers Articulate 360 AI features	Articulate 360	USA
Postmark	Email Delivery	Sends email notifications to learners or subject matter experts	Articulate 360 Rise	USA
RingCentral	Sales Communications	Provides AI-powered cloud contact center	Articulate 360	USA
Salesforce	CRM	Manages customer interactions and sales data	Articulate 360 Rise	USA
TalkDesk	Sales Systems	Provides AI-powered cloud contact center	Rise	USA
YouTrack	Issue Tracking System	Tracks software bugs and feature requests	Rise	USA

5.3 You may object to Articulate's use of a new Subprocessor by notifying Articulate within ten (10) business days after Articulate notifies you of the new Subprocessor pursuant to Section 5.2. If you reasonably object to a new Subprocessor, Articulate will use reasonable efforts to make available to you a change in the Services or recommend a commercially-reasonable change to your configuration or use of the Services to avoid Processing of Personal Data by the objected-to new Subprocessor without unreasonably burdening you. If Articulate is unable to make available such change within a reasonable time period, which shall in no event exceed thirty (30) days, you may terminate the Agreement and/or applicable order(s) by providing written notice to Articulate and ceasing use of the Services on the effective date of the termination. Articulate will refund you a prorated amount covering the remainder of the term of such subscription or order(s) following the effective date of termination with respect to such terminated Services. If you do not object to use of the new Subprocessor and terminate as set forth above, the Subprocessor is deemed to be accepted by you.

5.4 Your agreement to this Section 5 constitutes your consent under the Standard Contractual Clauses, if they apply, and to Processing of Personal Data by the Subprocessors that are listed in this DPA as of the effective date of the Agreement.

5.5 Upon written request, Articulate will provide to Customer copies of Subprocessor agreements; provided, however, that to the extent that such Subprocessor agreements contain commercial information or provisions unrelated to information required by applicable Data Protection Laws and Regulations, such unrelated information may be removed or redacted by Articulate in its discretion.

6. Security

6.1 Articulate will assist you in your compliance with the security obligations of the GDPR and other Applicable Law, as relevant to Articulate role in Processing the Personal Data, taking into account the nature of Processing and the information available to Articulate, by implementing technical and organizational measures described in Attachment 2 to this DPA, without prejudice to Articulate's right to make future replacements or modifications to the measures that do not materially lower the level of security of the Personal Data.

6.2 You are solely responsible for reviewing any available security documentation and features (if available) and evaluating for yourself whether the Services and related security meet your needs, including your security obligations under Applicable Law. You may use the Services only if the security commitments in this DPA would provide a level of security appropriate to the risk in respect of the Personal Data. By signing this DPA, Customer agrees and represents that the security commitments in this DPA provide a level of security appropriate to the risk in respect of the Personal Data.

6.3 Articulate will ensure that the individuals Articulate authorizes to Process the Personal Data (i) are subject to a written confidentiality agreement covering such data or are under an appropriate statutory obligation of confidentiality and (ii) receive training appropriate to their role in the Processing of the Personal Data.

7. Personal Data Breach Notification

7.1 Articulate and Customer will comply with the Personal Data Breach-related obligations directly applicable to them under the GDPR and other Applicable Law, including any obligations to notify Data Subjects, government authorities, or third parties.

7.2 Taking into account the nature of Processing and the information available to Articulate, Articulate will reasonably assist you in complying with the Personal Data Breach-related obligations applicable to you under Applicable Law by informing you without undue delay after becoming aware of a confirmed Personal Data Breach. Such notification is not an acknowledgement of fault or responsibility. To the extent available, this notification will include Articulate's then-current assessment of the following, which may be based on incomplete information:

7.3 Articulate shall make reasonable efforts to identify the cause of a confirmed Personal Data Breach and take such remediation measures as Articulate deems necessary and reasonable.

7.4 At all times, Customer has the right to take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Information.

8. Assistance Responding to Data Subjects

8.1 If Articulate receives a Data Subject Request or complaint directed to Customer or an Authorized Affiliate, Articulate will forward the Data Subject Request or complaint to Customer promptly.

8.2 Taking into account the nature of the Processing, Articulate will reasonably assist you with the fulfillment of your obligation to honor requests by individuals to exercise their rights under the GDPR or other Applicable Law (such as rights to access their Personal Data) ("Data Subject Request") by appropriate organizational and technical measures, insofar as possible. To the extent that you, in your use of the Services, are unable to address a Data Subject Request, Articulate will upon your request provide commercially reasonable efforts to assist you in responding to such Data Subject Request, to the extent that Articulate is required to do so under Applicable Law and is legally authorized to do so.

9. Assistance with DPIAs and Consultation with Supervisory Authorities

9.1 Taking into account the nature of the Processing and the information available to Articulate, Articulate will, upon your written request, provide reasonable assistance and cooperation to you for your performance of any legally required data protection impact assessment of the Processing or proposed Processing of the Personal Data in connection with the Services, and with related consultation with supervisory authorities. Additional support for data protection impact assessments or relations with regulators will require mutual agreement on fees, the scope of Articulate's involvement, and any other terms that the parties deem appropriate.

10. Data Transfers

10.1 You authorize Articulate and its Subprocessors to make international transfers of the Personal Data in accordance with this DPA and Applicable Law.

10.2 To the extent otherwise legally required, the 2021 SCCs form part of this DPA and take precedence over the rest of this DPA to the extent of any conflict, and (except as described in Section 10.4) they will be deemed completed as follows:

10.3 To the extent legally required under UK Data Protection Law, the UK SCC Addendum forms part of this DPA and takes precedence over the rest of this DPA as set forth in the UK SCC Addendum. Undefined capitalized terms used in this Section 10.3 shall have the definitions set forth in the UK SCC Addendum. For purposes of the UK SCC Addendum:

10.4 For transfers of Personal Data that are subject to the Swiss Federal Act on Data Protection ("FADP"), the 2021 SCCs form part of this DPA as set forth in Section 10.2 of this DPA, but with the following differences to the extent required by the FADP:

11. Audits

11.1 Upon your written request, Articulate will make available to you all information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits including inspections, conducted by you or another auditor mandated by you, as follows:

12. Return or Destruction

12.1 Articulate will, at your choice, return to you and/or destroy all Personal Data upon your request or six months after the termination or expiration of your use of the relevant Service except to the extent Applicable Law requires storage of the Personal Data. The certification of deletion required by the Standard Contractual Clauses (if they apply) will be provided only on written request.

12.2 Nothing will oblige Articulate to delete Personal Data from files created for security, backup and business continuity purposes sooner than required by Articulate's reasonable data retention processes.

13. General

13.1 Assignment. This DPA shall inure to the benefit of, and be binding upon, any successor to all or substantially all of the business and assets of either party, whether by merger, sale of assets, or other agreements or operation of law.

13.2 Counterparts; Facsimile Signatures. This DPA may be executed in multiple counterparts, each of which, when executed and delivered, shall be deemed an original, but all of which shall constitute one and the same instrument. Any signature page of any such counterpart, or any facsimile transmission thereof, may be attached or appended to any other counterpart to complete a fully executed counterpart of this DPA, and any facsimile transmission of any signature of a party shall be deemed an original and shall bind such party.

13.3 Order of Precedence. With respect to the rights and obligation of the parties vis-à-vis each other, in the event of a conflict between the terms of the Agreement and this DPA, the terms of this DPA will control. In the event of a conflict between the terms of this DPA and the Standard Contractual Clauses, the terms of the Standard Contractual Clauses will control.

13.4 Liability. To the extent legally permitted, this DPA is subject to the limitations of liability clause in the Agreement.

13.5 Miscellaneous. This DPA constitutes the entire understanding of the parties with respect to the subject matter of this DPA and merges all prior communications, understandings, and agreements. This DPA may be modified only by a written agreement signed by the parties. The failure of either party to enforce at any time any of the provisions hereof shall not be a waiver of such provision, or any other provision, or of the right of such party thereafter to enforce any provision hereof. If any provision of this DPA is declared invalid or unenforceable, such provision shall be deemed modified to the extent necessary and possible to render it valid and enforceable. In any event, the unenforceability or invalidity of any provision shall not affect any other provision of this DPA, and this DPA shall continue in full force and effect, and be construed and enforced, as if such provision had not been included, or had been modified as above provided, as the case may be.

Subject Matter, Nature and Purpose of Processing, and details of processing operations: Provision of the Services pursuant to the Agreement.

Term/Duration of Processing: As set forth in the Agreement and/or any applicable Price Quote, Customer order, or Statement of Work.

Categories of Data Subjects: The Personal Data transferred may concern current and prospective employees of the exporter and its contractors, and other third parties, as determined by the exporter.

Categories of Data

For Articulate 360 and Rise:

• First and Last Name
• Employer
• Business Contact Information (e.g., email address; phone number)
• Profile Image
• Title
• Approximate Location
• Language Preference
• Professional Biography

Special Categories of Data (if any): Not applicable.

Applied safeguards and restrictions specific to any special categories of data: Not applicable. In any case, the same high standard of protection described in Attachment 2 to the DPA applies to this and other categories of Personal Data.

The frequency of the transfer (e.g., whether the data is transferred on a one-off or continuous basis): Continuous for as long as necessary to provide the Services pursuant to the Agreement.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: The lesser of six (6) months, as long as needed to provide the Services pursuant to the Agreement, or as long as required by Applicable Law.

Articulate (the data importer) implements the following technical and organizational security measures.

1. Pseudonymisation and encryption: Personal data is encrypted at rest on our servers using industry standards (e.g., AES 256-bit), and key management is managed by Articulate's hosting environment provider, Amazon Web Services (AWS).
2. Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services: Articulate uses an intrusion detection system to analyze, detect, and report network events and other alert situations, and engages a third-party partner(s) to conduct security and application assessments. Articulate also uses Amazon Web Services (AWS) as its hosting provider, which provides redundancies (e.g., across three (3) or more physically isolated and resource independent availability zones).
3. Disaster recovery and business continuity measures (restoring the availability and access to personal data in the event of a physical or technical incident): Articulate has a disaster recovery policy and related procedures which provide that Articulate, in the event of a disaster, will rebuild its infrastructure to restore services as quickly as possible with an RTO of 72 hours and RPO of 24 hours.
4. Testing, assessment, and evaluation of security measures: Articulate has an incident response policy that is tested at least annually, or whenever there is a material change to our security.
5. User identification and authorization: Articulate 360 services do not store user credentials; instead, it relies on a third-party single sign-on service that implements tested and industry-accepted identity protocols to authenticate users, including encryption at rest using a minimum of AES-256 cryptographic strength.
6. Protection of data during transmission: Confidential data is encrypted in transit using at a minimum the Transport Layer Security protocol of TLS 1.2.
7. Protection of data during storage: Confidential data is encrypted at rest on our servers using the Advanced Encryption Standard 256-bit industry standard. Key management is managed by Articulate's hosting environment provider, AWS.
8. Physical security of locations at which personal data are processed: Articulate is a fully distributed company, meaning we do not have physical offices. We host Articulate services on AWS servers. AWS data centers are state of the art, using innovative architectural and engineering approaches, are housed in nondescript facilities, and physical access is strictly controlled both at the perimeter and at building ingress points (e.g., professional security staff, video surveillance).
9. Events logging: Articulate uses SIEM solutions in alignment with defined standards for log centralization and alerting functionalities, and AWS CloudWatch and AWS CloudTrail to track all changes in infrastructure
10. System configuration, including default configuration: Articulate codifies all infrastructure changes in version control and uses industry best practices for safely and securely applying these changes to Articulate services.
11. Internal IT and IT security governance and management: Articulate employees sign confidentiality agreements and complete security training upon hire, and security training continues annually thereafter. Articulate has policies and procedures on proper data protection, management, retention, and deletion. Articulate also uses state-of-the art antivirus and mobile device management software on all Articulate workstations, monitors vendor and third-party sources for updated vulnerability information, distributes pertinent patch information promptly, and requires that the workstations for all Engineering team members and others who have access to AWS (our host) servers be encrypted at rest.
12. Certification/assurance of processes and products: Articulate undergoes an annual SOC2 Type 2 audit conducted by a third party and has ISO 27001 and ISO 27701 certifications. Employees are required to complete security awareness training upon hire and annually thereafter to understand their obligations and responsibilities in complying with corporate policies that are designed to protect customer data.
13. Data minimization: Articulate collects personal data necessary to provide services to customers and grants access to personal data only if necessary to enable human resources to perform their jobs. Articulate also periodically reviews access privileges and removes privileges within 24 hours of a person being terminated from Articulate. Further, personal data is retained and securely destroyed in accordance with Articulate's data retention policies (or earlier upon customer request), so long as there is no legal requirement to retain such data.
14. Data quality: Articulate services validate user input and HTTP parameters.
15. Limited data retention: Articulate has retention policies that require regular deletion of personal data. Articulate performs daily backups as part of our disaster recovery process, which data is archived for approximately 60 days and then is automatically overwritten.
16. Accountability: Articulate has implemented a privacy program, appointed a Data Privacy Officer, implemented privacy policies and practices (including on incident response), and conducts employee trainings at least annually.
17. Data portability and erasure: Articulate abides by the processes set forth in its Data Processing Agreement for responding to customer requests for a copy, correction, or deletion of their end users' personal data.
18. For transfers to (sub-) processors: specific technical and organizational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter: The exporter's administrators and/or users can use self-service features in the Services for accessing, deleting, or correcting data about end users. All other relevant assistance would be provided through the customer support team.