Data Processing Addendum – The UD Project

Effective Date: October 15, 2025
Version: 1.0

1. Introduction and Scope

This Data Processing Addendum (“DPA”) forms part of the Terms of Service (the “Agreement”) between Pruett & Co., LLC, DBA The UD Project (“UD Project,” “we,” “us,” “Processor”) and the entity or person agreeing to these terms (“Customer,” “you,” “Controller”) to reflect the parties’ agreement with regard to the Processing of Personal Data.

1.1 Application

This DPA applies where and only to the extent that:

UD Project processes Personal Data on behalf of the Customer
The processing is subject to Data Protection Laws
The Customer acts as a Controller and UD Project acts as a Processor

1.2 Hierarchy

In the event of any conflict or inconsistency between this DPA and the Agreement, this DPA shall take precedence to the extent of such conflict or inconsistency with respect to the Processing of Personal Data.

1.3 Incorporation of Standard Contractual Clauses

To the extent that UD Project processes Personal Data originating from the European Economic Area (“EEA”), United Kingdom, or Switzerland, the Standard Contractual Clauses approved by the European Commission (as set forth in Annex II) are incorporated into and form part of this DPA.

2. Definitions

For the purposes of this DPA:

“Controller” means the entity which determines the purposes and means of the Processing of Personal Data.

“Data Protection Laws” means all applicable laws and regulations relating to privacy and data protection, including but not limited to:

EU General Data Protection Regulation 2016/679 (“GDPR”)
UK Data Protection Act 2018 and UK GDPR
California Consumer Privacy Act (“CCPA”) and California Privacy Rights Act (“CPRA”)
Virginia Consumer Data Protection Act (“VCDPA”)
Any other applicable U.S. state privacy laws

“Data Subject” means an identified or identifiable natural person.

“Personal Data” means any information relating to an identified or identifiable natural person that is processed by UD Project on behalf of Customer pursuant to or in connection with the Agreement.

“Processing” means any operation or set of operations performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction.

“Processor” means the entity which processes Personal Data on behalf of the Controller.

“Standard Contractual Clauses” or “SCCs” means the standard data protection clauses for the transfer of Personal Data to third countries approved by the European Commission.

“Sub-processor” means any Processor engaged by UD Project to process Personal Data on behalf of Customer in connection with the Agreement.

“Supervisory Authority” means an independent public authority established by an EU Member State or other jurisdiction pursuant to Data Protection Laws.

3. Roles and Scope of Processing

3.1 Roles of the Parties

The parties acknowledge and agree that:

Customer is the Controller of Personal Data
UD Project is the Processor of Personal Data
Each party will comply with the obligations applicable to it under Data Protection Laws

3.2 Customer’s Processing Instructions

UD Project shall process Personal Data only:

On documented instructions from Customer, including as set forth in this DPA and the Agreement
To provide the Services as described in the Agreement
As otherwise agreed to in writing by the parties

The parties agree that the Agreement (including this DPA) constitutes Customer’s complete and final documented instructions to UD Project for the Processing of Personal Data. Any additional or alternate instructions must be agreed to in writing.

3.3 Processing Details

Subject Matter of Processing: Provision of online educational platform services, including course hosting, user account management, payment processing, and community discussion features.

Duration of Processing: The term of the Agreement, plus the period required for deletion or return of Personal Data after termination.

Nature and Purpose of Processing:

Hosting and delivering online courses
Managing user accounts and authentication
Processing payments and subscriptions
Facilitating community discussions
Providing customer support
Analyzing platform usage and performance
Sending transactional and marketing communications

Types of Personal Data:

Identity data: name, username
Contact data: email address, billing zip code/country
Technical data: IP address, device identifiers, browser information
Usage data: course enrollment, completion data, assessment scores
Transaction data: payment information (processed via third-party payment processors)
Content data: user-generated content in community discussions

Categories of Data Subjects:

Course participants and learners
Community discussion participants
Customer account administrators
Website visitors

See Annex I for complete processing details.

3.4 Compliance with Laws

UD Project shall process Personal Data in compliance with applicable Data Protection Laws. If UD Project becomes aware that it cannot process Personal Data in accordance with Data Protection Laws, it shall immediately inform Customer.

3.5 Prohibited Data

Customer shall not provide, and UD Project shall not be required to process:

Special categories of Personal Data under GDPR Article 9 (e.g., health data, biometric data, genetic data)
Personal Data related to criminal convictions or offenses
Personal Data of children under 16 years of age (or applicable age under local Data Protection Laws)
Protected Health Information (PHI) under HIPAA

Customer warrants that it will not submit such data to UD Project’s systems. If such data is discovered, UD Project reserves the right to delete it immediately.

4. UD Project’s Obligations as Processor

4.1 Confidentiality

UD Project shall ensure that all personnel authorized to process Personal Data:

Are subject to appropriate confidentiality obligations
Receive adequate training on data protection
Process Personal Data only as necessary to provide the Services

4.2 Security Measures

UD Project shall implement and maintain appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, as described in Annex III.

Security measures include:

Encryption of data in transit (TLS/SSL) and at rest
Access controls and authentication mechanisms
Regular security assessments and penetration testing
Secure development practices
Employee security training
Incident response procedures
Regular backups and disaster recovery planning

UD Project shall regularly review and update security measures as appropriate.

4.3 Sub-processors

4.3.1 Authorization

Customer provides general authorization for UD Project to engage Sub-processors to process Personal Data, provided that:

UD Project maintains a current list of Sub-processors (Annex IV)
UD Project notifies Customer of any intended changes concerning addition or replacement of Sub-processors
Customer has the opportunity to object to such changes

4.3.2 Sub-processor Obligations

UD Project shall:

Enter into a written agreement with each Sub-processor imposing data protection obligations substantially similar to this DPA
Remain fully liable to Customer for the performance of Sub-processor obligations
Ensure Sub-processors only access Personal Data necessary to perform their specific functions

4.3.3 List of Sub-processors

Current Sub-processors are listed in Annex IV.

4.3.4 Notification and Objection

UD Project shall provide Customer with at least 30 days’ advance notice of any new Sub-processor. Customer may object to a new Sub-processor on reasonable grounds relating to data protection by notifying UD Project in writing within 15 days of notice.

If Customer objects, the parties shall work together in good faith to find a commercially reasonable solution. If no solution is found, Customer may terminate the affected Services without penalty.

4.4 Data Subject Rights

4.4.1 Assistance

UD Project shall, taking into account the nature of the Processing, provide reasonable assistance to Customer to fulfill Customer’s obligations to respond to requests from Data Subjects exercising their rights under Data Protection Laws, including:

Right of access
Right to rectification
Right to erasure (“right to be forgotten”)
Right to restriction of processing
Right to data portability
Right to object
Rights related to automated decision-making

4.4.2 Data Subject Requests

If UD Project receives a request directly from a Data Subject, UD Project shall:

Not respond to the request without Customer’s prior written authorization
Promptly notify Customer of the request
Provide reasonable assistance to Customer in responding

4.4.3 Fees

UD Project may charge reasonable fees for assistance with complex or excessive Data Subject requests, particularly those requiring significant technical effort.

4.5 Data Breach Notification

4.5.1 Notification Obligation

UD Project shall notify Customer without undue delay and in any event within 72 hours after becoming aware of a Personal Data breach affecting Customer’s Personal Data.

4.5.2 Notification Contents

The notification shall include, to the extent possible:

Description of the nature of the breach
Categories and approximate number of Data Subjects affected
Categories and approximate number of Personal Data records affected
Name and contact details of UD Project’s data protection contact
Description of likely consequences of the breach
Measures taken or proposed to address the breach and mitigate its possible adverse effects

4.5.3 Investigation and Cooperation

UD Project shall:

Investigate the breach promptly and thoroughly
Take reasonable steps to mitigate the effects and minimize harm
Provide Customer with reasonable cooperation and assistance
Document the breach and remediation efforts

4.6 Data Protection Impact Assessments and Consultations

UD Project shall provide reasonable assistance to Customer with:

Data Protection Impact Assessments (DPIAs) where required under Data Protection Laws
Prior consultations with Supervisory Authorities
Other compliance assessments related to the Processing

UD Project may charge reasonable fees for such assistance.

4.7 Deletion or Return of Personal Data

4.7.1 Upon Termination

Upon termination or expiration of the Agreement, UD Project shall, at Customer’s choice:

Delete all Personal Data, or
Return all Personal Data to Customer in a commonly used, machine-readable format

4.7.2 Timing

Deletion or return shall occur within 30 days of termination unless:

Longer retention is required by applicable law
Personal Data is stored in backup systems (which shall be deleted in accordance with UD Project’s standard backup deletion schedule, not to exceed 90 days)

4.7.3 Certification

Upon request, UD Project shall provide written certification that Personal Data has been deleted or returned.

4.7.4 Retention Exceptions

UD Project may retain Personal Data to the extent and for such period as required by applicable law, provided that UD Project ensures confidentiality and processes such Personal Data only as necessary for the purpose(s) specified in the applicable law.

4.8 Audit Rights

4.8.1 Customer Audit Rights

UD Project shall make available to Customer all information necessary to demonstrate compliance with this DPA and Data Protection Laws, and allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer.

4.8.2 Audit Process

Audits shall be conducted:

Upon reasonable advance notice (at least 30 days)
No more than once per year, unless required by Data Protection Laws or following a Data breach
During regular business hours
With minimal disruption to UD Project’s operations
Subject to reasonable confidentiality obligations

4.8.3 Audit Fees

Customer shall bear all costs associated with audits, including UD Project’s reasonable fees for time and resources spent facilitating the audit.

4.8.4 Alternative to Audit

As an alternative to on-site audits, UD Project may provide:

Industry-standard security certifications (e.g., SOC 2, ISO 27001)
Third-party audit reports
Completed security questionnaires
Other documentation demonstrating compliance

5. International Data Transfers

5.1 General

UD Project may transfer Personal Data to countries outside the EEA, United Kingdom, or Switzerland. When making such transfers, UD Project shall ensure that appropriate safeguards are in place as required by Data Protection Laws.

5.2 Transfer Mechanisms

Personal Data transfers to countries not recognized by the European Commission as providing adequate protection shall be governed by:

Standard Contractual Clauses (Annex II), or
Other valid transfer mechanisms under Data Protection Laws

5.3 Additional Safeguards

In addition to the Standard Contractual Clauses, UD Project implements supplementary measures including:

Strong encryption for data in transit and at rest
Strict access controls and authentication
Contractual obligations with all Sub-processors
Regular security assessments
Transparency regarding data locations

5.4 Government Access Requests

If UD Project receives a legally binding request from a government authority for access to Personal Data, UD Project shall:

Promptly notify Customer (unless legally prohibited)
Challenge overbroad or unlawful requests where possible
Limit disclosure to what is legally required
Document all such requests and responses

6. Liability and Indemnification

6.1 Liability Allocation

Each party’s liability under this DPA shall be subject to the limitations and exclusions of liability set forth in the Agreement.

6.2 Indemnification by UD Project

UD Project shall indemnify, defend, and hold harmless Customer from and against all claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys’ fees) arising out of:

UD Project’s breach of this DPA
UD Project’s violation of Data Protection Laws in connection with processing Personal Data
UD Project’s failure to comply with documented instructions

6.3 Indemnification by Customer

Customer shall indemnify, defend, and hold harmless UD Project from and against all claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys’ fees) arising out of:

Customer’s breach of this DPA
Customer’s violation of Data Protection Laws
Customer’s processing instructions that violate Data Protection Laws
Customer’s provision of prohibited data types (Section 3.5)

7. Term and Termination

7.1 Term

This DPA shall commence on the Effective Date and continue for so long as UD Project processes Personal Data on behalf of Customer.

7.2 Termination

Either party may terminate this DPA:

Upon termination of the underlying Agreement
If the other party materially breaches this DPA and fails to cure within 30 days of written notice
As permitted under Section 4.3.4 (Sub-processor objection)

7.3 Effect of Termination

Upon termination:

UD Project shall cease all processing of Personal Data
UD Project shall delete or return Personal Data as specified in Section 4.7
The terms of this DPA that by their nature should survive termination shall remain in effect

8. Miscellaneous

8.1 Governing Law

This DPA shall be governed by the same governing law as the Agreement, except where Data Protection Laws require otherwise.

8.2 Amendments

UD Project may update this DPA from time to time to reflect:

Changes in Data Protection Laws
Guidance from Supervisory Authorities
Changes in UD Project’s data processing practices

UD Project will notify Customer of material changes at least 30 days in advance. Continued use of the Services after such notice constitutes acceptance.

8.3 Severability

If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.

8.4 Entire Agreement

This DPA, together with the Agreement and its incorporated policies, constitutes the entire agreement between the parties regarding the Processing of Personal Data.

8.5 Contact Information

For questions about this DPA or data processing practices:

Data Protection Contact:
Email: [email protected]
Phone: (540) 908-3473

Mailing Address:
Pruett & Co., LLC, DBA The UD Project
8401 Mayland Drive, Suite A
Richmond, Virginia 23294
United States

ANNEX I: DETAILS OF PROCESSING

A. List of Parties

Controller:

Name: [Customer Name]
Address: [Customer Address]
Contact: [Customer Contact Information]
Role: Controller

Processor:

Name: Pruett & Co., LLC, DBA The UD Project
Address: 8401 Mayland Drive, Suite A, Richmond, Virginia 23294, United States
Contact: [email protected], (540) 908-3473
Role: Processor

B. Description of Transfer

Categories of Data Subjects:

Course participants and learners
Community discussion participants
Customer account administrators
Website visitors

Categories of Personal Data:

Identity data: full name, username
Contact data: email address, billing zip code/country of residence
Technical data: IP address, device identifiers, web browser information
Usage data: page views, browsing history, course enrollment, completion status, assessment scores, time spent on platform
Transaction data: transaction amounts, dates, payment method type (full payment details processed by third-party payment processors)
Content data: comments, posts, and other user-generated content in community discussions
Communication data: correspondence with customer support

Sensitive Data (if applicable): None. UD Project does not process special categories of data under GDPR Article 9 or PHI under HIPAA.

Frequency of Transfer: Continuous during the term of the Agreement

Nature of Processing:

Collection and storage of Personal Data
Hosting and delivering online educational content
Managing user authentication and access
Facilitating community discussions
Processing payments via third-party processors
Sending transactional and marketing communications
Providing customer support
Analyzing platform usage for improvement

Purpose of Processing: To provide online educational platform services as described in the Agreement

Retention Period: Personal Data is retained:

During active account: for duration of account
After account closure: 2 years
Transaction records: 7 years for tax/accounting purposes
As otherwise required by applicable law

C. Competent Supervisory Authority

For Controller located in the EU/EEA: The supervisory authority of the EU Member State in which the Controller is established.

For Controller located in the UK: The UK Information Commissioner’s Office (ICO)

For Controller located in the US or elsewhere: As determined by applicable Data Protection Laws

ANNEX II: STANDARD CONTRACTUAL CLAUSES

The following Standard Contractual Clauses approved by the European Commission for controller-to-processor transfers apply:

Module Two (Controller to Processor)
The optional docking clause in Clause 7
The optional clause in Clause 11(a) regarding third-party beneficiary rights
Clause 17 (Governing law): The laws of Ireland
Clause 18 (Choice of forum): The courts of Ireland have jurisdiction

ANNEX III: TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

UD Project implements the following technical and organizational measures to ensure an appropriate level of security:

1. Access Control

Physical Access Control:

Data centers with 24/7 security monitoring
Biometric access controls
Visitor logs and escort requirements
Environmental controls (fire suppression, climate control)

Logical Access Control:

Unique user IDs and strong password requirements
Multi-factor authentication for administrative access
Role-based access controls (RBAC)
Principle of least privilege
Regular access reviews and deprovisioning
Session timeouts

Data Access Control:

Encryption of data at rest (AES-256)
Encryption of data in transit (TLS 1.2 or higher)
Database access logging and monitoring
Segregation of customer data
Secure API authentication

2. Transmission Control

TLS/SSL encryption for all data transmissions
Virtual Private Networks (VPNs) for remote access
Secure File Transfer Protocol (SFTP) when applicable
Certificate-based authentication

3. Input Control

Audit logging of data creation, modification, and deletion
Timestamping and user attribution for all changes
Immutable audit logs
Regular log reviews

4. Data Integrity

Data validation at input
Checksums and hashing for data verification
Regular integrity checks
Version control for code and configurations
Change management procedures

5. Availability and Resilience

Redundant systems and failover capabilities
Regular backups (daily incremental, weekly full)
Geographically distributed backup storage
Disaster recovery plan (tested annually)
Business continuity plan
99.9% uptime SLA target

6. Incident Response

Security Incident Response Plan
24/7 security monitoring
Automated threat detection
Incident response team
Defined escalation procedures
Post-incident review and remediation

7. Data Minimization and Retention

Collection limited to necessary data only
Automated deletion based on retention schedules
Data anonymization and pseudonymization where appropriate
Regular data cleanup procedures

8. Personnel Security

Background checks for employees with data access
Confidentiality agreements for all personnel
Regular security awareness training
Clear policies on acceptable use
Termination procedures including access revocation

9. Vendor Management

Security requirements in vendor contracts
Regular vendor security assessments
Sub-processor due diligence
Compliance verification

10. Application Security

Secure Software Development Lifecycle (SSDLC)
Code reviews and security testing
Regular vulnerability scanning
Penetration testing (at least annually)
Web Application Firewall (WAF)
Protection against OWASP Top 10 vulnerabilities

11. Network Security

Firewalls and intrusion detection/prevention systems
Network segmentation
DDoS protection
Regular security updates and patching
Vulnerability management program

12. Monitoring and Testing

Continuous security monitoring
Regular security assessments
Annual penetration testing
Compliance audits (SOC 2, if applicable)
Security metrics and KPIs

13. Documentation and Policies

Information Security Policy
Acceptable Use Policy
Incident Response Plan
Disaster Recovery Plan
Data Retention and Deletion Policy
Vendor Management Policy

UD Project reviews and updates these security measures at least annually and as needed based on emerging threats and best practices.

ANNEX IV: LIST OF SUB-PROCESSORS

UD Project engages the following Sub-processors to process Personal Data on behalf of Customer:

Current Sub-processors

Square
Service: Payment processing
Data Processed: Payment information, email, name
Location: United States

Stripe
Service: Payment processing
Data Processed: Payment information, email, name
Location: United States

Helcim
Service: Payment processing
Data Processed: Payment information, email, name
Location: Canada

SiteGround
Service: Website and data hosting
Data Processed: All personal data categories
Location: United States

Postmark
Service: Transactional and marketing emails
Data Processed: email, name
Location: United States

Google
Service: Website analytics
Data Processed: IP addresses (anonymized), usage data
Location: United States

Sub-processor Changes

UD Project will notify Customer of any Sub-processor additions or changes in accordance with Section 4.3 of this DPA.

By using the Services, Customer acknowledges that it has read and agrees to the terms of this Data Processing Addendum.