Subprocessor List

This Subprocessor List identifies the third-party service providers engaged by SchoolToolz ("Proctorly," "we," "us," or "our") that may process Customer Data in connection with the Proctorly services.

Capitalized terms not defined in this Subprocessor List have the meanings given in the applicable Master Services Agreement, Terms of Service, Data Processing Addendum, or other agreement between Proctorly and the customer.

1. Current Subprocessors

3. Categories of Subprocessors

Proctorly may engage Subprocessors in the following categories:

1. cloud infrastructure and hosting;
2. database and file-storage services;
3. authentication and identity management;
4. payment and subscription processing;
5. email and communication services;
6. application monitoring and error tracking;
7. cybersecurity and fraud-prevention services;
8. customer support and communication platforms;
9. product analytics;
10. document-processing services;
11. artificial intelligence service providers; and
12. professional services necessary to operate, maintain, and support the Services.

4. Changes to Subprocessors

Proctorly may add, replace, or remove Subprocessors as necessary to operate and improve the Services.

Proctorly will update this Subprocessor List when a new Subprocessor is authorized to process Customer Data.

Where required under the applicable Data Processing Addendum, Proctorly will provide Customer with advance notice of a new Subprocessor by:

• email to the Customer's designated notification address;
• an in-product notification;
• publication on this webpage; or
• another method agreed upon by the parties.

The notice period will be 30 days before the new Subprocessor begins processing Customer Data, unless a shorter period is reasonably necessary to:

1. address an emergency;
2. prevent or respond to a security threat;
3. maintain service availability;
4. comply with applicable law; or
5. replace a Subprocessor that has unexpectedly discontinued its services.

5. Customer Objections

Where the applicable Data Processing Addendum provides a right to object, Customer may submit a written objection to a new Subprocessor within 30 days after receiving notice.

The objection must:

1. be based on reasonable and documented data-protection or information-security concerns;
2. identify the specific Subprocessor;
3. describe the basis of the objection; and
4. be submitted to privacy@proctorly.co.

Proctorly and Customer will work in good faith to address the objection.

Possible resolutions may include:

1. providing additional information regarding the Subprocessor;
2. implementing reasonable additional safeguards;
3. limiting the Subprocessor's access to Customer Data;
4. using a commercially reasonable alternative, where available; or
5. permitting Customer to discontinue the affected portion of the Services as provided in the applicable agreement.

An objection does not automatically prohibit Proctorly from using the Subprocessor unless the applicable agreement expressly states otherwise.

6. Subprocessor Obligations

Proctorly requires each Subprocessor that processes Customer Data to enter into a written agreement containing data-protection and security obligations appropriate to the services provided.

Such obligations may include requirements concerning:

1. confidentiality;
2. information security;
3. processing only for authorized purposes;
4. assistance with data-subject requests;
5. Security Incident notification;
6. deletion or return of Customer Data;
7. international data transfers;
8. compliance with applicable data-protection laws; and
9. restrictions on appointing additional subprocessors.

Proctorly remains responsible for the performance of its Subprocessors to the extent required by the applicable agreement and applicable law.

7. International Data Transfers

Where a Subprocessor processes Customer Data outside the country or region in which it was originally collected, Proctorly will use an appropriate transfer mechanism where required by applicable law.

Such mechanisms may include:

1. the European Commission Standard Contractual Clauses;
2. the United Kingdom International Data Transfer Addendum;
3. an applicable adequacy decision;
4. participation in a recognized data-transfer framework;
5. binding corporate rules; or
6. another legally recognized transfer mechanism.

8. Affiliates

No Proctorly affiliate currently processes Customer Data.

Where applicable, Proctorly will list any affiliate Subprocessors here.

9. Removed Subprocessors

No Subprocessors have been removed from this list during the last 12 months.

Where applicable, Proctorly will list any removed Subprocessors here.

10. Contact Information

Questions or objections regarding this Subprocessor List should be submitted to:

SchoolToolz

Privacy Contact: Privacy Team

Email: privacy@proctorly.co

Security Email: security@proctorly.co

Mailing Address: Durham, North Carolina, United States