Data Processing Agreement

1. Definitions

For purposes of this DPA:

1.1 "Applicable Data Protection Law"

means any applicable law, regulation, legally binding requirement, regulatory requirement, or binding regulatory guidance relating to privacy, data protection, cybersecurity, confidentiality, or the processing of Personal Data that applies to the parties or the processing covered by this DPA.

Depending on the School's jurisdiction and the circumstances of the processing, Applicable Data Protection Law may include national or regional data-protection legislation applicable in African countries, including, where applicable, the Nigeria Data Protection Act 2023, Botswana Data Protection Act 2018, South Africa Protection of Personal Information Act 2013 (POPIA), Kenya Data Protection Act 2019, Ghana Data Protection Act 2012, Rwanda Law Relating to the Protection of Personal Data and Privacy, Uganda Data Protection and Privacy Act 2019, Tanzania Personal Data Protection Act 2022, Zambia Data Protection Act 2021, Zimbabwe Cyber and Data Protection Act 2021, and other applicable data-protection legislation, regulations, and requirements in African jurisdictions.

References to particular laws in this DPA are illustrative and do not limit the definition of Applicable Data Protection Law.

1.2 "Personal Data"

means information relating to an identified or identifiable natural person, or the equivalent term used under Applicable Data Protection Law.

1.3 "Processing"

means any operation performed on Personal Data, including collection, recording, organization, storage, retrieval, use, transmission, disclosure, modification, restriction, deletion, or destruction.

1.4 "Data Controller"

means the person or organization that determines the purposes and means of processing Personal Data, or the equivalent legal role under Applicable Data Protection Law.

1.5 "Data Processor"

means a person or organization that processes Personal Data on behalf of a Data Controller, or the equivalent legal role under Applicable Data Protection Law.

1.6 "Subprocessor"

means a third-party service provider engaged by ProHub to process Personal Data on behalf of the School in connection with the provision of ClassNex.

1.7 "Data Subject"

means the individual to whom Personal Data relates.

1.8 "Security Incident"

means a confirmed or reasonably suspected unauthorized access to, acquisition, disclosure, alteration, loss, destruction, or other compromise of Personal Data processed under this DPA.

2. Relationship of the Parties

For Personal Data submitted to ClassNex by or on behalf of the School for the purpose of managing the School's operations, the School generally acts as the Data Controller and ProHub Digital Solutions generally acts as the Data Processor, service provider, or equivalent role under Applicable Data Protection Law.

The applicable legal classification of the parties may vary depending on the jurisdiction, nature of the processing, and applicable law.

The School generally determines:

• the categories of individuals whose information is entered into ClassNex;
• the types of Personal Data collected;
• the purposes for which the information is processed;
• the lawful basis for processing;
• the retention requirements applicable to School records;
• the information that is entered into ClassNex; and
• which School personnel, guardians, teachers, administrators, and other authorized users should be permitted to access the School's information.

ProHub Digital Solutions processes such Personal Data on behalf of the School in accordance with this DPA, the School's lawful instructions, the applicable ClassNex agreement, and Applicable Data Protection Law.

ClassNex provides role-based access controls through predefined roles and permissions maintained by ProHub Digital Solutions. The roles and the permissions associated with those roles are defined and maintained by ClassNex and are not independently created or defined by the School.

The School is responsible for determining which individuals should have access to its information and for assigning those individuals to the available ClassNex roles that are appropriate for their responsibilities.

Once a user is assigned to a particular ClassNex role, that user receives the permissions associated with that role as defined by ClassNex. The School is responsible for reviewing the available roles and assigning them appropriately to its users.

Detailed information concerning ClassNex roles and the permissions associated with those roles may be maintained in the official ClassNex documentation and user manual, available through docs.classnex.com . Such documentation may be updated from time to time as the Platform evolves.

ProHub Digital Solutions does not determine which School personnel should receive particular roles within the School and does not determine the School's internal administrative responsibilities. The School remains responsible for selecting and assigning appropriate available roles to its users.

Nothing in this DPA prevents ProHub Digital Solutions from processing information for purposes for which ProHub independently acts as a Data Controller or equivalent entity, including:

• account administration;
• customer and billing administration;
• security;
• fraud prevention;
• legal and regulatory compliance;
• service administration;
• protection of ProHub's rights and property;
• maintaining business records; and
• other purposes described in the ClassNex Privacy Policy.

3. Scope and Purpose of Processing

The School authorizes ProHub Digital Solutions to process Personal Data as reasonably necessary to provide, maintain, secure, support, administer, and operate ClassNex in accordance with the School's lawful instructions, the applicable ClassNex agreement, this DPA, and Applicable Data Protection Law.

Processing activities may include:

• receiving information submitted by or on behalf of the School;
• storing Personal Data;
• organizing and displaying School information;
• managing student records;
• managing guardian records;
• managing teacher and staff records;
• managing user accounts;
• implementing and maintaining role-based access controls and permissions established by ClassNex;
• managing classes and class structures;
• managing academic sessions and terms;
• managing enrollment information;
• managing academic information;
• managing attendance and other school records where applicable;
• managing invoices and fees;
• recording payment and transaction information;
• managing expenses and financial records;
• generating receipts, statements, and reports;
• providing guardian and authorized-user accounts;
• authenticating and securing user accounts;
• providing notifications and service-related communications;
• maintaining backups and business continuity measures;
• monitoring and maintaining system performance;
• maintaining and improving the security of the Platform;
• detecting, preventing, and investigating fraud, abuse, and security threats;
• troubleshooting technical problems;
• providing customer and technical support;
• maintaining and administering the ClassNex infrastructure;
• exporting information where an export facility is available;
• retaining information where required or reasonably necessary under Applicable Data Protection Law or contractual obligations; and
• deleting or otherwise disposing of information in accordance with applicable requirements.

The processing described above may involve automated processing, database operations, system-generated records, audit and security logs, backups, access-control operations, security monitoring, infrastructure operations, and other technical operations reasonably necessary for the provision, administration, maintenance, and security of ClassNex.

As part of operating ClassNex, ProHub Digital Solutions implements and maintains the technical role-based access controls and permissions established by ClassNex. The School remains responsible for determining which individuals are authorized to access its information and for assigning those individuals to the appropriate available ClassNex roles.

The roles and permissions available within ClassNex are established by ClassNex and may be modified or updated by ProHub Digital Solutions as the Platform develops. Detailed information regarding available roles and their associated permissions may be provided in the official ClassNex documentation and user manual.

ProHub Digital Solutions will not intentionally process School Personal Data for purposes unrelated to the provision, security, administration, support, maintenance, or improvement of ClassNex, except where:

• the School has authorized the processing;
• the processing is required by Applicable Data Protection Law;
• the processing is reasonably necessary to protect the security, integrity, or availability of the Platform;
• the processing is reasonably necessary to prevent fraud, abuse, or unlawful activity; or
• the processing is otherwise permitted under this DPA or Applicable Data Protection Law.

ProHub Digital Solutions may also process information for purposes for which it independently acts as a Data Controller or equivalent responsible entity, as described in the ClassNex Privacy Policy. Such processing is not treated as processing performed solely on behalf of the School under this section.

The specific features, roles, permissions, and processing activities available through ClassNex may vary depending on the functionality made available to the School and may change as the Platform is developed, maintained, and updated.

4. Categories of Data Subjects

Depending on the School's use of ClassNex, Personal Data may relate to:

• students;
• prospective students;
• parents and guardians;
• teachers;
• principals and vice principals;
• registrars;
• administrators;
• accountants;
• bursars;
• cashiers;
• other School employees;
• contractors;
• authorized School users;
• emergency contacts; and
• other individuals whose information the School lawfully enters into ClassNex.

The School must not knowingly provide ProHub with Personal Data that is unnecessary for the legitimate purposes for which ClassNex is being used.

5. Categories of Personal Data

Depending on the features used by the School, Personal Data may include the following.

5.1 Student Information

This may include:

• full name;
• student identification number;
• date of birth;
• gender where collected;
• nationality where collected;
• class and enrollment information;
• academic records;
• attendance information;
• assessment and grading information where applicable;
• photographs where uploaded by the School;
• guardian relationships;
• school-related documents; and
• other information reasonably necessary for school administration.

5.2 Guardian Information

This may include:

• name;
• email address;
• telephone number;
• residential or mailing address;
• relationship to the student;
• account information;
• communication preferences;
• invoices and balances;
• payment and transaction records; and
• related financial communications.

5.3 Teacher and Staff Information

This may include:

• name;
• email address;
• telephone number;
• employment-related information entered by the School;
• assigned role;
• permissions;
• account information;
• authentication information; and
• system activity information.

5.4 Financial Information

This may include:

• invoices;
• fees;
• balances;
• discounts;
• scholarships;
• payment records;
• transaction references;
• payment status;
• refunds;
• expenses;
• income records;
• payment-related communications; and
• other financial information entered by the School.

ProHub does not intentionally require Schools to store full payment-card numbers or card security codes in ClassNex.

Where payment processing is provided through a third-party payment provider, payment-card information may be processed directly by that provider under its own terms, security practices, and privacy policy.

6. Processing Instructions

ProHub will process School Personal Data only:

• to provide the ClassNex Service;
• in accordance with the School's documented or otherwise lawful instructions;
• as necessary to maintain and secure the Platform;
• as necessary to provide technical support and troubleshooting;
• as necessary to comply with Applicable Data Protection Law;
• as necessary to prevent fraud, abuse, or security threats; or
• for other purposes expressly permitted by this DPA or the applicable agreement.

The School's use of ClassNex constitutes its general authorization for ProHub to perform the processing activities reasonably necessary to provide the Service.

Where ProHub reasonably believes that an instruction from the School violates Applicable Data Protection Law, ProHub may notify the School and may decline to carry out the instruction until the issue has been resolved.

ProHub will not intentionally use School Personal Data to create or sell a commercial database of identifiable students, guardians, teachers, employees, or other School Data Subjects.

7. School Responsibilities

The School is responsible for:

• determining the purposes and means of its processing activities;
• ensuring that it has an appropriate lawful basis for collecting and processing Personal Data;
• providing appropriate privacy notices to Data Subjects where required;
• obtaining consent where consent is the applicable lawful basis;
• complying with applicable requirements relating to children and student information;
• ensuring that information submitted to ClassNex is accurate and appropriate;
• ensuring that information submitted to ClassNex is relevant and not unnecessarily excessive;
• ensuring that users are properly authorized;
• assigning authorized users to appropriate roles available within ClassNex;
• reviewing user role assignments periodically;
• promptly disabling or removing user access when a user is no longer authorized;
• protecting user credentials;
• ensuring users do not share accounts;
• responding to Data Subject requests where the School is the Data Controller;
• determining appropriate retention periods for School records;
• providing lawful and appropriate instructions to ProHub; and
• complying with Applicable Data Protection Law.

ClassNex provides predefined roles and associated role-based permissions designed to control access to information, modules, features, and actions within the Platform. The roles and permissions available within ClassNex are established and maintained by ProHub Digital Solutions and may be updated from time to time.

The School is responsible for determining which of its authorized users should be assigned to the available ClassNex roles based on their duties, responsibilities, and legitimate need for access. The School does not independently create or define the underlying permissions associated with those roles.

Detailed information concerning ClassNex roles, permissions, access levels, and related functionality is maintained in the official ClassNex documentation and user manual available at docs.classnex.com. Such documentation may be updated from time to time as the Platform evolves.

The School acknowledges that assigning a user to a particular ClassNex role provides that user with the access associated with that role. Accordingly, the School is responsible for ensuring that users are assigned only to roles appropriate to their responsibilities and authorization.

8. ProHub Responsibilities

ProHub will:

• process School Personal Data in accordance with this DPA;
• maintain reasonable technical and organizational safeguards;
• restrict access to School Personal Data to authorized personnel;
• maintain appropriate confidentiality obligations for personnel who have access to School Personal Data;
• provide reasonable assistance with applicable data-protection requests;
• provide reasonable assistance concerning Security Incidents;
• maintain reasonable procedures for information security and data protection;
• use appropriate safeguards when engaging Subprocessors;
• maintain reasonable procedures for data retention and deletion; and
• delete or return School Personal Data in accordance with this DPA and Applicable Data Protection Law.

9. Confidentiality

ProHub will treat School Personal Data as confidential.

ProHub will ensure that personnel authorized to process School Personal Data are subject to appropriate confidentiality obligations.

ProHub will not intentionally disclose School Personal Data to third parties except:

• as necessary to provide the ClassNex Service;
• as authorized by the School;
• through approved Subprocessors;
• where required by law;
• where necessary to protect the security of the Platform, users, or other customers; or
• as otherwise permitted by this DPA or Applicable Data Protection Law.

10. Security Measures

ProHub will maintain reasonable technical and organizational measures designed to protect Personal Data against unauthorized access, accidental loss, destruction, alteration, disclosure, or other unlawful processing.

Depending on the relevant system and circumstances, measures may include:

• HTTPS/TLS encryption;
• password hashing;
• authentication controls;
• role-based access controls;
• database access restrictions;
• server security controls;
• restricted administrative access;
• logging and monitoring;
• security updates;
• vulnerability management;
• backup procedures;
• access-control management;
• incident-response procedures;
• account security controls; and
• administrative security policies.

ProHub will periodically review its security measures and may update them where reasonably necessary to address changing security risks.

11. Role-Based Access and Administrative Access

ClassNex uses role-based access controls to help Schools manage access to School information.

Depending on the School's configuration and the functionality available within ClassNex, authorized School users may include roles such as:

• Super Admin;
• System Administrator;
• Principal;
• Vice Principal;
• Registrar;
• Admin;
• Accountant;
• Bursar;
• Cashier;
• Class Teacher;
• Subject Teacher;
• Guardian; and
• other authorized users supported by the Platform.

ClassNex establishes the roles and the permissions associated with those roles. The permissions determine the information, modules, features, and actions that a user assigned to a particular role may be able to access or perform within the Platform.

The School is responsible for determining which of its authorized users should be assigned to the available ClassNex roles based on their duties, responsibilities, and legitimate need for access. The School does not independently create or define the underlying permissions associated with those roles.

Detailed information concerning the roles, permissions, access levels, and functionality available within ClassNex is maintained in the official ClassNex documentation and user manual available at docs.classnex.com. Such documentation may be updated from time to time as the Platform evolves.

The School acknowledges that assigning a user to a particular ClassNex role grants that user the access associated with that role. The School is therefore responsible for reviewing user role assignments and ensuring that users are assigned only to roles appropriate to their responsibilities and authorization.

ClassNex may permit different roles to view, create, update, delete, or otherwise interact with different categories of information and Platform functionality. The specific permissions available to each role are determined by ClassNex and are not independently configurable by the School unless a particular configuration feature is expressly provided by the Platform.

ProHub personnel may access School Personal Data only when reasonably necessary for legitimate operational purposes, including:

• technical support;
• troubleshooting;
• security investigations;
• system maintenance;
• incident response;
• service administration;
• account assistance; or
• compliance with legal obligations.

ProHub will seek to limit such access to the information reasonably necessary for the relevant purpose and will apply appropriate technical and organizational safeguards to such access.

12. Subprocessors and Third-Party Service Providers

ProHub may engage third-party service providers to support the operation of ClassNex.

Such providers may include providers of:

• cloud hosting;
• database infrastructure;
• email delivery;
• payment processing;
• backup services;
• security services;
• monitoring;
• communications;
• technical infrastructure; and
• other services necessary to operate and support ClassNex.

ProHub will take reasonable steps to ensure that Subprocessors are subject to appropriate confidentiality, security, and data-protection obligations.

The School authorizes ProHub to engage Subprocessors as reasonably necessary to provide the Service, subject to Applicable Data Protection Law.

Where required by Applicable Data Protection Law, ProHub will provide appropriate information regarding relevant Subprocessors.

ProHub remains responsible for the processing activities of its Subprocessors to the extent required by Applicable Data Protection Law and the applicable contractual relationship.

13. Payment Processors

Where ClassNex provides online payment functionality, payment transactions may be processed by third-party payment providers.

The relevant payment provider may independently process information such as:

• payer name;
• email address;
• telephone number;
• transaction amount;
• currency;
• transaction reference;
• payment status; and
• payment method information.

The School acknowledges that third-party payment providers may process Personal Data under their own privacy policies and contractual terms.

ProHub may receive transaction information necessary to:

• record payments;
• reconcile payments;
• verify payment status;
• update School financial records; and
• provide payment-related functionality.

ProHub does not intentionally store full payment-card numbers or card security codes in ClassNex.

14. Data Subject Requests

Where the School is the Data Controller, the School is primarily responsible for responding to requests from Data Subjects concerning their Personal Data.

Depending on Applicable Data Protection Law, Data Subjects may have rights including:

• access;
• correction;
• deletion;
• restriction;
• objection;
• portability; and
• withdrawal of consent where applicable.

Where reasonably required and legally appropriate, ProHub will assist the School in responding to valid Data Subject requests.

ProHub may require reasonable information from the School to verify the request, understand the circumstances, and determine the appropriate action.

15. Security Incidents and Data Breaches

ProHub will maintain reasonable procedures for detecting, investigating, containing, and responding to Security Incidents.

If ProHub becomes aware of a Security Incident affecting School Personal Data, ProHub will, where required by Applicable Data Protection Law and reasonably practicable:

• investigate the incident;
• take reasonable steps to contain and mitigate the incident;
• notify the School without undue delay;
• provide reasonably available information concerning the nature and scope of the incident;
• provide reasonably available information concerning affected Personal Data;
• provide reasonably available information concerning mitigation measures; and
• cooperate reasonably with the School concerning applicable notification and remediation obligations.

The School remains responsible for determining whether notification to Data Subjects or a regulatory authority is legally required, except to the extent Applicable Data Protection Law places such obligation directly on ProHub.

16. Data Protection Impact Assessments

Where required by Applicable Data Protection Law, the School is responsible for conducting or arranging any required Data Protection Impact Assessment or equivalent assessment relating to its processing activities.

Where reasonably necessary and legally appropriate, ProHub will provide reasonable information and assistance concerning:

• the nature of ClassNex processing;
• relevant processing activities;
• security measures;
• relevant Subprocessors;
• technical safeguards; and
• reasonably foreseeable processing risks.

The School remains responsible for assessing the legality and risks of its own processing activities.

17. International and Cross-Border Data Transfers

ClassNex may use infrastructure or service providers located in countries other than the country in which the School operates.

As a result, School Personal Data may be transferred to, stored in, or processed in:

• the School's country;
• another African country;
• countries outside Africa; or
• multiple jurisdictions depending on the infrastructure and service providers used by ClassNex.

Where a transfer of Personal Data across national borders is subject to Applicable Data Protection Law, ProHub will take reasonable steps to implement legally appropriate safeguards for the transfer.

Depending on the applicable legal requirements, safeguards may include:

• contractual protections;
• appropriate transfer mechanisms;
• security measures;
• data minimization;
• access controls;
• confidentiality protections;
• appropriate processor or service-provider agreements; and
• other safeguards required or recognized under Applicable Data Protection Law.

The School acknowledges that the use of cloud infrastructure, payment providers, communications providers, email providers, security providers, and other third-party service providers may involve cross-border processing.

Where the School is the Data Controller, the School remains responsible for determining whether international or cross-border processing associated with its use of ClassNex satisfies its own legal obligations, except to the extent responsibility is imposed directly on ProHub by Applicable Data Protection Law.

18. Children's Data

ClassNex is designed for use by schools and may therefore process information concerning children.

The School is responsible for ensuring that its collection and use of children's Personal Data complies with Applicable Data Protection Law and applicable child-protection requirements.

ProHub will process children's Personal Data only as reasonably necessary to provide the Service, in accordance with the School's lawful instructions, and for purposes permitted under this DPA.

ProHub will not intentionally use identifiable student information for unrelated commercial purposes.

The School should provide only information reasonably necessary for legitimate educational, administrative, financial, or other lawful purposes.

Where Applicable Data Protection Law requires parental, guardian, regulatory, or other authorization for the processing of children's information, the School is responsible for obtaining such authorization unless otherwise agreed in writing or required by law.

19. Sensitive or Special-Category Personal Data

The School should not upload sensitive, special-category, or otherwise specially protected Personal Data to ClassNex unless:

• the information is necessary for a legitimate School purpose;
• the School has an appropriate lawful basis for processing it;
• processing is permitted under Applicable Data Protection Law; and
• appropriate safeguards are in place.

Where the School intends to process particularly sensitive information through ClassNex, the School should determine whether additional safeguards, authorization, notification, consultation, or a Data Protection Impact Assessment is required.

ProHub will apply reasonable safeguards to Personal Data processed through ClassNex but does not determine whether the School is legally permitted to collect or process a particular category of information.

20. Data Retention

ProHub will retain School Personal Data for as long as reasonably necessary to provide the Service and in accordance with the applicable agreement with the School and Applicable Data Protection Law.

Following termination of the School's use of ClassNex, Personal Data may be:

• returned to the School;
• made available for export where an export facility exists;
• deleted from active systems; or
• retained for a limited period in backups or where required by law, security requirements, dispute resolution, fraud prevention, or other legitimate purposes.

The School is responsible for determining the retention periods applicable to its School records, subject to Applicable Data Protection Law.

Backup copies may remain for a reasonable period until overwritten or securely deleted through ProHub's ordinary backup procedures.

21. Return and Deletion of Data

Upon termination of the School's use of ClassNex, ProHub will, subject to Applicable Data Protection Law and the parties' contractual obligations, take reasonable steps to delete or return School Personal Data upon the School's request.

Where an export facility is available, the School should export or request the information it requires before terminating its ClassNex account.

ProHub may retain limited information where reasonably necessary to:

• comply with legal obligations;
• establish or defend legal claims;
• prevent fraud;
• maintain security;
• resolve disputes;
• maintain financial and accounting records; or
• comply with regulatory requirements.

Information retained for these purposes will remain subject to appropriate protections.

22. Audits and Compliance Information

Where required by Applicable Data Protection Law, ProHub will provide reasonable information necessary to demonstrate compliance with its obligations under this DPA.

The School may request reasonable information regarding ProHub's security and data-processing practices.

Any audit or assessment must:

• be reasonably related to the processing covered by this DPA;
• be conducted with reasonable advance notice;
• occur during normal business hours;
• avoid unnecessary disruption to ClassNex operations;
• protect the confidentiality and security of ProHub and other customers; and
• comply with reasonable security requirements.

Where reasonably available, ProHub may satisfy audit requirements by providing relevant policies, certifications, security information, summaries, or other documentation instead of permitting a direct technical audit.

Where an audit is required by Applicable Data Protection Law, the parties will cooperate reasonably to determine an appropriate method for demonstrating compliance while protecting the security and confidentiality of ClassNex and other customers.

23. Regulatory Cooperation

The parties will reasonably cooperate with applicable data-protection authorities and other competent regulatory bodies where required by law.

This may include, where legally applicable, cooperation with national or regional data-protection authorities in African jurisdictions.

Each party remains responsible for its own legal and regulatory obligations.

Nothing in this DPA prevents either party from communicating directly with a competent regulatory authority where legally required.

24. Privacy Contact

ProHub will maintain an appropriate privacy contact for data-protection matters relating to ClassNex.

Privacy inquiries may be directed to:

ProHub Digital Solutions / ClassNex
Privacy Email: privacy@classnex.com
General Email: support@classnex.com
Website: classnex.com

Where ProHub is legally required to appoint a Data Protection Officer or equivalent privacy professional, the applicable contact information may be provided through the ClassNex website or directly to customers.

25. Data Ownership and Rights

As between the School and ProHub, the School retains its rights in Personal Data submitted to ClassNex by or on behalf of the School.

Nothing in this DPA transfers ownership of School Personal Data to ProHub.

ProHub retains its rights in:

• ClassNex software;
• source code;
• system architecture;
• database structures;
• interfaces;
• documentation;
• trademarks;
• branding;
• technology;
• features;
• software functionality;
• aggregated or de-identified information that does not identify individuals; and
• other intellectual property belonging to ProHub or its licensors.

Nothing in this DPA transfers ownership of ProHub's intellectual property to the School.

26. Aggregated and De-Identified Information

ProHub may create aggregated, statistical, or appropriately de-identified information derived from the operation and use of ClassNex.

Such information may be used for purposes including:

• service analytics;
• performance monitoring;
• security;
• fraud prevention;
• product improvement;
• research;
• reporting;
• benchmarking; and
• development of new features.

ProHub will not intentionally use appropriately de-identified information in a manner designed to identify an individual Data Subject.

Where information is capable of identifying an individual, it will not be treated as de-identified merely because identifying information has been removed if the individual could reasonably still be identified using reasonably available information.

ProHub will handle aggregated and de-identified information in accordance with Applicable Data Protection Law.

27. Compliance with African Data-Protection Laws

Each party will comply with the Applicable Data Protection Law applicable to its respective role, activities, and obligations under this DPA.

The data-protection laws applicable to a particular processing activity may depend on factors including:

• the country in which the School operates;
• the location or jurisdiction of the relevant Data Subject;
• where Personal Data is collected;
• where Personal Data is processed;
• where Personal Data is stored;
• the location or jurisdiction of relevant service providers or subprocessors;
• the nature and purpose of the processing; and
• any other legally relevant connection or jurisdictional requirement.

Depending on the circumstances, Applicable Data Protection Law may include legislation, regulations, regulatory guidance, and other legally binding requirements applicable in jurisdictions including, without limitation:

• Nigeria;
• Botswana;
• South Africa;
• Kenya;
• Ghana;
• Rwanda;
• Uganda;
• Tanzania;
• Zambia;
• Zimbabwe;
• Namibia;
• Mauritius;
• Egypt;
• Morocco;
• Senegal;
• Côte d'Ivoire; and
• other African jurisdictions in which applicable data-protection requirements may arise.

The jurisdictions listed above are provided for illustrative purposes only. The inclusion of a country in this list does not mean that its data-protection laws necessarily apply to every School, Data Subject, processing activity, or use of ClassNex.

Similarly, the absence of a country from this list does not mean that its data-protection laws cannot apply where there is a relevant legal connection or other basis for their application.

The parties will take reasonable steps to identify and comply with the data-protection requirements applicable to their respective roles and processing activities.

Where the applicable legal requirements impose additional obligations on either party, the parties will cooperate in good faith as reasonably necessary to address those obligations in accordance with this DPA and Applicable Data Protection Law.

28. Term and Termination

This DPA will remain in effect for as long as ProHub processes Personal Data on behalf of the School under the applicable ClassNex agreement.

The DPA will terminate when ProHub no longer processes Personal Data on behalf of the School, subject to provisions that by their nature should survive termination.

Provisions concerning confidentiality, security, data retention, deletion, liability, dispute resolution, and other continuing obligations will survive termination to the extent required.

29. Liability and Indemnification

The liability of each party in connection with this DPA will be governed by the applicable ClassNex Terms of Service or commercial agreement between the parties.

Nothing in this DPA excludes or limits liability that cannot legally be excluded or limited under Applicable Data Protection Law.

Where legally permitted, any indemnification obligations relating to data protection will be governed by the parties' applicable commercial agreement.

30. Changes to This DPA

ProHub may update this DPA from time to time where reasonably necessary to:

• reflect changes in ClassNex;
• reflect changes in Applicable Data Protection Law;
• introduce new security measures;
• update Subprocessor arrangements;
• address regulatory requirements;
• reflect changes in the countries or jurisdictions in which ClassNex operates; or
• improve the clarity of the agreement.

Where a material change is made, ProHub may provide reasonable notice to affected Schools.

If a change materially affects the School's data-protection obligations, ProHub may provide additional notice or require acceptance of the updated DPA where appropriate.

31. Governing Law

The governing law applicable to this DPA will generally correspond to the governing law specified in the applicable commercial agreement between ProHub and the School.

Where no separate governing-law provision exists, the applicable governing law will be determined in accordance with the applicable contractual arrangements and Applicable Data Protection Law.

Nothing in this DPA prevents a party from exercising rights or remedies that cannot lawfully be waived under Applicable Data Protection Law.

The parties acknowledge that the fact that ClassNex operates across multiple African jurisdictions does not, by itself, mean that the laws of every African country apply to every processing activity.

32. Entire Agreement

This DPA forms part of the agreement governing the School's use of ClassNex.

This DPA should be read together with:

• the ClassNex Terms of Service;
• the ClassNex Privacy Policy;
• the applicable subscription or commercial agreement;
• any applicable order form; and
• any applicable service agreement.

If a conflict exists concerning the processing of Personal Data, this DPA will control to the extent necessary to resolve that conflict, unless the parties have expressly agreed otherwise in writing.

33. Notices

Notices relating to this DPA may be provided through:

• email;
• the ClassNex Platform;
• the School's registered account;
• written communication; or
• another reasonable communication method.

The School is responsible for keeping its contact information current.

34. Contact Information

For questions concerning this DPA or data-protection matters, contact:

ProHub Digital Solutions
Product: ClassNex
General Email: support@classnex.com

Registered Business Name: ProHub Digital Solutions
Registration No.: RC 8131976

35. Acceptance

By accepting this DPA on behalf of a School, the authorized representative acknowledges that:

1. the School has reviewed and understands this DPA;
2. the School understands its responsibilities as a Data Controller or equivalent responsible entity under Applicable Data Protection Law;
3. the School will provide lawful and appropriate instructions to ProHub in connection with the processing of School Personal Data;
4. the School will comply with Applicable Data Protection Law applicable to its processing activities and responsibilities;
5. the School will ensure that the information it submits to ClassNex is collected and processed lawfully and appropriately;
6. the School will properly manage its ClassNex users and assign users only to roles appropriate to their responsibilities and authorization;
7. the School understands that ClassNex establishes the permissions associated with its available roles, as described in the official ClassNex documentation and user manual;
8. the School will periodically review user role assignments and promptly disable or remove access when a user is no longer authorized; and
9. the School agrees to comply with the terms of this DPA.

Where an authorized representative accepts this DPA on behalf of a School or other organization, that representative confirms that they have the authority to bind the School or organization to this DPA.

Where this DPA is incorporated into or executed together with a separate subscription agreement, order form, service agreement, or other written agreement between the School and ProHub, the acceptance and effective date of this DPA will be determined in accordance with that applicable agreement.

Effective Date: 8/28/2026
Last Updated: 8/28/2026