Data Processing Agreement

---

Parties

This Data Processing Agreement ("Agreement") is entered into between:

Data Processor: MapOutcomes Inc., a corporation incorporated under the Canada Business Corporations Act (Canadian Corporations Number 1791669-8), with its registered office in the Province of Ontario ("Processor" or "MapOutcomes");

Data Controller: The customer organization that determines the purposes and means of processing personal information through the MapOutcomes Platform ("Controller").

---

1. Definitions

1.1 Personal Information

Has the meaning given in section 4(1) of PIPEDA and includes any information about an identifiable individual.

1.2 Processing

Any operation performed on Personal Information, including collection, use, retention, disclosure, and deletion.

1.3 Platform

The MapOutcomes software-as-a-service platform, including all features, functionality, content, and related services.

1.4 Sub-processor

A third-party service provider engaged by MapOutcomes to perform Processing activities on behalf of MapOutcomes.

1.5 Applicable Law

PIPEDA, applicable provincial privacy legislation (including but not limited to Quebec Act 25, Alberta PIPA, BC PIPA), and any other applicable Canadian privacy laws.

---

2. Scope of Processing

2.1 Subject Matter

MapOutcomes processes Personal Information solely to operate the Platform and provide the Services described in the ToS, including:

• User account management and authentication
• Accreditation data management and analysis
• Course-program-outcome mapping and gap analysis
• AI-assisted evidence mapping suggestions, reviewed by the Controller's own authorized users before use (see Section 3.6)
• Data export and reporting functionality
• Customer support and technical maintenance

2.2 Categories of Personal Information

The Personal Information processed under this Agreement includes:

• Account information: Name, institutional email, job title, role, institution name
• Usage data: Login timestamps, IP addresses, feature usage patterns
• User-created content: Course descriptions, learning outcomes, accreditation mappings, assessment criteria, aggregate scoring data, configuration settings

2.3 Categories of Data Subjects

• Employees, faculty, and staff of Controller's institution
• Accreditation coordinators and program administrators

2.4 Student Personal Information; Authority to Submit Evidence

(a) No student identifiers. Consistent with Section 3.2(e) of the ToS, the Controller shall not upload direct student identifiers (student names, student IDs, Social Insurance Numbers, or grades tied to an identifiable student). Before uploading sample work (exams, assignments, or portfolio pieces), the Controller shall remove or redact these identifiers. The AI mapping features use the assessment design, not student identity.

(b) Warranty of authority. The Controller represents and warrants that it has the legal authority to submit, and to authorize MapOutcomes to process, all evidence files, course outlines, and other materials it uploads to the Platform (“Submitted Materials”).

(c) Identifiers included by mistake. If Submitted Materials contain student personal information despite (a), the Controller warrants that its disclosure of that information to MapOutcomes was lawful: for institutions in Canada, consistent with its own privacy policies and applicable law (including PIPEDA and any applicable provincial privacy legislation); for institutions in the United States, under the “school official” exception of the Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. § 99.31(a)(1). The Controller shall delete or replace the file with a redacted copy once it becomes aware of the identifiers, and MapOutcomes shall delete such a file on the Controller's request.

(d) No independent verification. MapOutcomes relies on the Controller's warranties in this Section and does not independently verify the Controller's authority. The Controller remains responsible for compliance with its own privacy and student-data obligations.

2.5 Duration

Processing continues for the duration of the Controller's subscription and for up to 120 days thereafter (data retention and deletion period as described in Section 7).

---

3. Obligations of the Processor

3.1 Processing Instructions

MapOutcomes shall process Personal Information only on the documented instructions of the Controller, unless required to do so by Applicable Law. In the event of a legal requirement that conflicts with Controller's instructions, MapOutcomes shall notify the Controller before complying, unless legally prohibited from doing so.

3.2 Confidentiality

MapOutcomes ensures that all persons authorized to process Personal Information are subject to appropriate confidentiality obligations. Access is restricted to personnel who need it to perform their duties, and all personnel receive regular privacy and security training.

3.3 Security Measures

MapOutcomes implements and maintains appropriate technical and organizational security measures, including at minimum:

3.4 Sub-processing

3.4.1 General Rule. MapOutcomes shall not engage another processor (Sub-processor) to carry out processing activities on behalf of MapOutcomes without the prior notice to Controller. MapOutcomes provides general authorization for the categories of Sub-processors listed below. Controller may object to any new Sub-processor within 15 days of receiving notice.

3.4.2 Current Sub-processors.

3.4.3 Sub-processing Obligations. MapOutcomes imposes on each Sub-processor obligations no less protective than those set out in this Agreement. MapOutcomes remains fully liable to Controller for the acts and omissions of its Sub-processors.

3.5 Data Residency

All Personal Information is hosted on servers located in Canada, except billing contact and payment details processed by the payment processor listed in Section 3.4.2. MapOutcomes shall not transfer Personal Information to servers located outside Canada without Controller's prior written consent and appropriate safeguards (such as standard contractual clauses or binding corporate rules).

3.6 AI Processing

AI-assisted features are processed by a local AI model hosted on MapOutcomes' own infrastructure in Canada. MapOutcomes does not send Personal Information or Institutional Data to any external AI service, and does not use it to train models that serve any other customer. AI output is advisory: an authorized user of the Controller accepts, corrects, or rejects every suggestion before it is used.

---

4. Assistance with Data Subject Rights

4.1 Requests

MapOutcomes shall assist Controller, by appropriate technical and organizational measures, to fulfill its obligations to respond to data subject requests exercising their rights under Applicable Law, including:

• Right of access (Section 3 of PIPEDA)
• Right to correction (Section 4.3 of PIPEDA)
• Right to withdraw consent (Section 4.3 of PIPEDA)
• Right to deletion
• Right to data portability

4.2 Response Timeline

MapOutcomes will respond to Controller's requests for assistance within 10 business days of receipt. Controller remains responsible for communicating directly with data subjects.

---

5. Data Breach Notification

5.1 Notification Obligation

In the event of a personal information breach (as defined by PIPEDA), MapOutcomes shall:

1. Notify Controller without undue delay, and in no case later than 24 hours after becoming aware of the breach;
2. Provide sufficient information to enable Controller to meet its own notification obligations under PIPEDA and Applicable Law;
3. Cooperate with Controller in investigating and mitigating the breach;
4. Maintain a record of all breaches including facts, effects, and remedial measures.

5.2 Notification Content

Breach notifications will include:

• The nature of the breach and categories of affected Personal Information
• The likely consequences of the breach
• Measures taken or proposed to address the breach, including measures to mitigate adverse effects
• Contact information for MapOutcomes' Privacy Officer

5.3 Privacy Officer

For breach-related inquiries, contact MapOutcomes' Privacy Officer at: [email protected]

---

6. Audit and Inspection

6.1 Audit Rights

Upon reasonable notice (at least 10 business days), Controller may audit MapOutcomes' compliance with this Agreement, including inspections of facilities, systems, and procedures relevant to Processing. Audits may be conducted no more than once per calendar year unless a breach or material compliance concern is identified.

6.2 Compliance Evidence

MapOutcomes shall, at Controller's request, provide documented evidence of compliance, including but not limited to:

• Security assessment reports
• Penetration testing results
• Employee training records
• Incident response documentation

---

7. Return and Deletion

7.1 End of Service

Upon termination of the Services or expiration of the subscription, MapOutcomes shall, at Controller's choice:

• Return all Personal Information in a structured, commonly used, and machine-readable format; or
• Delete all Personal Information and existing copies, unless Applicable Law requires storage for longer periods.

7.2 Deletion Timeline

• Data export window: 90 days following termination, with read-only access to the Platform
• Permanent deletion from active systems: Within 16 days following the export window (no later than 106 days after termination)
• Backup purging: Within 14 days of deletion from active systems, under the standard backup rotation, so that no copy remains later than 120 days after termination

7.3 Retention of AI Analysis Data

MapOutcomes shall retain the Personal Information and Institutional Data processed through the AI analysis features for no longer than is necessary for the purposes set out in this Agreement, in accordance with the following schedule:

(a) MapOutcomes shall implement automated retention and deletion in accordance with this schedule.

(b) The Controller may set a shorter retention period for the correction/audit trail by written notice to MapOutcomes.

(c) On termination, MapOutcomes shall provide the Controller with an export of the correction/audit trail before deletion, and shall delete the trail, including from backups, no later than 120 days after termination unless the Controller requests in writing that it be retained.

(d) Deletion of a source evidence file shall erase the AI-generated text (excerpts, reasoning, improvement tips) derived from that file.

(e) Nothing in this section limits MapOutcomes' obligation to retain records where required by Applicable Law; where such a requirement exists, MapOutcomes shall isolate and protect those records and delete them when the legal hold ends.

---

8. Governing Law and Dispute Resolution

8.1 Governing Law

This Agreement is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein.

8.2 Jurisdiction

Any dispute arising out of this Agreement is subject to the exclusive jurisdiction of the courts of the Province of Ontario.

8.3 Good-Faith Negotiation

Before pursuing formal legal remedies, the parties agree to attempt to resolve any dispute through good-faith negotiation for at least 30 days.

---

9. General Provisions

9.1 Relationship to ToS

This DPA supplements the ToS. In the event of inconsistency, this DPA prevails with respect to data processing matters.

9.2 Amendments

MapOutcomes may amend this DPA with 30 days' written notice. Material changes affecting Controller's rights will be communicated via email and/or Platform notice.

9.3 Survival

Sections 3.2 (Confidentiality), 5 (Data Breach Notification), 7 (Return and Deletion), 8 (Governing Law), and 9 (General Provisions) survive termination of this Agreement.

9.4 Contact

MapOutcomes Inc.
Privacy Officer: [email protected]
Support: [email protected]
Legal: [email protected]

---

This Data Processing Agreement has been prepared by the MapOutcomes Legal & Compliance function. For legal advice regarding data processing compliance, consult a qualified Canadian privacy lawyer.