Data Processing Agreement

Last Updated: February 25, 2026 Effective Date: February 25, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service ("Agreement") between you ("Subscriber," "Controller," or "you") and Reservita Inc. ("Caletan," "Processor," "we," or "us") regarding the processing of personal data through the Caletan platform. This DPA supplements the Agreement and takes precedence over conflicting terms on data processing matters.

By using the Caletan platform, you agree to the terms of this DPA. This DPA, together with the Terms of Service and Privacy Policy, constitutes the complete agreement regarding personal data processing.

1. Definitions

"Applicable Data Protection Laws" means all laws and regulations applicable to the processing of Personal Data under this DPA, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial legislation, the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the United Kingdom Data Protection Act 2018, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and any other applicable data protection or privacy laws.

"Controller" means the entity that determines the purposes and means of Processing Personal Data. Under this DPA, the Subscriber is the Controller.

"Data Subject" means an identified or identifiable natural person to whom Personal Data relates.

"Personal Data" means any information relating to an identified or identifiable natural person that is processed by Caletan on behalf of the Subscriber in connection with the Services.

"Personal Data Breach" means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed by the Processor or its Sub-Processors. This does not include unsuccessful access attempts or security events that do not compromise the confidentiality, integrity, or availability of Personal Data.

"Processing" (and "Process") means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction.

"Processor" means the entity that Processes Personal Data on behalf of the Controller. Under this DPA, Caletan is the Processor.

"Services" means the Platform as defined in the Terms of Service.

"Standard Contractual Clauses" means the standard contractual clauses for the transfer of personal data to processors established in third countries, as set out in the European Commission's Decision (EU) 2021/914.

"Sub-Processor" means any third party appointed by the Processor to Process Personal Data on behalf of the Controller in connection with the Services.

2. Roles of the Parties

The Subscriber is the Controller of Personal Data entered into or collected through the Caletan platform in connection with the Subscriber's use of the Services. The Subscriber determines the purposes and means of Processing such Personal Data.

Caletan is the Processor, Processing Personal Data solely on behalf of and in accordance with the Subscriber's documented instructions. Caletan may engage Sub-Processors in accordance with Section 7 of this DPA.

3. Scope of Processing

3.1 Categories of Data Subjects

Personal Data processed under this DPA may concern the following categories of Data Subjects:

Students and minors enrolled in or registering for classes through the Subscriber's account
Parents and legal guardians of students
Staff members (instructors, administrators) of the Subscriber's organization
Other contacts associated with the Subscriber's account (e.g., emergency contacts, family members)

3.2 Types of Personal Data

The following types of Personal Data may be processed:

Identity information: names, dates of birth, gender, profile photos
Contact information: email addresses, phone numbers, mailing addresses
Enrollment and attendance data: class registrations, attendance records, skill levels, progression notes
Financial information: billing details, payment history, invoice records (note: full payment card details are processed directly by our third-party payment processor and are not stored by Caletan)
Communications: messages exchanged through the platform between Subscribers, parents, and staff
Account credentials: usernames and hashed passwords
Device and usage data: IP addresses, browser type, and platform usage logs generated through use of the Services

3.3 Purpose and Duration of Processing

Personal Data is processed solely for the purpose of providing the Services as described in the Agreement, including operating the platform, processing enrollments, managing classes, facilitating communications, and processing payments. Processing continues for the duration of the Agreement and any applicable retention period described in Section 12.

4. Processing Obligations

4.1 Caletan shall Process Personal Data only in accordance with the Subscriber's documented instructions. The Agreement and the Subscriber's use of the Services constitute the Subscriber's complete and final processing instructions. Additional instructions require prior written agreement between the parties.

4.2 Caletan shall comply with Applicable Data Protection Laws in its Processing of Personal Data.

4.3 Caletan shall not: (a) sell or share Personal Data; (b) retain, use, or disclose Personal Data for any purpose other than providing the Services; or (c) combine Personal Data received from or on behalf of the Subscriber with Personal Data received from other sources, except as permitted by Applicable Data Protection Laws.

4.4 If Caletan determines that a Subscriber instruction infringes Applicable Data Protection Laws, Caletan shall promptly notify the Subscriber.

5. Personnel

5.1 Caletan shall ensure that access to Personal Data is limited to personnel who require such access to perform the Services, and that all such personnel are subject to binding confidentiality obligations.

5.2 Caletan shall take reasonable steps to ensure the reliability of its personnel who have access to Personal Data, including appropriate background verification and training on data protection obligations.

6. Security Measures

6.1 Caletan shall implement and maintain appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, damage, alteration, or disclosure, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risks to the rights and freedoms of Data Subjects (in accordance with GDPR Article 32 standards). These measures include:

Encryption: Personal Data encrypted in transit (TLS) and at rest
Access controls: Role-based access controls, multi-factor authentication for administrative access, and principle of least privilege
Infrastructure security: Hosting on industry-standard cloud infrastructure with network security monitoring, firewalls, and intrusion detection
Backup and recovery: Regular automated backups with tested disaster recovery procedures
Logging and monitoring: Audit logging of access to Personal Data, security event monitoring, and alerting

6.2 Caletan shall periodically review and update its security measures to maintain an appropriate level of protection.

7. Sub-Processors

7.1 The Subscriber provides general authorization for Caletan to engage Sub-Processors for the provision of the Services, subject to the requirements of this Section 7.

7.2 Caletan maintains a current list of Sub-Processors, available upon request to [email protected]. As of the effective date of this DPA, the current Sub-Processors include cloud hosting, email delivery, payment processing, and analytics providers.

7.3 Caletan shall notify the Subscriber at least 30 days before engaging any new Sub-Processor or replacing an existing Sub-Processor. Notification will be provided via email to the Subscriber's registered account address.

7.4 The Subscriber may object to a new Sub-Processor within 14 days of receiving notice, providing reasonable grounds for the objection. If the Subscriber objects, Caletan shall use reasonable efforts to make available an alternative arrangement. If no alternative is reasonably available and the parties cannot resolve the objection, the Subscriber may terminate the affected Services without penalty by providing written notice within 30 days of Caletan's notification.

7.5 Caletan shall impose data protection obligations on each Sub-Processor that are at least as protective as those set out in this DPA, including obligations regarding confidentiality, security, and limitations on Processing. Caletan remains responsible for the acts and omissions of its Sub-Processors to the same extent it would be liable for its own acts and omissions.

8. Data Subject Rights

8.1 Caletan shall, taking into account the nature of the Processing, assist the Subscriber through appropriate technical and organizational measures in fulfilling the Subscriber's obligation to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Laws (including rights of access, rectification, erasure, restriction, portability, and objection).

8.2 If Caletan receives a request directly from a Data Subject, Caletan shall promptly notify the Subscriber and shall not respond to the Data Subject directly unless authorized by the Subscriber or required by law.

8.3 The Caletan platform provides self-service tools that enable Subscribers to access, export, correct, and delete Personal Data, supporting the Subscriber's ability to respond to Data Subject requests.

9. Personal Data Breach Notification

9.1 Caletan shall notify the Subscriber without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Personal Data processed on behalf of the Subscriber.

9.2 The notification shall include, to the extent reasonably available:

A description of the nature of the Personal Data Breach, including where possible the categories and approximate number of Data Subjects and Personal Data records affected
The name and contact details of the point of contact at Caletan for further information
A description of the likely consequences of the Personal Data Breach
A description of the measures taken or proposed to be taken to address the Personal Data Breach, including measures to mitigate its possible adverse effects

9.3 Caletan shall cooperate with the Subscriber and take reasonable steps to assist in the investigation, mitigation, and remediation of the Personal Data Breach. Caletan shall provide the Subscriber with sufficient information to enable the Subscriber to meet its obligations under Applicable Data Protection Laws to notify regulatory authorities and affected Data Subjects, where required.

10. Data Protection Impact Assessments

Where a data protection impact assessment is required under Applicable Data Protection Laws (including GDPR Articles 35 and 36), Caletan shall provide reasonable assistance to the Subscriber in conducting such assessment, taking into account the nature of the Processing and the information available to Caletan. This includes providing relevant information about Caletan's processing activities, security measures, and Sub-Processors.

11. Cross-Border Data Transfers

11.1 Personal Data processed by Caletan may be stored and processed in Canada and the United States. By using the Services, the Subscriber acknowledges that Personal Data may be transferred to and processed in these jurisdictions.

11.2 Canada has been recognized by the European Commission as providing adequate data protection. For transfers of Personal Data from the European Economic Area, the United Kingdom, or Switzerland to jurisdictions that have not received an adequacy decision, Caletan shall ensure appropriate safeguards are in place as required by Applicable Data Protection Laws, including, where applicable, the Standard Contractual Clauses.

11.3 If the Standard Contractual Clauses are required, the parties agree to enter into the Standard Contractual Clauses (Module Two: Controller to Processor), which are incorporated into this DPA by reference. The UK Addendum to the Standard Contractual Clauses shall apply to transfers from the United Kingdom.

11.4 If any transfer mechanism relied upon under this Section ceases to be valid under Applicable Data Protection Laws, the parties shall cooperate in good faith to implement an alternative lawful transfer mechanism.

12. Data Deletion and Return

12.1 During the term of the Agreement, the Subscriber may export Personal Data from the Caletan platform at any time using the platform's self-service export tools.

12.2 Upon termination or expiration of the Agreement, Caletan shall provide the Subscriber with a period of 30 days to export Personal Data from the platform.

12.3 Following the 30-day export window, Caletan shall delete all Personal Data processed on behalf of the Subscriber, except where retention is required by Applicable Data Protection Laws or where Personal Data exists in archived backup systems. Backup data shall be securely isolated and deleted in accordance with Caletan's standard backup rotation schedule.

12.4 Upon request, Caletan shall provide written confirmation of deletion.

13. Audit Rights

13.1 Caletan shall make available to the Subscriber, upon reasonable request, information and documentation reasonably necessary to demonstrate compliance with this DPA, including summaries of security audits, certifications, and third-party assessment reports.

13.2 The Subscriber, or a qualified third-party auditor appointed by the Subscriber and subject to confidentiality obligations acceptable to Caletan, may conduct an audit or inspection of Caletan's data processing activities, subject to the following conditions:

The Subscriber shall provide at least 30 days' prior written notice of any audit request
Audits shall be conducted during normal business hours with minimal disruption to Caletan's operations
The Subscriber may conduct no more than one audit per 12-month period, unless required by a regulatory authority or following a Personal Data Breach
The Subscriber shall bear its own costs of conducting the audit

13.3 If an audit reveals material non-compliance with this DPA, Caletan shall promptly take reasonable steps to remediate the non-compliance.

14. Subscriber Responsibilities

14.1 The Subscriber is responsible for compliance with Applicable Data Protection Laws in its capacity as Controller, including:

The accuracy, quality, and legality of Personal Data provided to Caletan
Obtaining all necessary consents, authorizations, and providing all required notices to Data Subjects for the lawful Processing of Personal Data through the Services
Ensuring that the Subscriber's instructions to Caletan comply with Applicable Data Protection Laws
Independently assessing whether the security measures described in this DPA meet the Subscriber's obligations under Applicable Data Protection Laws

14.2 The Subscriber warrants that it has the right and authority to provide Personal Data to Caletan for Processing in accordance with this DPA and the Agreement.

15. General Provisions

15.1 Term. This DPA remains in effect for as long as Caletan Processes Personal Data on behalf of the Subscriber, including any post-termination retention period described in Section 12.

15.2 Governing law. This DPA is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to conflict of laws principles. The parties submit to the exclusive jurisdiction of the courts of Ontario for any disputes arising under this DPA.

15.3 Precedence. In the event of any conflict between this DPA and the Agreement, this DPA shall prevail with respect to the Processing of Personal Data.

15.4 Amendments. Caletan may update this DPA to reflect changes in Applicable Data Protection Laws or processing practices. Caletan will notify active Subscribers of material changes via email. Continued use of the Services after such notification constitutes acceptance of the updated DPA.

15.5 Severability. If any provision of this DPA is held invalid or unenforceable, the remaining provisions shall remain in full force and effect. The invalid provision shall be amended to the minimum extent necessary to make it valid and enforceable while preserving the parties' original intent.

15.6 Contact. For questions regarding this DPA or data processing matters, contact us at [email protected].

Reservita Inc. Ontario, Canada [email protected]