Data Processing Agreement

1. Parties, purpose and incorporation

This Agreement is between EASYKIDS2GO LLC ("EasyKids") and the customer organization identified in the accepted service order ("Customer"). It forms part of the business subscription agreement identified in Schedule A upon valid acceptance of the exact documents by authorized representatives.

It governs processing entrusted to EasyKids to provide the contracted software functions, including supporting services. Customer may be a transportation company, school, daycare or other authorized organization within the United States. Nationwide commercial scope does not establish uniform compliance with all state laws or remove the need for specific addenda. EasyKids provides software; the identified transportation provider retains its transportation functions and agreements. This DPA does not incorporate BabyBus's transportation contract or make EasyKids a transportation provider, physical custodian or clinical provider.

Schedules A–E form part of this Agreement. The specific relationship must identify the parties, instructions, locations, measures, retention and contacts. This Agreement does not retroactively change existing privacy commitments, signatures or acceptances.

2. Definitions and data scope

Customer Data means data, documents and content Customer or its authorized users provide or generate through the service for Customer's contracted purposes. Entrusted Personal Data means the portion relating to identified or identifiable people that EasyKids processes on Customer's behalf and instructions, including the categories selected in Schedule A. Referring to Customer Data does not confer absolute ownership over people, records or others' rights.

Instructions means this DPA, the applicable agreement and schedules, authorized configuration and Customer's lawful documented requests within the service. Subprocessor means a provider engaged by EasyKids to process Entrusted Personal Data on its behalf to provide that service. A recipient acting for its own purposes is not automatically classified as a Subprocessor.

Data Incident means a compromise of the confidentiality, integrity or availability of Entrusted Personal Data, including unauthorized access, disclosure or use, alteration, loss or destruction. Rejected attempts without compromise and routine service faults are not themselves Data Incidents; reasonable suspicions are investigated and may trigger obligations before a final determination.

Applicable Law means privacy, security and recordkeeping obligations that apply to the processing and each party based on its facts, functions and jurisdiction. "Controller," "processor," "service provider" and equivalent terms will be used according to the regime that actually applies, not as a certification or automatic adoption of a foreign regime. Unless stated otherwise, days are calendar days; business days are Monday through Friday, excluding United States federal holidays, using America/New_York. Mandatory deadlines retain their own counting rules.

3. Roles and instructions

Customer determines the purposes and instructions for entrusted processing. It must have sufficient authority to provide the data and commission the functions, maintain accurate and current data and access and custody instructions, designate authorized users and fulfill notices, permissions or other lawful grounds appropriate to its role. If acting for a school or another controller, it will identify that relationship and establish the authority needed to engage EasyKids. It will not represent that an organizational signature replaces every family consent or judicial authority.

EasyKids will process Entrusted Personal Data only under valid Instructions and to provide the service, subject to legally required uses addressed in clause 10. If it believes an instruction violates Applicable Law, it will notify Customer and coordinate a resolution; it will not carry out an unlawful instruction. Any restriction will be proportionate and coordinated with safe continuity and urgent obligations, without preserving compromised access.

EasyKids retains its own responsibilities for the software and its data processing. Its limited independent purposes of administering its contractual relationship, SaaS billing, compliance and account security will be identified separately in the Privacy Policy and Schedule A. That classification will not be used to repurpose children's records, GPS or documents for independent commercial purposes. Each party retains obligations arising from its own conduct and actual role.

4. Permitted purposes and prohibited uses

Entrusted processing is limited to contracted functions for routes, pickups and drop-offs, authorized tracking, communications, documents, records, support, security and return of data, within Schedule A's scope. Operations may include receipt, organization, storage, authorized access, necessary transmission, correction, return and deletion when appropriate under clause 12.

EasyKids will not sell or rent personal data about customers, children or users; it will not use children's data for targeted advertising or commercial profiles based on schools, travel or medical needs. It will not train artificial intelligence models with Customer Data or permit its providers to use those data for training. Necessary provider access to perform a function does not authorize those uses. No perpetual commercial exploitation license over content is granted.

Using development tools without Customer Data is not prohibited by that rule. Any future AI function requiring those data will need defined scope and safeguards, reviewed instructions and appropriate notices or permissions; this DPA is not blanket authorization. EasyKids will require its Subprocessors to observe this clause's purpose and use restrictions.

5. Minimization, children, health and access authority

The parties will limit information to what is necessary for authorized purposes. Health and assistance information will prioritize transportation-relevant allergies, mobility or assistance needs, emergency contacts and specific plans needed during transport. A complete medical record will not be requested by default; an additional document requires a justified need or applicable obligation. Customer will keep instructions concerning guardians, authorized adults and custody restrictions current.

Access will be limited by organization, role, need and authority: drivers to necessary information for assigned routes; office personnel to authorized staff; and each parent or guardian to data for which they have authority. A student code, account link or signature on this DPA does not alone establish parental authority or verifiable consent. Medical information must not be exposed in CarPlay or openly visible notifications.

Before processing data subject to special educational, health or state conditions, the parties will identify the applicable situation and complete any required addendum. Customer represents and warrants that, prior to supplying children’s personal information to the Platform (or authorizing parents, guardians or staff to do so), Customer has provided all required privacy notices and obtained all necessary parental, guardian or institutional authorizations required for its role under Applicable Law (including, where applicable to the Customer, the Children’s Online Privacy Protection Act (COPPA, 16 CFR Part 312) and state student-privacy statutes). Where FERPA applies, the school-official exception under 34 CFR § 99.31(a)(1)(i)(B) may be used only if all its requirements are met: EasyKids performs an institutional service or function for which the institution would otherwise use employees; remains under the institution’s direct control over use and maintenance of education records; meets the institution’s school-official and legitimate-educational-interest criteria; and complies with 34 CFR § 99.33 limits on use and redisclosure. Supplying records or signing this DPA alone does not establish that exception. Customer authorization cannot override FERPA restrictions. COPPA applicability and any independent duties of EasyKids as an operator must be evaluated separately; the Customer’s representation does not transfer or extinguish those duties. This DPA is not a HIPAA Business Associate Agreement (BAA); the Platform does not provide clinical diagnosis or medical billing.

6. Confidentiality and security measures

EasyKids will apply technical and organizational measures appropriate to risk and the scope agreed in Schedule B to protect Entrusted Personal Data. It will allow personnel and contractors access only for an authorized need, under appropriate confidentiality obligations and training, and review and revoke permissions when appropriate. Customer will protect its credentials and devices and report personnel changes, lost devices or signs of improper access.

Measures will address identity and authorization, organizational separation, protection of communications and storage according to risk, vulnerability and change management, records, incident response, recovery and providers. The parties will document owners, scope, evidence and gaps to resolve. Schedule B specifies these security requirements; an existing function or scheduled job does not prove continuous operation or complete coverage.

EasyKids will not materially reduce agreed security protections during processing without appropriate review and contractual notice. EasyKids must maintain technical and administrative security controls in accordance with Schedule B and applicable data-security regulations (including Massachusetts 201 CMR 17.00 where applicable), without claiming third-party SOC 2 or ISO 27001 certification, 24/7 continuous human monitoring, or full-disk encryption of every active database table at rest. That clarification does not remove any expressly assumed or legally required security obligation.

7. Subprocessors and changes

EasyKids will maintain an accessible list showing each Subprocessor's legal identity, function, data categories and processing and access locations. Selection will include reasonable diligence and written confidentiality, security, instruction, prohibited-use, cooperation and end-of-service obligations compatible with this DPA. EasyKids retains its responsibilities for entrusted functions; engaging a provider does not transfer all consequences of its own failures to Customer. Schedule C identifies services; each applicable provider relationship must satisfy the written obligations and verified scope required by this section.

For a new or replacement Subprocessor that will process Customer's data, EasyKids will provide valid notice at least 30 calendar days before the planned new processing, by email to the designated contact and persistent app/panel notice. It will identify the provider, function, data, locations and proposed date. Customer may make a written objection on substantiated data-protection grounds within 15 calendar days of that notice. Processing will not be brought forward to day 15, and silence will not become consent to different purposes.

The parties will seek to resolve the objection before the provider accesses that Customer's data. If no viable resolution exists, Customer may terminate the affected service and receive a proportional refund of unused prepaid fees from termination; if the component is inseparable, it may terminate the relevant subscription. No unverified alternative or isolation capability is promised, and objected-to data will not meanwhile be transferred for mere convenience. Safe continuity, export and retention will be coordinated without forced renewal or unexpected loss of records.

A genuine security or continuity emergency permits shorter notice only where Applicable Law and the agreement allow, with documented necessity, minimum scope, provider diligence and notice as soon as possible. It does not include cost savings or convenience, remove applicable objections or remedies, or avoid the need for a compatible alternative if the exception is unavailable. Security facts discovered after the 15-day period and mandatory rights do not expire with that window.

8. Individual requests and assistance

Considering the processing's nature and available information, EasyKids will cooperate with Customer to locate, access, correct, return, restrict or delete data when appropriate, handle applicable requests and appeals, and supply relevant information for privacy and security assessments. It will promptly relay requests received concerning entrusted processing and coordinate their handling without making individuals' rights dependent on an unrelated commercial decision.

Before disclosing or modifying data, identity and authority will be verified using proportionate, relevant information. Other organizations' and individuals' data will be protected, and custody restrictions, shared records and legitimate retention considered. Verification may not be artificially delayed, restart mandatory deadlines or treat a child's code as sufficient evidence of authority. EasyKids may respond directly when its own role or obligation requires, informing Customer when appropriate.

Prior applicable response commitments, including the historical 30-day commitment described in Privacy section 10, and any stricter mandatory deadlines are preserved. The commercial export target in clause 13 does not replace them. Legally or contractually required assistance will not depend on an unagreed additional fee. Optional extraordinary services must be distinguished and quoted before performance.

9. Data Incidents and notification

EasyKids will assess reasonable indications of an incident, take proportionate containment and recovery measures, preserve relevant evidence and document facts and decisions. It will coordinate safe transportation continuity with Customer; that coordination does not require preserving compromised credentials or permit destroying evidence. Each party will provide reasonably necessary cooperation and information concerning its systems and actions.

EasyKids will notify the affected Customer's authorized contact without undue delay upon becoming aware of a Data Incident affecting entrusted processing, or earlier when an applicable obligation is triggered. Through a secure means, it will communicate available facts, known nature and scope, affected categories, foreseeable consequences, measures taken or proposed and a follow-up channel. It will not wait for a final report or complete count where earlier notice is required; it will distinguish confirmed from uncertain information and provide updates. Notification does not require an admission of undetermined legal liability.

The parties will coordinate communications to people, institutions and authorities according to their roles and obligations. EasyKids retains its own duties and will not condition legally required notice on Customer's permission. Content and recipients will be adapted to each regime, without disclosing other customers' data or secrets that increase risk. No universal 72-hour deadline is set, and support hours do not extend legal deadlines.

10. Required disclosures and location

When a binding legal obligation requires processing or disclosure outside Instructions, EasyKids will examine its scope, limit data to what is necessary and notify Customer before disclosure where legally permitted. If prior notice is prohibited, it will document the restriction and notify when appropriate. It will reasonably cooperate with lawful measures to protect data; it does not guarantee successfully challenging every request or disobeying valid orders.

Hosting, backup, support and remote-access locations will be documented by provider in Schedule C. EasyKids's United States location does not establish exclusive residency of all data or access. Transfers requiring a specific addendum, restriction or safeguard will not begin before completing it. Nationwide commercial scope does not automatically authorize new international processing or migration of historical data.

11. Security information and reviews

EasyKids will first provide relevant, current documentation, reasonable answers and authentic evidence of existing controls to assess its obligations. The standard package and ordinary clarifications carry no additional charge. It may protect confidential information through appropriate commitments, without claiming nonexistent certifications or audits.

If documentation is insufficient for a reasonable assessment, or Applicable Law or a competent authority requires, EasyKids will cooperate with a scoped review by competent Customer personnel or an independent auditor. Scope, method, reasonable advance notice and hours will be agreed, preserving continuity and confidentiality. There is no unrestricted access to production, passwords, source code or others' data, or automatic permission for intrusive testing. EasyKids will offer sufficient secure means; protecting trade secrets will not veto mandatory rights, and confidentiality will permit legally required communications.

Ordinary frequency is one audit per Customer every 12 months. This does not limit necessary information, correction or reasonable follow-up. Relevant incidents, substantiated indications of noncompliance and legal or authority requirements are exceptions, without EasyKids's sole veto or undue delay through ordinary advance notice. School or state addenda may specify additional rights.

Customer pays the external auditor it engages for an ordinary review. Extraordinary EasyKids assistance is chargeable only with prior scope, quote and acceptance where permissible. No charge applies to correcting EasyKids's own breaches, and required rights or assistance will not depend on accepting a fee. Incident or noncompliance review costs will be resolved under the facts, law and agreement, including the response-cost rules in clause 15, without automatic transfer to Customer or implied expansion of liability caps.

12. Duration, retention and deletion

Once validly adopted, this DPA will govern for as long as EasyKids retains or processes Entrusted Personal Data. Subscription termination does not extinguish protection, confidentiality, assistance and final-processing obligations that must survive. Data will be kept only as needed by category and purpose during the lawfully established periods in Schedule D.

At service termination, EasyKids will return or delete data according to Customer's valid instructions and Applicable Law, using the schedule and backup treatment specified in Schedule D. Return does not authorize indefinite retention of the remaining copy. Where information must be retained, its grounds, scope, restricted access and review will be documented; an abstract possibility of litigation will not justify keeping everything without limit, nor will a generic interest defeat a legally binding instruction. Data subject to a specific preservation requirement will be used only for that reason until it ends.

Requests concerning adults, shared records and transportation-provider or school records will be resolved according to authority and applicable obligations. Backups, providers and restorations will be addressed to prevent reintroducing data that should be deleted. Proportionate evidence of action will be retained. Adult accounts, organizational closure, return and deletion are separate processes; neither the export window nor 30-day reopening establishes automatic purging.

13. Export and service exit

Customer may request one standard exit export at no additional charge before service ends or within 30 calendar days after its effective end. The window organizes this ordinary commercial service without extinguishing subsequent rights or obligations. A valid request within the window may be completed after it ends. Correcting an incomplete or defective standard delivery attributable to EasyKids does not consume a second paid export. An unpaid invoice will not be used to improperly withhold data.

A verified representative will securely receive legitimately retained, relevant data within the organization's authority: structured records in CSV or JSON as appropriate, and documents and signatures in their retained format, with necessary relationships, dates, authorship and context. Excluded are other organizations' or individuals' data outside that authority, passwords, secrets and EasyKids code. Reconstructing lawfully deleted data or automatic successful import into another system is not promised. Where the automated self-service export tool packages structured JSON/CSV records, message text and incident metadata, any retained binary media attachments, voice notes or signature/document files within the Customer’s authorized scope that are not yet bundled in the single automated archive will be provided through coordinated secure assisted delivery within the same exit process without additional charge.

The delivery target is 10 business days from a complete request with verified identity and authority. Verification and scope definition will proceed without undue delay or discretionary restarts. If complexity arises, EasyKids will explain the reason and expected date; any applicable mandatory or contractual deadline prevails. Download-access expiry will be explained separately, allowing a reasonable opportunity for secure download or reissue.

Optional migrations, special formats or extraordinary assistance may be separately quoted with prior acceptance, without charging for EasyKids's errors or evading mandatory rights or assistance. An export does not renew the subscription, automatically reopen the account or add 30 days of operational access. Schedule E sets out the exit rules.

14. Breach, continuity and remedies

For an ordinary, curable material breach, either party will provide valid notice with reasonably sufficient facts and required correction and allow 30 calendar days from receipt to cure before termination for that cause if the breach persists. Correction must begin without undue delay. That period is not a repair SLA or permission to leave a serious problem unattended.

It does not prevent immediate proportionate containment or restriction for security or custody risks, urgent legal requirements, remedies for serious incurable breaches or mandatory rights. It does not change the Terms' specific office nonpayment schedule or delay refunds, notices or stricter deadlines. Expiry does not automatically interrupt a route or delete data. Decisions, review and restoration where appropriate will be documented.

Remedies for EasyKids's material failure are coordinated with the Terms and Refund Policy: assessing attributable impact, scope and duration, a proportional refund of amounts actually paid for affected service and period, credit only by agreement, and termination for cause with refund of unused prepaid amounts where appropriate. They are not exclusive remedies, duplicate refunds of the same amount or releases for EasyKids's or providers' failures. The Refund Policy section 5 specifies the base/van/office allocation, actual paid periods and overlap safeguards. An integrity or security incident without measurable downtime is not automatically valued at zero; its effects and other harm require separate assessment. Refunds due remain outside damages caps as stated in clause 15. Exit will be coordinated with safe continuity and authorized return of data.

15. Liability, response costs, priority and disputes

One coordinated liability regime. Terms section 11, including its scope, exceptions, fee adjustments, incident grouping and annual aggregates, governs EasyKids's business liability under this DPA. This DPA creates no separate cap or additional pool. For each incident or causally connected group, the general base is the greater of USD500 and valid SaaS fees actually paid within the applicable twelve-month window; the special data limit is twice that base, with a resulting minimum of USD1,000. Ordinary claims remain within the general limit and ordinary plus special data claims within twice the base, subject to the individual and annual limits in the Terms; those limits are not added for the same harm. A floor is part of calculating a ceiling, not an automatic payment or insurance.

The fee base covers the identified Customer entity's integrated subscription: the base fee and all contracted vans, with app and panel forming the same service. Users, vans, locations, monthly invoices and additions do not create new caps or restart consumption or the contractual anniversary. Legally separate entities retain separate calculations even if they share an owner. Genuinely distinct agreements, assignments or reorganizations require written identification without counting fees twice or silently releasing existing obligations. The Terms' fee-window, credit and refund rules apply; the price allocation for a partial service refund does not narrow the liability fee base to the affected van.

Special data category. It covers harm caused by a breach attributable to EasyKids of its confidentiality, security, or data protection and integrity obligations that causes unauthorized access, disclosure or use, alteration, loss or destruction of data, including signatures and custody records, or compromised data availability through a security incident. An internal error can qualify without an outside attacker; an attack alone does not establish breach or liability. Provider conduct is attributed according to EasyKids's own and assumed duties, without automatic exemption for subcontracting or an absolute guarantee against every provider act. An ordinary interruption with no such compromise remains in the general category; third-party internet or GPS problems do not by themselves establish liability.

Customer response costs. Necessary, reasonable and documented costs incurred by Customer to investigate, make mandatory or reasonably justified notifications, and recover or restore data, causally attributable to EasyKids's breach, are treated as direct damages. They may include external response providers, but an invoice alone does not establish necessity or attribution. Where they fall within the special data category, they consume its applicable individual and annual limits rather than being added to them. The same expense is not compensated twice; excessive or unrelated expenses, general improvements and lost profits are not converted into these direct response costs. Applicable exceptions and mandatory rights remain.

EasyKids's own duties and costs. EasyKids bears its own costs of meeting its response and remediation duties; they do not reduce Customer's available compensation limits and are not charged to Customer to correct EasyKids's breach. Exhausting a monetary cap does not end duties to protect, contain, notify, cooperate or restore where applicable. Costs will be coordinated where practicable without making urgent measures or mandatory notices depend on advance approval; urgency may require documentation afterward. Restoration means recovering authentic available evidence, never fabricating signatures or custody records or guaranteeing absolute recoverability.

Litigation defense, fines, third-party settlements and indemnification retain their separate treatment under Terms section 12 and applicable law; this DPA does not create a new indemnity, a reciprocal defense guarantee or a second data limit for those matters. Refunds due under the Refund Policy neither consume nor are reduced by damages caps. A refund for the same incident does not retroactively reduce its base, cap or already determined aggregate; improper charges never increase valid fees. Only an established overlap in the same amount or harm is adjusted, without offsetting distinct harm.

End of service and reactivation. The Terms' end-of-service rules preserve earlier events, claims, defenses, first-event dates and limits. Applicable confidentiality, retained-data protection, exit and covered defense duties continue without renewing the subscription, adding fees or authorizing indefinite retention. For genuinely new events during closure, the fee window is fixed to the twelve months before the effective end, with valid fee refunds made before the new event still accounted for. Upon an accepted effective reactivation of the same relationship, genuinely new events use the twelve months before their first event again, preserving the original anniversary, prior consumption and history. Later discovery or a connected event does not reset a group; another effective end fixes a new window for subsequent new events. Export access is not reactivation and these calculations authorize neither charges nor deletion.

Scope and exceptions remain. The Terms' exceptions for fraud, gross negligence, intentional misconduct and nonwaivable duties or liabilities apply. These business limits do not automatically limit authorities' powers or penalties, personal rights, injuries or custody, or claims by children, parents, drivers and other nonparties. Public entities and free relationships require their own valid treatment. No representative, parent, driver or employee becomes a personal guarantor through this DPA.

Order of precedence: For entrusted personal-data processing, this DPA prevails over the Terms in the event of a direct conflict, and the Terms prevail over the Refund Policy; however, no schedule or order may silently alter the coordinated liability caps in Terms sections 11 and 12 or reduce mandatory privacy rights.

Governing law and disputes: Disputes and governing law follow Terms section 14 (laws and state or federal courts of the Commonwealth of Massachusetts for business subscription disputes, a 30-day good-faith direct negotiation period running concurrently with any applicable cure period rather than a cumulative 60-day wait, and arbitration only by specific mutual written agreement, while preserving urgent relief, small claims, regulatory authorities’ powers and non-waivable statutory rights).

16. Contacts, notices, changes and acceptance

The parties will designate representatives for instructions, requests and incidents in Schedule A and keep their details current. Ordinary support hours will be Monday through Friday, 9 a.m.–6 p.m. New York time, excluding United States federal holidays. Critical reports may also be submitted outside those hours through the critical-incident contact identified in the accepted service order. Assessment will be prioritized according to severity and applicable obligations. Receiving alerts does not mean 24/7 support, continuous human monitoring, immediate response or a fixed resolution time; hours do not restrict protection, response or notification duties. Privacy and incident requests may be sent to easykids2go@gmail.com; any replacement must be verified and communicated with continuity.

EasyKids will communicate ordinary material changes with at least 30 calendar days' valid notice, a summary, version and effective date, by email and persistent app/panel notice. For paid subscriptions, changes ordinarily apply at a renewal after the full notice period, preserving the contracted period and option not to renew. Express acceptance will be obtained where required. Legal requirements or urgent risks permit shorter notice only where permissible, to the necessary extent and with notice as soon as possible, not for commercial advantages, price increases or extending an inaccurate privacy notice. Clause 7 specifically governs Subprocessor changes.

Authentic evidence of notice and acceptance, exact text, version, language, actor and authority, event and receipt times, and an accessible copy will be retained. Sending, delivery to a recipient mail server, display and acceptance are distinct events; opening email or using the service does not alone prove required acceptance. Bounces and failures will be followed up through valid channels without waiting for a next login for urgent notices or restarting deadlines at discretion. New acceptance requests will not block an active route, custody or offline reconciliation.

Acceptance must be by Customer's authorized representative, not users acting for other people or through a prechecked box. Privacy notice and specific permissions are separate. Historical versions will be preserved.

Schedule A. Identification, instructions and processing

The accepted service order identifies the Customer, signatory and authority, services/version, effective date, jurisdictions, entity type, instructions and contractual/privacy/incident contacts. It identifies any processing for another controller. Processing is continuous or event-based while selected functions are provided, with limited later retention under Schedule D. An unspecified category does not authorize additional processing.

Schedule B. Security requirements

The following requirements define the security obligations in coordination with clauses 6 and 11. They do not constitute a certification, a guarantee against every failure, or a claim of encryption of the entire active database.

Schedule C. Services and provider scope

This functional inventory does not classify every service as a Subprocessor. An applicable relationship schedule must identify each contracted entity, role, agreement, processing/access locations and safeguards before the corresponding processing, under clause 7. A service name or public policy does not establish those facts.

Schedule D. Retention and final processing

Applicable historical commitments are preserved without extension. The rules on necessity, specific preservation and copies in clause 12 govern this schedule; a configured cutoff does not prove completed deletion. The schedule does not authorize indefinite retention or establish a single period for unspecified categories.

Schedule E. Exit procedure