Data Processing Agreement (DPA)

Effective Date: December 12, 2025

1. Scope and Applicability

This Data Processing Agreement ("DPA") applies to the processing of student and user personal data by Galactic Matrix - Portugal (the "Processor") on behalf of educational institutions and educators (the "Customer") when using the ZunoTales platform.

2. Roles and Responsibilities

The Customer acts as the Data Controller, and Galactic Matrix - Portugal acts as the Data Processor. The Customer is responsible for obtaining any necessary parental consent as required by applicable laws (e.g., COPPA, FERPA, GDPR).

3. Data Categories

Data processed under this agreement includes:

• Student names and ages.
• Teacher/Educator names and contact details.
• User-generated story content and prompts.
• Classroom usage and performance analytics.

4. Security Measures

Galactic Matrix - Portugal implements industry-standard technical and organizational measures to protect data, including encryption at rest and in transit, secure access controls, and regular security audits.

5. Sub-processors

The Processor utilizes trusted sub-processors to provide essential services, including Google Cloud (Firebase) for data storage and Google AI for generation. All sub-processors are bound by confidentiality and data protection obligations consistent with this DPA.

6. Data Breach Notification

In the event of a confirmed security breach leading to the accidental or unlawful destruction, loss, or unauthorized disclosure of personal data, Galactic Matrix - Portugal will notify the Customer without undue delay.

7. Contact Information

For inquiries regarding data processing, please contact our Data Protection Officer at dpo@zunotales.com.