Data Processing Agreement

1. Scope and Roles

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Software Quality Associates ("Skooly," "we," "us") and the Skooly customer (the "Owner"), and governs Skooly's processing of personal data of the Owner's email recipients ("Recipients") in connection with the Email Broadcasting feature.

For the purposes of applicable data protection laws (including the EU/UK GDPR and analogous frameworks), the Owner is the Controller of Recipient personal data and Skooly is the Processor. Skooly processes Recipient data only on the Owner's documented instructions, as expressed through the Owner's use of the Service.

This DPA does not cover personal data Skooly processes about the Owner themselves (administrative account data, billing, etc.) — those are governed by the main Privacy Policy where Skooly acts as a Controller.

2. Categories of Personal Data

Skooly processes the following categories of Recipient personal data on behalf of the Owner:

• Contact details: email address and (optionally) display name provided by the Owner via manual entry, CSV import, Skooly Page signup, or import from the Owner's connected Skool community.
• Consent records: double-opt-in confirmation timestamps and signed tokens demonstrating that the Recipient consented to receive email.
• Engagement metadata: per-broadcast deliverability events (sent, delivered, bounced, complained) and, when enabled, open and click events. Sourced from Skooly's sending subprocessor.
• Suppression state: a per-Owner list of email addresses that have unsubscribed, hard-bounced, or filed a spam complaint.
• Optional community linkage: when a Recipient's email matches a member of the Owner's connected Skool community, Skooly may store a link between the email contact and the community member record so the Owner can correlate email engagement with community activity.

Skooly does not process special categories of data (health, biometric, etc.) and instructs Owners not to use the Service to process such data.

3. Purposes of Processing

• Delivering email broadcasts the Owner composes and sends.
• Recording and honoring unsubscribe requests, hard bounces, and spam complaints by adding Recipients to the Owner's suppression list.
• Producing aggregate and per-broadcast deliverability reporting for the Owner.
• Providing the Owner with tools to manage contacts, lists, and broadcasts.
• Maintaining the security, integrity, and lawful operation of the Service.

Skooly will not process Recipient data for its own marketing, for cross-Owner profiling, or for any purpose other than the ones above without the Owner's separate written instruction.

4. Owner Obligations

The Owner warrants and agrees that:

• The Owner has a lawful basis (such as consent or legitimate interest, as applicable) for adding each Recipient to a Skooly list and for sending the Recipient email through Skooly.
• The Owner's email content complies with applicable anti-spam and consumer-protection laws, including the U.S. CAN-SPAM Act (15 U.S.C. §§ 7701–7713), the EU/UK ePrivacy regimes, and Canada's Anti-Spam Legislation (CASL) where any of those apply to the sender or Recipient.
• Every Skooly broadcast the Owner sends includes a valid physical postal address (set in Email Settings) and a functional unsubscribe link, both of which Skooly auto-injects.
• The Owner will respond to Recipient data-subject requests (access, deletion, correction, objection) it receives directly, and will use Skooly's tools (or contact Skooly support) to action such requests against Recipient data held in the Service within the applicable statutory window.
• The Owner's acquisition of Recipient consent — whether via Skooly's double-opt-in flow, the Owner's Skool community signup, or an external source — is documented and producible on demand.

5. Subprocessors

The Owner authorizes Skooly to engage the following subprocessors to deliver the Service. Each subprocessor is bound by terms providing data-protection obligations no less protective than those in this DPA.

Skooly will give the Owner reasonable prior notice of any addition or replacement of a subprocessor by updating this page. The Owner may object to a change by notifying Skooly support; if Skooly is unable to accommodate a reasonable objection, the Owner may terminate the Email Broadcasting feature without penalty.

6. International Transfers

Recipient data may be transferred to and processed in the United States by Skooly and its subprocessors. Where personal data of EU/UK Recipients is involved, Skooly relies on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, where applicable) as the transfer mechanism with each subprocessor, supplemented by the technical measures described in Section 8.

7. Retention and Deletion

• Active contacts and lists: retained for the lifetime of the Owner's account. The Owner can delete individual contacts and lists from the dashboard at any time.
• Suppression list (unsubscribes, bounces, complaints): retained for as long as the Owner's account is active. Required to keep the Owner from re-mailing Recipients who have opted out — deleting suppression rows is not a routine operation. On account closure, suppression rows are deleted within 30 days.
• Broadcast records and recipient snapshots: the per-broadcast frozen recipient list, subject, and body are retained as the audit trail for what was sent to whom. Deleted within 30 days of account closure.
• Unsubscribe tokens: the signed tokens embedded in unsubscribe links remain valid indefinitely so a Recipient can always unsubscribe via a previously-received email.
• Deliverability event metadata: aggregated stats per broadcast are retained for the broadcast's lifetime. Raw events from the subprocessor are kept according to that subprocessor's retention policy.

On termination of the Email Broadcasting feature or the Owner's Skooly account, all Recipient data Skooly holds on behalf of the Owner is deleted or anonymized within 30 days, except where retention is required by law.

8. Security

Skooly maintains technical and organizational measures appropriate to the risk, including:

• Encryption in transit (TLS) for all API and database connections.
• Encryption at rest for the primary database.
• Per-tenant access scoping at the application layer; service-role database operations always filter by Owner identity.
• Egress sanitization of email HTML to prevent stored cross-site-scripting attacks on the Owner's composer preview.
• Signed, expiring tokens for unsubscribe links to prevent forgery.
• Signature verification of inbound webhooks from the sending subprocessor.
• Role-based access control for Skooly staff; production data access is logged.

9. Personal Data Breach Notification

Skooly will notify the Owner without undue delay after becoming aware of a personal data breach affecting Recipient data processed under this DPA, providing such information as the Owner reasonably requires to meet its own notification obligations to supervisory authorities and Recipients.

10. Data Subject Requests

Recipients can unsubscribe themselves at any time using the link in every Skooly-sent email. For other Recipient requests (access, deletion, correction, objection), the Owner should:

• Action requests directly through the Skooly dashboard where possible (delete a contact, unsubscribe a contact).
• Contact Skooly support for requests that the dashboard cannot fulfill (e.g., export of all data Skooly holds about a specific Recipient). Skooly will provide reasonable assistance within 30 days.

If a Recipient contacts Skooly directly, Skooly will route the request to the relevant Owner and reply to the Recipient with the Owner's contact information.

11. Audit Rights

The Owner may request reasonable information demonstrating Skooly's compliance with this DPA. Skooly will respond within 30 days. Owners with specific, documented regulatory obligations requiring on-site audit may request such audits at their own cost, on at least 30 days' written notice, no more than once per 12 months, and subject to mutually agreed scope.

12. Term and Termination

This DPA remains in effect for as long as Skooly processes Recipient data on behalf of the Owner. On termination, Skooly will delete or return Recipient data as described in Section 7.

13. Changes to this DPA

Skooly may update this DPA from time to time. Material changes will be notified by updating the "Last updated" date above and, where practicable, in-app or by email. Continued use of the Email Broadcasting feature after a change constitutes acceptance.

14. Contact

Questions about this DPA or data-protection matters should be directed to: hi@softwarequalityassociates.net.