Data Processing Addendum

This DPA applies to FalconEye's processing of Personal Information contained in Customer Data, including data relating to student-athletes and staff, in connection with providing the Service to Customer.

Customer is the data controller (or equivalent role under applicable law) for Personal Information it submits to the Service. FalconEye is a service provider/processor acting solely on Customer's documented instructions, as set out in the Agreement and this DPA. FalconEye's general information practices are further described in FalconEye's public-facing Privacy Policy; the processing of Personal Information is governed by the Agreement and this DPA. The subject matter of the processing is the provision of the Service; the nature and purpose of the processing are the hosting, analysis, and generation of scouting and performance analytics as described in the Agreement; the types of Personal Information are account, player-performance, and film data relating to student-athletes, coaches, and staff, including such Personal Information and other Customer Data that Customer or its Authorized Users submit to or generate through the AI Features; and the duration of processing is the Subscription Term and any wind-down period under the Agreement. Processing activities include FalconEye's transmission of Customer Data to generate AI Customer Output. These transmission and generation activities are carried out by automated means. FalconEye's personnel do not, in the ordinary course, access or review the contents of Customer Data (including the inputs used to generate AI Customer Output), and FalconEye accesses the contents of Customer Data only where reasonably necessary to administer, secure, support, or investigate the Service, consistent with Section 6.9 of the Agreement. FalconEye does not permit its third-party AI subprocessors to use Customer Data or AI Customer Input to train their models for the benefit of unrelated third parties

FalconEye will process Personal Information only: (a) to provide, maintain, and support the Service; (b) as necessary to comply with applicable law; or (c) as otherwise instructed in writing by Customer. FalconEye will not use Personal Information for any independent purpose of its own, including model training for unrelated third parties, and will not sell Personal Information.

Where Personal Information constitutes an “education record” under FERPA, FalconEye acts as a “school official” with a legitimate educational interest, performing an institutional service that Customer would otherwise perform with its own employees, and remains under Customer's direct control with respect to the use and maintenance of such records, consistent with 34 C.F.R. § 99.31(a)(1). FalconEye will not disclose education records to any third party except as directed by Customer or required by law.

The Service is intended for individuals who are at least 13 years of age and is not directed to children under 13, and FalconEye does not knowingly collect Personal Information directly from any child under 13. As set out in the Agreement, Customer is responsible for eligibility and for not provisioning accounts or submitting Personal Information for any individual under the age of 13. Customer acknowledges and authorizes FalconEye to operate an automated compliance-monitoring process, on a periodic basis, designed to help identify indicators that an account or Customer Data may relate to an individual under the age of 13, and to flag, suspend, or remove any such account or Personal Information. FalconEye will reasonably cooperate with Customer's requests to review, correct, or delete Personal Information in FalconEye's custody.

FalconEye will ensure personnel authorized to process Personal Information are subject to confidentiality obligations.

FalconEye will implement and maintain administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, disclosure, alteration, or destruction, consistent with the safeguards described in the FalconEye Security Overview, including encryption in transit and at rest, access controls, and routine security review.

FalconEye may engage subprocessors to provide the Service (e.g., cloud hosting, payment processing). FalconEye's current subprocessors are identified in the FalconEye Subprocessor List, which includes cloud hosting, third-party AI, payment processing, banking, and email providers; the List also identifies certain payment-related intermediaries (such as the receiving bank for ACH settlement) that do not process Personal Information and are included for transparency only. FalconEye will impose confidentiality and security obligations on subprocessors no less protective than those in this DPA and will maintain a current subprocessor list available on request. FalconEye will provide notice of a new subprocessor at least thirty (30) days before that subprocessor begins processing Personal Information (by email or by posting an updated Subprocessor List), and will give Customer a reasonable opportunity during that period to object on reasonable data-protection grounds.

Where FalconEye receives a request from an individual (or parent/guardian) to access, correct, or delete Personal Information, FalconEye will promptly direct the request to Customer, unless legally prohibited from doing so, and will reasonably assist Customer in responding.

FalconEye will notify Customer without undue delay, and in no event later than five (5) business days thereafter, after confirming a security incident affecting Customer's Personal Information, and will provide reasonably requested information to help Customer meet its own legal notification obligations.

Upon termination or expiration of the Agreement, and consistent with Section 6.5 (Data Return / Deletion) of the Agreement, FalconEye will, upon Customer's written request, make Customer Data available for export in a standard format for a period not to exceed thirty (30) days, after which it will be deleted from active systems except as retained in routine backups or as required by law (subject to continued confidentiality obligations). Where the Agreement is terminated by FalconEye for Customer's breach or violation (including uncured non-payment of Fees), FalconEye may, as set forth in Section 6.5 of the Agreement, suspend access immediately, decline extended wind-down or migration assistance, and condition an export on payment of undisputed amounts then due; provided that, upon Customer's written request, FalconEye will in all events either return Customer Data to Customer or delete it, and will return or delete Customer Data as and when required by applicable law and FalconEye's obligations to any Customer that is an educational agency or institution.

Upon reasonable written request, and no more than once per year absent a security incident, FalconEye will provide Customer with information reasonably necessary to demonstrate compliance with this DPA, which may include completing a security questionnaire in lieu of an on-site audit.

Where Customer is subject to a state-specific student data privacy law (e.g., New York Education Law § 2-d, California SOPIPA/AB 1584, or similar), the parties agree to cooperate in good faith to execute any additional exhibit reasonably required to comply with that law.

In the event of a conflict between this DPA and the Agreement with respect to the processing of Personal Information, this DPA controls.

Customer: ___________________________

Signature: ___________________________

Name/Title: ___________________________

Date: ___________________________

FalconEye-Faceoff Intelligence System LLC

Signature: ___________________________

Name/Title: Christopher J. O’Connor/Founder

Date: ___________________________