Institution Terms and Data Processing Agreement

SOUTH AFRICAN INSTITUTION TERMS AND DATA PROCESSING ADDENDUM

Institution services, POPIA role allocation, minors and operator provisions

Academic Quality. Verified.

1. Parties

Provider: PARAMOUNT ENTERPRISE SOLUTIONS (PTY) LTD, registration 2024/611570/07, trading as Veri-AQ. Institution: [INSERT FULL LEGAL DETAILS]. This Addendum forms part of the applicable order/service agreement.

2. Roles

For institution-instructed learner submissions, Veri-AQ may act as operator to the extent it processes personal information only on documented institution instructions. Veri-AQ remains a responsible party for independent purposes such as platform security, service administration, billing and legal compliance.

3. Institution obligations

• Have lawful authority to disclose/process student information through Veri-AQ.
• Maintain accurate authorised-user permissions.
• Provide required learner/guardian notices and authority where minors are involved.
• Do not use automated results as the sole basis for significant adverse decisions.

4. Repositories and similarity

No global cross-customer repository is created from institution submissions merely by upload. An institution-specific repository may be enabled only where the processing schedule documents purpose, authority, access, retention and exit/deletion. Veri-AQ does not use institution-controlled raw content for general model training.

5. Security and subprocessors

Veri-AQ must maintain appropriate technical/organisational safeguards and a current subprocessor/vendor register. Material subprocessor changes are handled under the agreed notice process.

6. International transfers

Institution-controlled personal information may not be transferred or migrated overseas until the applicable POPIA section 72 basis and safeguards are documented. Contractual data-residency or approval requirements remain additional obligations.

7. Retention and exit

Educator/institution raw submissions use an ordinary maximum of 6 months unless a shorter institution rule is agreed. At termination, institution-controlled data is returned/exported or deleted according to the Processing Schedule and lawful retention obligations. Institution repository entries, if any, follow the separately agreed repository exit rules.

8. Incident and rights support

Veri-AQ will cooperate with the institution on applicable data-subject requests and notify the institution without undue delay after becoming aware of a security compromise affecting institution-controlled information, subject to any shorter contractual requirement.

Schedule A – Processing details

Legal review and mandatory-law notice. This policy framework is designed for Veri-AQ operations and must be reviewed by appropriately qualified counsel before a new entity, jurisdiction, school contract, under-13 U.S. workflow or materially new processing purpose is launched. Nothing in this document excludes rights or duties that applicable law does not permit the parties to waive.

Primary legal references

• POPIA: Protection of Personal Information Act 4 of 2013 — https://www.gov.za/documents/protection-personal-information-act

Contact details

Website: www.veri-aq.com | Support: support@veri-aq.com | Privacy / PAIA: privacy@veri-aq.com

Principal address: Hofmeyer Rd, Centurion, South Africa, 0157