Data Processing Addendum

Last updated: October 12, 2026

This Data Processing Addendum ("DPA") forms part of the agreement between Holon Technology LLC ("Holon," "Processor") and the institution or individual that has licensed Holon's software ("Customer," "Controller") for the provision of Holon's Canvas LTI applications and related services (the "Services"). Where this DPA conflicts with the Terms of Service, this DPA governs for matters of personal data.

1. Roles

Customer is the controller of personal data processed through the Services. Holon is the processor and acts only on Customer's documented instructions. Customer's use of the Services constitutes its instruction to process personal data as needed to provide them. Holon does not sell personal data, does not share it for cross-context behavioural advertising, and does not use it to train machine-learning models.

2. Subject matter and duration

Processing continues for the term of the agreement. On termination, Holon will delete Customer's data within 30 days of a written request, or within 90 days of termination if no request is made. Backups containing Customer data are overwritten on the retention cycle described in section 6 and are not retained beyond it.

3. Categories of data subject and personal data

Data subjects: instructors, administrators and other staff who use the Services; students enrolled in Canvas courses the Services act upon.

Personal data:

• Canvas user id, name, email address, course enrolment and role, supplied by Canvas in the LTI launch.
• For student-activity features: Canvas user id, name, and activity signals such as last activity date or submission status, read from Canvas at run time.
• For direct purchasers: name, email, licence and order records.

Holon does not process special categories of personal data as defined by GDPR Article 9, and does not require them to provide the Services.

4. Student data

Holon processes student personal information only as a school official with a legitimate educational interest under FERPA (34 CFR § 99.31(a)(1)(i)(B)), under the direct control of the institution. Holon does not use student data for any purpose other than providing the Services, does not disclose it except as set out in this DPA, and does not retain it after the retention periods below. For Customers subject to it, Holon will process student data consistent with applicable state student-privacy law.

5. Sub-processors

Customer authorises Holon to engage the sub-processors listed on the Security page, which is maintained as the current list. Holon will give Customer at least 30 days' written notice before adding or replacing a sub-processor. Customer may object on reasonable data-protection grounds within that period; if the objection cannot be resolved, Customer may terminate the affected Services and receive a pro-rata refund of prepaid fees. Holon remains liable for its sub-processors' performance.

6. Security measures

Holon maintains the technical and organisational measures described on the Security page, which forms part of this DPA. In summary: encryption in transit (TLS 1.2+) and encryption at rest for credentials and backups; default-deny authentication with role verification against Canvas; per-tenant data scoping; service isolation under unprivileged accounts; a strict Content-Security-Policy; credential redaction in logs; and a gated release process. Holon will not materially reduce these measures during the term.

Retention: launch sessions 30 days; access logs 14 days with credentials redacted; database backups every six hours with 14 retained and mirrored to encrypted offsite storage; configuration and account records for the life of the agreement.

7. Personnel

Access to production systems and Customer data is limited to personnel who need it to operate or support the Services, and is subject to a duty of confidentiality that survives the end of their engagement.

8. Incident notification

Holon will notify Customer's named contact without undue delay and within 72 hours of becoming aware of a personal data breach affecting Customer data, by email to the address on the account. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records affected so far as known, the likely consequences, and the measures taken or proposed. Holon will provide updates as the investigation develops and will reasonably assist Customer with its own notification obligations.

9. Assistance to the Controller

Taking into account the nature of the processing, Holon will assist Customer, at Customer's reasonable request, with: responses to data-subject requests for access, correction, deletion, restriction, objection or portability; data protection impact assessments; and consultation with supervisory authorities. Where Holon receives a request directly from a data subject, it will not respond substantively but will refer the request to Customer without undue delay.

10. Audit

Holon will make available the information reasonably necessary to demonstrate compliance with this DPA, including a completed HECVAT on request. Customer may request an audit no more than once per twelve-month period, on 30 days' notice, during business hours, subject to confidentiality, and conducted so as not to disrupt the Services. Holon does not currently hold a SOC 2 report; this is stated plainly rather than implied otherwise.

11. International transfers

Holon processes and stores Customer data in the United States and does not transfer it outside the United States. Where Customer is subject to GDPR or UK GDPR, the parties will enter into the applicable Standard Contractual Clauses on request, which will be incorporated into this DPA by reference.

12. Return and deletion

At any time during the term, and on termination, Customer may request export of its data in a machine-readable format, and its deletion. Holon will comply within 30 days of the request, except where retention is required by law, and will confirm deletion in writing on request.

13. Contact

Holon Technology LLC
A Florida limited liability company · Florida Document No. L26000526857
7243 Heaven Ln, Fort Myers, FL 33908, United States
Mailing address: 10020 Coconut Rd, Ste 138 #5032, Estero, FL 34135, United States
Data protection and security contact: [email protected]