Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between HUBERT.STUDIO LLC ("Processor", "ROLearn") and the customer that integrates the ROLearn Multiplatform SDK or an Enterprise/Brand workspace ("Controller", "Customer").

For personal data that the Customer transmits to ROLearn about the end-users of the Customer's games or properties (including player identifiers, session data, coarse country, device/OS, and in-game events) — "Customer Personal Data" — the Customer is the controller and ROLearn is the processor. ROLearn processes Customer Personal Data only on the Customer's documented instructions.

ROLearn processes Customer Personal Data to provide the analytics, dashboards, exports, and SDK features described in the agreement, for the duration of the agreement and until deletion or return as set out in Section 9.

Categories of data subjects: end-users / players of the Customer's games, who may include minors.

Categories of personal data: developer-supplied player identifier, session identifier, coarse country (account-region/locale-derived; not precise geolocation), device type, operating system, and in-game behavioral events. ROLearn's SDK rejects payloads containing direct identifiers (email, phone, government IDs, payment card numbers). The player identifier is typically the player's platform account ID (on Roblox, the numeric UserId). ROLearn stores it as a salted, per-Customer pseudonym, retains the raw ID for no more than 30 days solely to support Customer-initiated Roblox Open Cloud sampling, and treats both as Customer Personal Data.

Purpose: game analytics, performance/crash diagnostics, retention and monetization metrics, brand-activation measurement, and Customer-configured data export.

• Process Customer Personal Data only on the Customer's documented instructions, including for transfers, unless required by law (in which case ROLearn will notify the Customer where permitted).
• Ensure persons authorized to process the data are bound by confidentiality.
• Implement the technical and organizational security measures in Section 6.
• Assist the Customer, taking into account the nature of processing, in responding to data-subject requests and in meeting its security, breach-notification, and data-protection-impact-assessment obligations.
• Notify the Customer of any Personal Data Breach affecting Customer Personal Data as described below.
• Make available information necessary to demonstrate compliance and allow for audits as set out in Section 8.

Personal Data Breach notification. ROLearn will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data. The notice will be sent to the Customer's account contact and will describe, to the extent then known: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; and the measures taken or proposed to address it and mitigate its effects. Where information is not available at once, ROLearn will provide it in phases without further undue delay. ROLearn will take reasonable steps to contain and remediate the breach and will cooperate with the Customer so that the Customer can meet its own notification obligations to supervisory authorities and data subjects. Notification is not an acknowledgement of fault or liability.

The Customer provides general authorization for ROLearn to engage the sub-processors listed on our Sub-processors page. ROLearn imposes data-protection obligations on each sub-processor no less protective than those in this DPA and remains responsible for their performance. ROLearn will give the Customer a mechanism to receive notice of intended changes and a reasonable period to object.

• Encryption in transit (TLS 1.2/1.3) and encryption of data exports prior to delivery.
• Access controls, least-privilege, and role-based permissions for internal systems.
• Data minimization at ingest (rejection of direct-identifier fields) and bounded retention.
• Logging, monitoring, and error tracking; regular backups with tested restore.
• Network isolation between the public-data pipeline and Customer Personal Data stores.

Where processing involves transfer of personal data out of the EEA, UK, or other restricted jurisdictions, the parties incorporate the applicable Standard Contractual Clauses (and the UK Addendum where relevant), and ROLearn supports any data-transfer impact assessment required under Vietnam’s PDPD. The Sub-processors page identifies processing locations.

ROLearn will make available, on the Customer’s reasonable request and subject to confidentiality, documentation sufficient to demonstrate compliance with this DPA, and will contribute to audits conducted by the Customer or an independent auditor at reasonable intervals and with reasonable prior notice.

On termination, and at the Customer’s choice, ROLearn will delete or return Customer Personal Data and delete existing copies within a commercially reasonable period, unless retention is required by law. Customer Personal Data is in any event subject to the retention windows in the Privacy Policy (SDK telemetry default 30 days).

The Customer acknowledges that Customer Personal Data may relate to minors. The Customer warrants that it has obtained and maintains all consents and authorizations required to collect and share such data with ROLearn, including under COPPA, the GDPR (including Article 8 parental consent where applicable), and the rules of any platform on which the Customer’s game operates (e.g. Roblox). ROLearn will not sell children’s data, will not use it for advertising or profiling beyond the analytics the Customer commissions, and applies data minimization as described above.

Each party’s liability under this DPA is subject to the limitations of liability in the underlying agreement (see Terms of Service, Section 11, and any Enterprise & SDK Terms).