PERSONAL DATA PROCESSING ADDENDUM
(the “DPA”)
Curious Platform – Child Mind Institute, Inc.
This Personal Data Processing Addendum (this “DPA”) supplements the Master Services Agreement of the Curious application and platform available at https://www.gettingcurious.com/msa, between the Applet Creator and Child Mind Institute, Inc., or such other equivalent instrument entered into between the parties governing the Applet Creator’s use of the Platform (the “Agreement”). This DPA is an agreement between Child Mind Institute, Inc. (“CMI”, “we” or “our”) and the legal entity identified as the Applet Creator under the Agreement (the “Applet Creator”, “you” or “your”) and is applicable to the extent the use of the Platform is subject to Brazilian privacy laws including the Brazilian General Data Protection Law (Federal Law No. 13,709/2018, the “LGPD”). Unless otherwise defined in this DPA or in the Agreement, capitalized terms used in this DPA have the meaning given to them in Clause 15 (Definitions) below.
1. Data Processing
1.1 Scope and roles. This DPA applies whenever Processed Data is processed by CMI on behalf of the Applet Creator. For purposes of this DPA, CMI acts as processor and the Applet Creator acts as controller of the Processed Data handled in connection with the Applets it creates, without prejudice to CMI acting as an independent controller with respect to account registration, browsing, and institutional communication data described in the Agreement and in the Platform’s Privacy Policy, to which this DPA does not apply.
1.2 Details of the processing
Subject matter: the Processed Data handled through the Applets made available on the Platform by the Applet Creator.
Duration: for the term of the Agreement, subject to Clause 12 below.
Purpose: CMI’s provision of the services of making available and operating the Platform and the Applets, in accordance with the Applet Creator’s instructions.
Nature of the processing: hosting, storage, collection, structuring, making data available to the Applet Creator, and other operations necessary to provide the services described in the Agreement.
Types of Personal Data and categories of data subjects: as described in the Agreement, in Annex 2 to this DPA, or, absent a specific description, in the Platform’s Privacy Policy.
1.3 Compliance with law. Each party will comply with the laws applicable and binding on it in the performance of this DPA, including the Brazilian General Data Protection Law (Federal Law No. 13,709/2018, the “LGPD”) and the regulations issued by the Brazilian Data Protection Agency (the “ANPD”).
2. Applet Creator’s Instructions
2.1 CMI will process the Processed Data only in accordance with the Applet Creator’s Documented Instructions, including those provided through any configuration tools made available on the Platform. Additional instructions outside the scope of the Documented Instructions will require the parties’ prior written agreement, including as to any additional fees.
2.2 If CMI believes that an instruction from the Applet Creator infringes the LGPD or other applicable data protection law, it will immediately inform the Applet Creator, in which case the Applet Creator may withdraw or modify the instruction in question.
2.3 The Applet Creator understands and agrees that it is responsible for verifying the age of any individuals the Applet Creator directs to the Platform.
3. Confidentiality of Processed Data
3.1 CMI will not access, use, or disclose to any third party the Processed Data, except as necessary to (i) provide the services under the Agreement; (ii) comply with the law or a valid and binding judicial, regulatory or governmental order; or (iii) as expressly authorized by the Applet Creator.
4. Confidentiality Obligations of CMI Personnel
4.1 CMI will restrict its personnel’s access to the Processed Data to what is strictly necessary to provide the services, and will impose on its employees and contractors contractual confidentiality and data protection obligations consistent with this DPA.
5. Security of Processing
5.1 CMI has implemented and will maintain the technical and organizational measures described in Annex 1 (Security Measures), taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to data subjects’ rights and freedoms.
5.2 The Applet Creator is responsible for properly configuring the Platform and for using the security features and controls made available on it, where applicable, to further protect the Processed Data.
6. Sub-processing
6.1 General authorization. The Applet Creator provides general authorization for CMI to engage third parties (“Sub-processors”) to process Processed Data on its behalf, in accordance with this Clause. The list of Sub-processors currently engaged by CMI is available at https://www.gettingcurious.com/subprocessors. Sub-processors located outside Brazil are engaged as recipients of an Onward Transfer under Clause 10.3.
6.2 Right to object. The Applet Creator may object to the engagement of a new Sub-processor by written notice to CMI, in which case the parties will use good-faith efforts to agree on an alternative solution; absent agreement, the Applet Creator may terminate the Agreement with respect to the service that depends on the objected-to Sub-processor.
6.3 Flow-down obligations. CMI will (i) enter into a written contract with each Sub-processor imposing data protection obligations equivalent to those undertaken by CMI under this DPA, including, for Sub-processors located outside Brazil, the safeguards CMI is required to flow down under Clause 18 of the Standard Contractual Clauses referred to in Clause 10; and (ii) remain fully responsible to the Applet Creator for the Sub-processor’s compliance with the obligations under this DPA.
7. Data Subject Rights
7.1 Because the Applet Creator acts as controller under this DPA, it is responsible for responding to data subjects’ requests regarding the rights set out in Article 18 of the LGPD. If CMI receives a request from a data subject relating to Processed Data handled in connection with an Applet, it will forward the request to the Applet Creator without undue delay once it identifies that the data subject is one for whom the Applet Creator is responsible.
7.2 CMI will provide the Applet Creator with reasonable assistance to respond to data subjects’ requests, taking into account the nature of the processing and the information available to CMI.
8. Security Incident Notification
8.1 CMI will notify the Applet Creator without undue delay after becoming aware of a security incident affecting Processed Data (a “Security Incident”), and will take appropriate measures to address the Security Incident, including measures to mitigate its adverse effects.
8.2 The notification will include, to the extent available to CMI, a description of the nature of the Security Incident, the categories and approximate number of affected data subjects and records, the likely consequences of the Security Incident, and the measures taken or proposed to mitigate it, and may be supplemented as further information becomes available.
8.3 The Applet Creator, as controller, is responsible for assessing whether the Security Incident must be reported to the ANPD and to affected data subjects, and may rely on CMI’s reasonable cooperation for that purpose.
9. Audits and Certifications
9.1 Upon the Applet Creator’s written request, and subject to an applicable confidentiality agreement between the parties, CMI will make available reasonable information regarding its security measures, including any certifications and audit reports it holds, to enable the Applet Creator to verify CMI’s compliance with this DPA.
10. International Transfer of Personal Data
10.1 Location of processing. CMI processes the Processed Data in the United States of America and may engage Sub-processors located in other countries, in accordance with Clause 6.
10.2 Application of the Standard Contractual Clauses. Whenever the processing under this DPA involves an international transfer of personal data under Articles 33 to 36 of the LGPD and the Regulation on the International Transfer of Personal Data approved by ANPD Resolution No. 19, of August 23, 2024 (“ANPD Resolution No. 19/2024”), the Applet Creator, as Exporter and controller, and CMI, as Importer and processor, will enter into the standard contractual clauses set out in Annex II to ANPD Resolution No. 19/2024 (the “Standard Contractual Clauses”). Because the Applet Creator is the only controller involved in this transfer, the Applet Creator will be the “Designated Party” under Clause 4 of the Standard Contractual Clauses for purposes of Clauses 14, 15 and 16 thereof, consistent with the requirement that this responsibility cannot be assigned to the party acting as processor.
10.3 Onward transfers to Sub-processors. CMI’s engagement of Sub-processors located outside Brazil under Clause 6 is authorized as an Onward Transfer under Option B of Clause 3 of the Standard Contractual Clauses executed with the relevant Applet Creator. Consistent with Clause 18 of the Standard Contractual Clauses, CMI will (i) ensure that the purpose of any such Onward Transfer is compatible with the purposes described in Clause 2 of the Standard Contractual Clauses; (ii) guarantee, through the written contract referred to in Clause 6.3, that the Sub-processor observes safeguards equivalent to those set out in the Standard Contractual Clauses; and (iii) remain responsible, as between CMI and the Applet Creator, for any irregularities committed by the Sub-processor in connection with the Onward Transfer.
10.4 Alternative transfer mechanism. The Standard Contractual Clauses will not apply to an international transfer if it is instead based on another valid mechanism under Articles 33 to 36 of the LGPD and ANPD Resolution No. 19/2024 (such as an ANPD adequacy decision, global corporate rules, a seal, certificate or code of conduct, or specific contractual clauses approved by the ANPD for that transfer), in which case the applicable legal basis will be indicated in the Agreement or in a specific annex to this DPA.
10.5 Integrity of the Standard Contractual Clauses. Nothing in this DPA varies, modifies or replaces the text approved by the ANPD for the Standard Contractual Clauses.
11. Sensitive Personal Data and Data of Children and Adolescents
11.1 Where Applets involve the processing of sensitive personal data (Article 5(II) and Article 11 of the LGPD), including data relating to physical or mental health, CMI will process such data solely within the limits of the Applet Creator’s Documented Instructions and the additional safeguards described in Annex 1.
11.2 The Applet Creator, as controller, is responsible for ensuring an adequate legal basis for the processing of personal data of children and adolescents, including with respect to any age-assurance and parental-supervision mechanisms required under applicable law, including Law No. 15,211/2025 (the “Digital ECA”). Where requested by the Applet Creator and to the extent operationally feasible, CMI may assist the Applet Creator in adopting such mechanisms on the Platform, it being understood that such assistance does not imply that CMI assumes responsibility for determining the legal basis for the processing.
12. Term, Return and Deletion of Data
12.1 This DPA will remain in effect for as long as the Agreement remains in effect.
12.2 Upon termination of the Agreement, CMI will, at the Applet Creator’s choice, delete or return the Processed Data within 90 days, unless CMI is legally required to retain the data for a different period, in which case the data will be retained solely for that purpose and for the legally required period.
13. Data Protection Officer and Communication with the ANPD
13.1 CMI has appointed a Data Protection Officer to act as a communication channel with data subjects and the ANPD regarding the personal data CMI processes as controller. The Data Protection Officer may be contacted at [insert name] – [insert email / [email protected]].
13.2 With respect to the Processed Data covered by this DPA (in which CMI acts as processor), primary responsibility for interacting with data subjects and the ANPD rests with the Applet Creator, as controller, and CMI will provide the cooperation described in Clause 7.
14. General Provisions
14.1 Hierarchy. This DPA forms part of the Agreement. In the event of a conflict between the Agreement and this DPA, this DPA will prevail with respect to data protection matters, except as set out in Clause 10.4 regarding the Standard Contractual Clauses.
14.2 Amendments. CMI may update this DPA to reflect changes in data protection law or ANPD regulations, upon reasonable prior notice to the Applet Creator.
14.3 Governing law and jurisdiction. This DPA is governed by the laws of the Federative Republic of Brazil.
15. Definitions
“Agreement” has the meaning given in the preamble to this DPA.
“ANPD” means the Brazilian National Data Protection Agency (Agência Nacional de Proteção de Dados).
“ANPD Resolution No. 19/2024” has the meaning given in Clause 10.2.
“Applet” means the digital tool made available by an Applet Creator through the Platform.
“Applet Creator” means the research institution or other legal entity that enters into the Agreement with CMI for the creation and operation of an Applet on the Platform, acting as controller of the Processed Data handled through that Applet, unless the Agreement provides otherwise.
“controller” and “processor” have the meanings given to them in Article 5(VI) and (VII) of the LGPD, respectively.
“data subject” has the meaning given in Article 5(V) of the LGPD.
“Data Protection Officer” has the meaning given in Article 5(VIII) of the LGPD.
“Documented Instructions” means the Applet Creator’s instructions regarding the processing of the Processed Data, as set out in this DPA, in the Agreement, or otherwise provided in writing, including through any configuration tools made available on the Platform.
“international transfer of personal data” has the meaning given in Article 5(XV) and Articles 33 to 36 of the LGPD.
“LGPD” means Federal Law No. 13,709, of August 14, 2018 (the Brazilian General Data Protection Law).
“Onward Transfer” has the meaning given to that term in the Standard Contractual Clauses, namely a transfer of Processed Data, within the same country or to another country, by CMI, as Importer, to a Sub-processor, provided that it does not constitute an Access Request (as defined in the Standard Contractual Clauses).
“Personal Data” has the meaning given in Article 5(I) of the LGPD.
“Platform” means the “Curious” application and website operated by CMI.
“Processed Data” means the Personal Data processed by CMI, as processor, on behalf of and under the Applet Creator’s Documented Instructions, in connection with the Applets it makes available on the Platform.
“Security Incident” has the meaning given in Clause 8.1.
“Sensitive Personal Data” has the meaning given in Article 5(II) of the LGPD.
“Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the international transfer of personal data set out in Annex II to ANPD Resolution No. 19/2024, and any subsequent amendments, as executed between the Applet Creator, as Exporter/Controller, and CMI, as Importer/Processor, under Option A of Clause 4 thereof.
“Sub-processor” means a third party engaged by CMI to process Processed Data on the Applet Creator’s behalf, as described in Clause 6.
“Third Country” means a country that has not been recognized by the ANPD as providing an adequate level of protection for personal data for purposes of Articles 33 to 36 of the LGPD.
ANNEX 1
TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES
Capitalized terms used and not defined in this Annex have the meaning given to them in the DPA.
Please find our security measures here.
ANNEX 2
ANPD Standard Contractual Clauses available here: Brazil SCC's
