Last Updated: March 2026 | Governing Jurisdiction: California, USA

This Data Processing Addendum ("DPA") is entered into between Immerse Inc. ("Immerse" or "Data Processor"), a Delaware corporation with its principal place of business at 2175 Tustin Ave, Costa Mesa, CA 92627, and the Customer identified on the applicable Order Form ("Customer" or "Data Controller").
‍
This DPA is automatically incorporated into and forms part of the Immerse Enterprise Terms of Service (available at immerse.com/legal/enterprise-terms) upon execution of an Order Form that references the Enterprise Terms of Service. No separate execution of this DPA is required. By executing an Order Form, both parties agree to be bound by this DPA as of the DPA Effective Date. This automatic incorporation satisfies the written contract requirement under GDPR Article 28(3) and equivalent provisions under applicable data protection law. Customers who require a countersigned copy of this DPA for their records may request one by contacting legal@immerse.online; Immerse will provide an executed copy within ten (10) business days of such request.
‍
This DPA applies where Immerse processes Personal Data on behalf of Customer in connection with the Services. In the event of any conflict between this DPA and the Enterprise Terms, this DPA shall prevail with respect to the processing of Personal Data.
DPA Effective Date: The date the applicable Order Form is executed, or the date Customer first provides Personal Data to Immerse, whichever is earlier.

‍

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person processed by Immerse on behalf of Customer in connection with the Services.
• "Processing" (and its derivatives) means any operation or set of operations performed on Personal Data, whether or not by automated means.
• "Data Controller" means Customer, the entity that determines the purposes and means of Processing Personal Data.
• "Data Processor" means Immerse, which Processes Personal Data on behalf of and under the instructions of the Data Controller.
• "Sub-processor" means any third party engaged by Immerse to Process Personal Data on Customer's behalf in connection with the Services.
• "Data Subject" means the identified or identifiable natural person to whom Personal Data relates.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.
• "Supervisory Authority" means any governmental, regulatory, or supervisory authority responsible for enforcing applicable data protection laws, including but not limited to the European Data Protection Board, national data protection authorities, the UK Information Commissioner's Office, and Brazil's Autoridade Nacional de Proteção de Dados (ANPD).
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses approved by the European Commission for the transfer of Personal Data to third countries, as amended or replaced from time to time.
• "GDPR" means the EU General Data Protection Regulation 2016/679.
• "LGPD" means Brazil's Lei Geral de Proteção de Dados Pessoais (Law No. 13,709/2018).
• "UK GDPR" means the GDPR as retained in UK law by the European Union (Withdrawal) Act 2018.
• "CCPA" means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020.

‍

2. Scope and Purpose of Processing

2.1 Categories of Data Subjects

Authorized Users of the Immerse platform, being employees, contractors, or students of Customer who have been granted access to the Services.

‍

2.2 Categories of Personal Data

Immerse may process the following categories of Personal Data on behalf of Customer:

• Identity and contact data: name, email address, job title, department, employee ID.
• Language learning data: proficiency assessments, lesson progress, performance metrics, fluency scores.
• Usage and session data: login timestamps, session duration, features accessed, platform interactions.
• Communication data: chat transcripts, voice recordings made during instructor-led sessions (where recording is enabled).
• Spatial interaction data: where applicable, movement and interaction data within VR environments.
• Neural and biometric data: where applicable, eye-tracking data, haptic response data, and spatial intent data generated by VR hardware.

‍

2.3 Purposes of Processing

Immerse processes Personal Data solely to:

• Provide the Services described in the applicable Order Form, including delivering language learning content, facilitating live and AI-driven coaching sessions, and maintaining platform functionality.
• Generate performance analytics and reporting for Customer's administrative users.
• Maintain platform security, prevent fraud, and ensure platform integrity.
• Fulfill legal obligations applicable to Immerse as a data processor.

‍

2.4 Duration of Processing

Immerse will Process Personal Data for the duration of the applicable Order Form term. Upon termination or expiry of the Order Form, Immerse will Process Personal Data only as necessary to facilitate the data retrieval and deletion obligations described in Section 8 of this DPA.

‍

3. Immerse Obligations as Data Processor

3.1 Documented Instructions

Immerse shall Process Personal Data only on documented instructions from Customer, including as set forth in this DPA, the Enterprise Terms, and the applicable Order Form. If Immerse is required by applicable law to Process Personal Data other than as instructed by Customer, Immerse shall inform Customer of such legal requirement before Processing, unless prohibited by law on important grounds of public interest.

‍

3.2 Confidentiality of Processing

Immerse shall ensure that all personnel authorized to Process Personal Data are subject to appropriate confidentiality obligations, whether by contract or statutory duty, and are informed of the confidential nature of the Personal Data they process.

‍

3.3 Security Measures

Immerse shall implement and maintain appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful Processing and against accidental or unlawful loss, destruction, damage, alteration, or unauthorized disclosure. Such measures shall include at a minimum:

• Encryption of Personal Data in transit and at rest using industry-standard protocols.
• Access controls limiting Personal Data access to authorized personnel on a need-to-know basis.
• Regular security assessments and penetration testing.
• Incident detection and response procedures.
• Business continuity and disaster recovery plans.

Immerse shall review and update these security measures regularly to account for changes in technology, the nature of the processing, and the risks presented.

‍

3.4 Sub-processor Management

Customer provides general authorization for Immerse to engage Sub-processors, subject to the requirements of this Section 3.4.

• Immerse shall maintain an up-to-date list of Sub-processors at immerse.com/legal/subprocessors.
• Immerse shall notify Customer of any intended addition or replacement of a Sub-processor by updating the Sub-processor list and providing Customer with at least thirty (30) days' prior written notice via email to Customer's designated contact.
• Customer may object to the engagement of a new Sub-processor on reasonable data protection grounds by notifying Immerse in writing within fifteen (15) days of receiving notice. The parties shall work in good faith to resolve the objection. If no resolution is reached within thirty (30) days, Customer may terminate the affected Order Form without penalty.
• Immerse shall impose data protection obligations on each Sub-processor that are no less protective than those set out in this DPA.
• Immerse remains liable to Customer for the performance of each Sub-processor's obligations under this DPA.

‍

3.5 Assistance with Data Subject Rights

Taking into account the nature of the Processing, Immerse shall assist Customer by implementing appropriate technical and organizational measures to enable Customer to fulfill its obligations to respond to Data Subject requests. Data Subject rights that Immerse shall assist Customer in fulfilling include:

• The right of access to Personal Data.
• The right to rectification of inaccurate Personal Data.
• The right to erasure ("right to be forgotten").
• The right to restriction of Processing.
• The right to data portability.
• The right to object to Processing.

‍

3.6 Data Breach Notification

Immerse shall notify Customer without undue delay, and in any event within seventy-two (72) hours of becoming aware of a Personal Data Breach affecting Customer's data. Such notification shall include, to the extent then known:

• A description of the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects concerned.
• The name and contact details of the data protection officer or other relevant contact at Immerse.
• A description of the likely consequences of the Personal Data Breach.
• A description of the measures taken or proposed to be taken to address the Personal Data Breach.

Where not all information is available at the time of initial notification, Immerse shall provide the remaining information as soon as it becomes available. Immerse shall cooperate with Customer and provide reasonable assistance to enable Customer to fulfill its own breach notification obligations under applicable law.

‍

3.7 Data Protection Impact Assessments

Immerse shall provide reasonable assistance to Customer in conducting data protection impact assessments (DPIAs) and prior consultations with Supervisory Authorities, where required by applicable data protection law.

‍

3.8 Records of Processing

Immerse shall maintain records of Processing activities carried out on behalf of Customer, containing all information required under applicable data protection law, including GDPR Article 30(2) and equivalent provisions. Such records shall be made available to Supervisory Authorities upon request.

‍

4. Customer Obligations as Data Controller

Customer represents and warrants that:

• Customer has the legal authority and all necessary consents, rights, and permissions to provide Personal Data to Immerse for Processing as contemplated by this DPA and the Enterprise Terms.
• Customer's instructions to Immerse comply with applicable data protection laws, including GDPR, LGPD, UK GDPR, and CCPA as applicable.
• Customer will ensure that Authorized Users are informed of the Processing of their Personal Data as required by applicable law, including providing any required privacy notices.
• Customer will promptly notify Immerse of any changes to Customer's instructions that may affect Immerse's Processing obligations.

‍

5. Sub-Processors

5.1 Current Sub-processors

As of the date of this DPA, Immerse engages the following Sub-processors in connection with the Services:

• OpenAI, L.L.C. — Provides AI language model processing services (Processing location: United States). Customer Data is processed under enterprise-grade zero data retention agreements. Customer inputs and data are not used by OpenAI to train foundation models.
• Amazon Web Services, Inc. (AWS) — Provides cloud infrastructure, data storage, and content delivery services (Processing location: United States, with regional deployment options available upon request).

The complete and current list of Sub-processors is maintained at immerse.com/legal/subprocessors and is updated in accordance with Section 3.4 of this DPA.

‍

6. International Data Transfers

6.1 Transfers from the EEA, UK, or Switzerland

Where Personal Data is transferred from the European Economic Area (EEA), United Kingdom, or Switzerland to Immerse or its Sub-processors located in a country not recognized as providing an adequate level of data protection under applicable law, Immerse shall ensure that such transfers are subject to appropriate safeguards, including:

• Standard Contractual Clauses as approved by the European Commission (Module 2: Controller to Processor) for transfers from the EEA;
• The International Data Transfer Agreement (IDTA) or UK Addendum to the SCCs for transfers from the United Kingdom;
• Equivalent transfer mechanisms as approved by the relevant Swiss data protection authority for transfers from Switzerland.

Customer may request a copy of the applicable SCCs or IDTA by contacting privacy@immerse.online. By executing the Order Form that incorporates this DPA, Customer agrees to enter into the applicable SCCs with Immerse as the data importer, which are incorporated herein by reference.

‍

6.2 Transfers from Brazil

Where Personal Data is transferred from Brazil under the LGPD, Immerse shall ensure that such transfers are conducted in compliance with LGPD Chapter V, including by implementing appropriate safeguards such as standard contractual clauses approved by Brazil's ANPD or other lawful transfer mechanisms.

‍

6.3 Onward Transfers by Sub-processors

Immerse shall ensure that any international data transfers made by its Sub-processors are subject to appropriate safeguards equivalent to those described in this Section 6.

‍

7. GDPR, LGPD, UK GDPR, and CCPA Compliance  [AMENDED]

7.1 GDPR Article 28 Compliance

This DPA is intended to constitute the written contract required under GDPR Article 28(3) between a controller and a processor. This DPA is automatically incorporated into the Enterprise Terms of Service upon execution of an Order Form, and no separate signature is required. For all purposes under GDPR, Immerse acts as a Data Processor and Customer acts as the Data Controller with respect to the Personal Data of Authorized Users.

‍

7.2 LGPD Compliance

Where Customer is subject to Brazil's LGPD, this DPA is intended to satisfy the requirements of LGPD Article 37. Immerse shall assist Customer in fulfilling its obligations to Data Subjects under the LGPD, including the rights of access, correction, anonymization, portability, elimination, and information about sharing.

‍

7.3 UK GDPR Compliance

Where Customer is subject to UK GDPR, this DPA applies with appropriate modifications to reflect the requirements of UK data protection law, including the UK GDPR and the Data Protection Act 2018.

‍

7.4 CCPA Service Provider Obligations

To the extent that Customer is a "Business" under the CCPA and Immerse is a "Service Provider," Immerse agrees that it:

• Shall not sell or share Personal Data received from Customer.
• Shall not retain, use, or disclose Personal Data for any purpose other than for the specific purpose of performing the Services, or as otherwise permitted under the CCPA.
• Shall not retain, use, or disclose Personal Data outside of the direct business relationship between Immerse and Customer.
• Shall notify Customer if Immerse determines it can no longer meet its obligations under the CCPA.
• Certifies that it understands the restrictions set forth in this Section 7.4 and will comply with them.

‍

7.5 Regulatory Fines and Enforcement Actions  [NEW]

Immerse's Liability for Regulatory Penalties. Notwithstanding any limitation of liability in the Enterprise Terms of Service (including Section 15 thereof), Immerse acknowledges that fines, penalties, or sanctions imposed by a Supervisory Authority or other governmental authority against Immerse in its capacity as a Data Processor, arising out of Immerse's own failure to comply with its data processing obligations under this DPA or applicable data protection law, are the sole financial responsibility of Immerse. The aggregate liability cap set forth in Section 15.1 of the Enterprise Terms shall not apply to, and shall not be construed to limit, Immerse's liability for:

• Administrative fines assessed under GDPR Article 83 as a result of Immerse's non-compliance with its processor obligations;
• Civil monetary penalties assessed under CCPA/CPRA Section 1798.155 arising from Immerse's processing activities;
• Sanctions or penalties assessed under LGPD Articles 52–54 as a result of Immerse's non-compliance; or
• Any equivalent statutory penalty imposed by a competent Supervisory Authority in any applicable jurisdiction as a result of Immerse's failure to comply with this DPA.

Customer Not Required to Indemnify for Processor Failures. Nothing in the Enterprise Terms of Service or this DPA shall be construed to require Customer to indemnify, hold harmless, or bear responsibility for any regulatory fine, penalty, or enforcement action assessed against Immerse arising from Immerse's failure to comply with its obligations as a Data Processor. This Section 7.5 does not limit Customer's liability for its own failures as a Data Controller under applicable data protection law.

‍

8. Deletion and Return of Personal Data

Upon the earlier of: (i) the termination or expiry of the applicable Order Form; or (ii) Customer's written request, Immerse shall, at Customer's election:

• Return all Personal Data to Customer in a commonly used, machine-readable format (.CSV or .JSON) within thirty (30) days of the request; or
• Securely delete and destroy all Personal Data, including any copies held by Sub-processors, and provide Customer with written confirmation of such deletion within thirty (30) days.

Immerse may retain Personal Data beyond this period only to the extent required by applicable law, in which case Immerse shall notify Customer of such retention requirement and shall maintain the confidentiality of the retained data and Process it only as required by law.

‍

9. Audit Rights

Customer may audit Immerse's compliance with this DPA subject to the following conditions:

• Customer shall provide Immerse with at least thirty (30) days' prior written notice of any audit request.
• Audits shall be conducted no more than once per calendar year, unless a Personal Data Breach or regulatory investigation requires an additional audit.
• Audits shall be conducted during normal business hours in a manner that minimizes disruption to Immerse's operations.
• Any third-party auditor engaged by Customer shall be bound by confidentiality obligations no less restrictive than those in the Enterprise Terms.

Immerse may satisfy Customer's audit rights by providing a current SOC 2 Type II report, ISO 27001 certification, or equivalent third-party security assessment in lieu of a direct audit. If Customer requires an audit beyond what is satisfied by such reports, the parties shall agree in writing on the scope, timing, and cost of such audit before it commences.

‍

10. Term and Termination

This DPA shall remain in effect for as long as Immerse processes Personal Data on behalf of Customer. This DPA shall automatically terminate upon the later of: (i) the expiry or termination of all Order Forms under which Personal Data is processed; or (ii) the completion of Immerse's deletion and return obligations under Section 8. Sections 1 (Definitions), 3.6 (Data Breach Notification), 6 (International Data Transfers), 7 (Regulatory Compliance), and 9 (Audit Rights) shall survive termination of this DPA.

‍

11. General Provisions

11.1 Order of Precedence

In the event of any conflict or inconsistency between this DPA and the Enterprise Terms of Service, this DPA shall prevail with respect to the Processing of Personal Data. In all other respects, the Enterprise Terms of Service shall govern.

‍

11.2 Governing Law

This DPA shall be governed by the laws of the State of California, without regard to its conflict of laws principles, except to the extent that applicable data protection law requires this DPA to be governed by the law of another jurisdiction (e.g., EU or UK law with respect to the SCCs or IDTA).

‍

11.3 Amendments

Immerse may update this DPA from time to time to reflect changes in applicable data protection law, regulatory guidance, or Immerse's processing activities. Immerse shall provide Customer with at least thirty (30) days' prior written notice of any material changes to this DPA. Customer's continued use of the Services after the effective date of any updated DPA constitutes acceptance of the updated terms. If Customer objects to any material change, Customer may terminate the applicable Order Form without penalty within thirty (30) days of receiving notice of the change.

‍

11.4 Severability

If any provision of this DPA is held to be invalid, illegal, or unenforceable, the remaining provisions shall continue in full force and effect.

‍

11.5 Entire Agreement

This DPA, together with the Enterprise Terms of Service and the applicable Order Form, constitutes the entire agreement between the parties with respect to the Processing of Personal Data and supersedes all prior agreements, understandings, and representations relating to such subject matter.

‍

Incorporation and Execution

This Data Processing Addendum is automatically incorporated into and forms part of the Immerse Enterprise Terms of Service upon execution of any Order Form that references the Enterprise Terms of Service. No separate signature on this DPA is required for it to be legally binding.

For customers who require a countersigned copy of this DPA for their compliance records, Immerse will provide an executed copy within ten (10) business days of a written request to legal@immerse.online.

For questions regarding this DPA or to request executed SCCs, please contact: privacy@immerse.online

To request a countersigned copy of this DPA for your records, please contact: legal@immerse.online

‍