Last updated 28 October 2026
1.1 This Data Processing Addendum ("DPA") forms part of the agreement between Wise Leap Technologies, Inc. ("Wise") and the Customer for the Wise Service: the Wise Terms of Service and any Order (the "Agreement"). It applies when Wise processes Customer Personal Data on the Customer's behalf.
1.2 The regional schedule for the Customer's region applies in addition to this DPA. If they conflict, the order of precedence is: (a) any Standard Contractual Clauses or other transfer terms incorporated by a regional schedule; (b) the regional schedule; (c) this DPA; (d) the Agreement.
1.3 This DPA takes effect when the Agreement does, without a separate signature. If a Customer asks for a signed copy, Wise will countersign it. It continues for as long as Wise processes Customer Personal Data.
3.1 Roles. The Customer is the controller of Customer Personal Data, and Wise is its processor. Wise acts as an independent controller only for: (a) account, billing and relationship data about the Customer and its Authorized Users; (b) monitoring login and access patterns to secure the Service; and (c) complying with law. The Privacy Policy governs that processing, not this DPA.
3.2 Instructions. Wise will process Customer Personal Data only on the Customer's documented instructions. Those instructions are the Agreement, this DPA and the Customer's configuration and use of the Service. Wise will tell the Customer if it believes an instruction breaks Data Protection Laws, unless the law prohibits this.
3.3 No other use. Wise will not: (a) sell or share Customer Personal Data, or use it for advertising or profiling; (b) retain, use or disclose it outside the direct business relationship with the Customer; or (c) combine it with personal data Wise receives from other sources, except as needed to provide the Service.
3.4 Customer responsibilities. The Customer is responsible for having a lawful basis and giving all required notices and consents for its processing, including parental consent where children are involved, and for the lawfulness of its instructions.
3.5 Confidentiality. Wise will ensure that everyone it authorizes to process Customer Personal Data is bound by confidentiality obligations and has suitable data protection training.
3.6 Assistance. Taking into account the nature of the processing, Wise will give reasonable assistance with: data subject requests; data protection impact assessments and consultations with regulators; and the Customer's security and breach notification obligations. If a data subject contacts Wise directly, Wise will forward the request to the Customer within 5 business days and will not respond unless the Customer authorizes it. Most requests can be handled through the Service's self-service tools.
4.1 General authorization. The Customer authorizes Wise to engage the Subprocessors listed in Annex 2 for the Customer's hosting region, and new Subprocessors under this Section 4.
4.2 Notice and objection. Wise will give advance notice before a new or replacement Subprocessor begins processing Customer Personal Data, by email or through a subscription at wise.live/subprocessors. The Customer may object on reasonable data protection grounds before the effective date stated in that notice. The parties will try in good faith to resolve the objection. If they cannot, the Customer may terminate the affected part of the Service and receive a refund of prepaid Fees for it.
4.3 Subprocessor terms. Wise will carry out appropriate due diligence on each Subprocessor. It will bind each one by written terms no less protective than this DPA, and remains liable for each Subprocessor's performance.
4.4 Customer-enabled services. Third-party services that the Customer chooses to connect, such as its own payment, calendar, video or messaging accounts (for example, a Twilio account used for SMS or WhatsApp, or a Lessonspace or Pencil Spaces account used for live sessions), are not Wise's Subprocessors. The Customer's own terms with those providers govern them.
5.1 Wise will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data. At a minimum, these include:
5.2 Wise may update these measures, provided the overall level of protection does not decrease.
5.3 On reasonable request, Wise will provide its security documentation, such as security policies and completed security questionnaires.
6.1 Notice. Wise will notify the Customer without undue delay, and in any event within 48 hours, after confirming a Security Incident. Notice goes to the Customer's account owner and any designated privacy contact.
6.2 Content. The notice will include, as the information becomes available: the nature of the incident; the categories and approximate number of data subjects and records affected; its likely consequences; the measures taken or proposed; and a named contact at Wise. Wise will provide updates until the incident is resolved.
6.3 Response. Wise will investigate, contain and remediate the Security Incident and preserve relevant evidence. After a significant incident, it will give the Customer a summary of its findings on request.
6.4 Notifications. The Customer controls notifications to regulators and data subjects. Wise will not notify them on the Customer's behalf without the Customer's prior written approval, unless the law requires it. Wise's notice of a Security Incident is not an admission of fault.
7.1 Hosting region. Customer Personal Data is stored in the hosting region selected for the Customer's account, as shown in Annex 2. Today the regions are United States and India.
7.2 Disclosed access. Some Subprocessors, and Wise's own support and engineering staff, may access Customer Personal Data from other countries to provide, support and secure the Service. All such locations are disclosed in Annex 2. Access is limited to authorized personnel, uses multi-factor authentication and is logged.
7.3 Transfer mechanisms. Where Data Protection Laws restrict a transfer, Wise will rely on the mechanism stated in the regional schedule. These are the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, an adequacy decision or the Data Privacy Framework, or an equivalent mechanism. If a mechanism stops being valid, Wise will put a lawful alternative in place without undue delay and tell the Customer.
7.4 New locations. Wise will give advance notice under Section 4.2 before Customer Personal Data is stored in, or accessed from, a country not already disclosed in Annex 2.
8.1 Documentation first. On request, and no more than once a year, Wise will answer a reasonable written security questionnaire and provide the documentation described in Section 5.3. If Wise later obtains independent certifications or audit reports, such as SOC 2 or ISO 27001, it will provide them on request.
8.2 Audits. If that documentation does not reasonably show compliance with this DPA, or after a Security Incident or a regulator's request, the Customer may audit Wise once a year with advance notice. The audit takes place during business hours, under confidentiality obligations, and at the Customer's cost. Wise may object to an auditor who is a competitor or not suitably qualified or independent.
8.3 Limits. Audits do not extend to other customers' data, Wise's financial records or trade secrets, or anything that would compromise the security of the Service.
9.1 During the Agreement. Customer Personal Data is retained while the Customer's account is active, unless the Customer deletes it. The Customer can delete individual records and export Customer Personal Data at any time through the Service. Session recordings are deleted 15 days after a paid plan expires without renewal.
9.2 Deleted records. When the Customer deletes a record, Wise will remove the personal data that directly identifies the data subject within 30 days. It may keep a residual record, holding only an internal identifier, as evidence of the deletion.
9.3 After termination. Customer Personal Data remains available for export for 30 days after the Agreement ends. Wise will then delete it, including from backups in line with its backup cycle, within a further 30 days, unless the law requires Wise to keep it.
9.4 Method and certificate. Deletion will follow recognized secure deletion practices, such as NIST SP 800-88. On request, Wise will provide a written certificate of deletion within 30 days.
10.1 Child profiles are private by default. Only the Customer's authorized administrators, and the Authorized Users the Customer assigns, can access them.
10.2 A child's messages, posts and progress are visible to the Customer's administrators and to the child's linked parent or guardian. The Customer is responsible for telling children about this.
10.3 Session recording and AI Features can be turned off by the Customer at account level. The Customer decides whether to use them with children.
10.4 Wise does not use children's data for any purpose other than providing the Service, and never for advertising or profiling.
11.1 AI Features are optional and run only when the Customer turns them on. They send the session content the Customer selects to the AI providers listed in Annex 2, currently OpenAI and Anthropic, to generate AI Output.
11.2 Neither Wise nor any Subprocessor will use Customer Personal Data to train or fine-tune AI or machine-learning models. AI providers may keep inputs for no more than 30 days for abuse monitoring, under their enterprise API terms.
11.3 Wise uses the analytics tools listed in Annex 2 only to operate, secure and improve the Service and to give reports to the Customer. Wise may create aggregated, de-identified usage data under Terms Section 7.5, and that data must not identify any data subject or the Customer. Wise will not use content created or uploaded by the Customer or its users, such as messages, files, recordings and AI Output, to improve the Service or to build or test new features.
12.1 Unless the law prohibits it, Wise will promptly notify the Customer of any legally binding request from a public authority for Customer Personal Data.
12.2 Wise will assess each request's legality and scope, and challenge it where it reasonably considers it unlawful or disproportionate. Where disclosure is required, Wise will disclose only the minimum necessary.
12.3 Wise will keep a record of requests and its responses, and share it with the Customer on reasonable request.
13.1 Each party's liability under or in connection with this DPA, including any Standard Contractual Clauses to the extent the law allows, is subject to the limitations and exclusions in Terms Section 17.
13.2 Nothing in this DPA limits either party's liability to data subjects under Data Protection Laws where the law does not allow it to be limited.
| Item | Details |
|---|---|
| Subject matter | Wise's provision of its platform for teaching, training and running education or training businesses, as configured by the Customer |
| Duration | The term of the Agreement, plus the export and deletion periods in Section 9 |
| Nature and purpose | Hosting, storage, transmission and display of Customer Personal Data. Delivering live sessions and recordings, scheduling, messaging, notifications, storefronts and payments, AI Features where enabled, reporting, support, security and data migration requested by the Customer |
| Data subjects | Authorized Users (administrators, managers, tutors, trainers, staff); End Users (learners, trainees, parents, guardians, clients); other people whose data the Customer adds |
| Categories of data | Identity and contact details; account credentials; scheduling, attendance and progress records; messages, files and course content; session audio, video, chat and transcripts; payment and payout records (no full card numbers); technical and usage data; any other fields the Customer configures |
| Special categories | Not required by the Service. Session content may incidentally include health, accessibility or safeguarding information. The Customer decides whether to collect such data |
| Frequency | Continuous, for as long as the Customer uses the Service |
| Customer privacy contact | The contact given in the Customer's account settings |
| Wise privacy contact | Mubeen Masudi, President, info@wiseapp.live |
This list is taken from Wise's existing regional DPAs. Anthropic and Stripe are added. Firebase and Featurebase are added. Services that run under the Customer's own account, such as Twilio, Lessonspace and Pencil Spaces, are not listed (Section 4.4).
| Subprocessor | Purpose | US-hosted customers | India-hosted customers | Transfer mechanism (UK/EU data) |
|---|---|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting, file and recording storage, identity and access management | AWS US regions | AWS Mumbai region | DPF (EU, UK extension); SCCs fallback |
| MongoDB, Inc. (Atlas) | Managed database | US regions | Mumbai region | DPF; SCCs fallback |
| Functional Software, Inc. (Sentry) | Error monitoring | United States | United States | DPF; SCCs fallback |
| Zoom Communications, Inc. | Live video sessions | North America | India | DPF; SCCs fallback |
| Google LLC (Firebase: Cloud Messaging, Analytics, Crashlytics, Authentication) | Push notifications, app usage analytics, crash reporting and sign-in for the Wise and branded mobile apps | United States | United States | DPF; SCCs and UK IDTA fallback under Google's data processing terms |
| CORDNET OÜ, trading as Featurebase (Estonia) | Bug reports and product feedback from users | European Economic Area | European Economic Area | None needed for EU data; UK adequacy regulations for UK data; Featurebase's SCCs for its own onward transfers |
| OpenAI OpCo, LLC | AI Features (optional) | United States | United States | DPF; SCCs fallback under OpenAI's Data Processing Addendum |
| Anthropic, PBC | AI Features (optional) | United States | United States | SCCs and UK IDTA under Anthropic's Data Processing Addendum |
| Stripe Payments UK Limited (UK); Stripe Payments Europe, Limited (EEA); Stripe, Inc. (US and rest of world) | Payments, split payments and payouts | United States, with Stripe's global infrastructure | Not used; India payments go through local providers | DPF; SCCs and UK IDTA fallback under Stripe's Data Transfers Addendum |
| RudderStack (self-hosted) | Product analytics | On Wise's AWS | On Wise's AWS | No separate transfer |
| Metabase (self-hosted) | Internal reporting | On Wise's AWS | On Wise's AWS | No separate transfer |
| Wise Leap Technologies Private Limited (affiliate) | Engineering, support and data migration through remote access only | India (remote access) | India | SCCs Module 3 and UK IDTA |
Each schedule applies to Customer Personal Data subject to that region's laws. A Customer may be covered by more than one schedule.
UK.1 Laws. Data Protection Laws include the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, each as amended by the Data (Use and Access) Act 2025. The competent supervisory authority is the Information Commissioner's Office.
UK.2 Transfers to Wise. Transfers from the Customer to Wise in the United States are made under the EU Standard Contractual Clauses, Module 2, as completed in Schedule EU. These are supplemented by the UK International Data Transfer Addendum (version B1.0) issued under section 119A of the Data Protection Act 2018 ("UK Addendum"). In the UK Addendum: Table 1 is completed with the parties' details in the Agreement; Table 2 refers to the Clauses as completed in Schedule EU; Table 3 refers to Annex 1, Section 5 and Annex 2 of this DPA; and in Table 4, neither party may end the UK Addendum under its Section 19.
UK.3 Onward transfers. Transfers to the India affiliate, and to Subprocessors not certified under the UK Extension to the Data Privacy Framework, are made under Module 3 of the Clauses together with the UK Addendum. Transfers to certified Subprocessors rely on the UK Extension.
EU.1 Laws. Data Protection Laws include the GDPR, the ePrivacy Directive 2002/58/EC and national implementing laws in the EEA, and the Swiss Federal Act on Data Protection.
EU.2 Standard Contractual Clauses. Transfers from the Customer to Wise are made under the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("Clauses"), Module 2. Transfers from Wise to the India affiliate and to Subprocessors not certified under the EU-US Data Privacy Framework are made under Module 3. The Clauses are incorporated by reference and completed as follows:
EU.3 Switzerland. For data subject to Swiss law, references to the GDPR mean the Swiss Federal Act on Data Protection, the competent authority is the Federal Data Protection and Information Commissioner, and "Member State" includes Switzerland.
US.1 Laws. Data Protection Laws include the California Consumer Privacy Act as amended by the CPRA ("CCPA"), and other US state consumer privacy laws. They also include the Children's Online Privacy Protection Act ("COPPA"), the Family Educational Rights and Privacy Act ("FERPA"), and state student privacy laws, such as California's Student Online Personal Information Protection Act.
US.2 Service provider terms. The Customer discloses Customer Personal Data to Wise only for the limited and specified purpose of providing the Service. Wise will:
The Customer may take reasonable steps to ensure Wise's processing is consistent with the CCPA, and to stop and remediate unauthorized processing.
US.3 FERPA. Where the Customer is an educational agency or institution, Wise acts as a "school official" with a legitimate educational interest under 34 CFR 99.31(a)(1). It is under the Customer's direct control in its use and maintenance of education records, and will not redisclose them except as FERPA allows.
US.4 COPPA. Where the Customer is a school, it may consent on behalf of parents to collection of children's personal information solely for an educational purpose, and Wise will use that information only for that purpose. Otherwise, the Customer is responsible for obtaining verifiable parental consent. Wise will help the Customer respond to parents' requests to review or delete their child's information.
US.5 Student data. Wise will not use student data for targeted advertising, to build a profile of a student for non-educational purposes, or for sale. Wise does not process biometric identifiers.
AU.1 Laws. Data Protection Laws include the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs").
AU.2 APPs. Wise will handle Customer Personal Data in a way consistent with the APPs, as if it were bound by them, including when it is accessed or held outside Australia. This lets the Customer take reasonable steps under APP 8.1 for those disclosures.
AU.3 Data breaches. Wise's notice under Section 6.1 will include the information the Customer needs to assess whether a breach is an eligible data breach under Part IIIC of the Privacy Act. Wise will help the Customer complete that assessment within 30 days. The Customer is responsible for notifying the Office of the Australian Information Commissioner and affected individuals.
AU.4 Children. Wise will review this schedule when the Children's Online Privacy Code takes effect.