Student Data Privacy Addendum

This DPA governs "Student Data" — personally identifiable information relating to a student that the LEA or its users provide to, or that is generated in, the Service, including "education records" under FERPA (20 U.S.C. § 1232g; 34 C.F.R. Part 99) and "covered information" under Arizona law (A.R.S. § 15-1046). A Schedule of Data identifying the categories of Student Data processed is provided with the executed agreement.

Provider processes Student Data solely to provide the Service and only as the LEA directs.

Ownership and control. All Student Data provided to Provider is and remains the property of, and under the control of, the LEA. Provider claims no ownership of Student Data.

FERPA school official. For FERPA purposes, Provider is a "school official" with a legitimate educational interest, performing an institutional service the LEA would otherwise perform with its own employees, under the LEA's direct control as to the use and maintenance of education records; Provider uses Student Data only for the authorized purpose and does not re-disclose it except as the LEA directs and FERPA permits. (34 C.F.R. § 99.31(a)(1)(i)(B)(1)-(3); § 99.33(a).)

Consequences of non-compliance. Provider acknowledges that improperly re-disclosing Student Data, or failing to destroy it when required, may result in the LEA being barred from providing Provider access to education records for at least five years. (20 U.S.C. § 1232g(b)(4)(B).)

Access, review, and amendment support. On the LEA's request, Provider will make Student Data available so the LEA can meet its obligation to allow parents/eligible students to inspect and review records (generally within 45 days), and will correct records at the LEA's direction. (34 C.F.R. §§ 99.10, 99.20-99.21; for special education, 34 C.F.R. §§ 300.613, 300.618.)

Directory information. Provider will treat and disclose directory information only as the LEA designates and will honor opt-outs; a Social Security number is never treated as directory information. (34 C.F.R. § 99.37(a), (d), (e).)

Government and law-enforcement requests. Provider will notify the LEA in advance of any compelled disclosure of Student Data unless legally prohibited from doing so.

Subprocessors. Provider will bind each subprocessor with access to Student Data, by written agreement, to protections no less stringent than this DPA.

Confidentiality of student-level data. Provider will treat student-level data as confidential, will not treat it as a public record, and will route public-records-style requests to the LEA. (A.R.S. § 15-1042(I).)

Disclosure recordkeeping. Where Provider discloses Student Data at the LEA's direction to any party other than as the LEA's routine school official, Provider will, on request, provide the information the LEA needs to maintain its record of disclosures — the party to whom the disclosure was made and that party's legitimate interest. Provider's own access as a school official is exempt. (34 C.F.R. § 99.32(a), (d); 20 U.S.C. § 1232g(b)(4)(A).)

No sale, no targeted advertising, no profiling. Provider will not sell or rent Student Data, will not use Student Data for targeted advertising, and will not use Student Data to amass a profile of a student except in furtherance of school purposes. (A.R.S. § 15-1046(A)(1)-(3).)

Permitted use. Provider uses Student Data only to provide the Service and for the purposes for which disclosure was made. (34 C.F.R. § 99.33(a)(2).)

Deletion on request. Provider will delete Student Data within a reasonable time following the LEA's request, unless a student or parent consents to its retention. (A.R.S. § 15-1046(C)(2).)

Employee confidentiality and access controls. Provider requires personnel and agents with access to Student Data to comply with this DPA, and limits access to Student Data to those with a legitimate need, using role-based least-privilege controls. (34 C.F.R. § 99.31(a)(1)(ii).)

Disposition of data. On termination or at the LEA's directive, Provider will return or destroy Student Data and, on request, certify its destruction. (Consistent with 34 C.F.R. § 99.31(a)(6)(iii)(C).)

Security program. Provider maintains a cybersecurity program aligned to a nationally recognized framework (for example, the NIST Cybersecurity Framework, NIST SP 800-53, ISO/IEC 27001, or CIS Controls), including administrative, technical, and physical safeguards, encryption of Student Data in transit and at rest, and role-based access controls. Provider designates personnel to coordinate the program, performs at least an annual risk assessment and review, tests the effectiveness of its safeguards, and obtains written assurances from its service providers before releasing Student Data to them. (A.R.S. § 15-1046(C)(1); 16 C.F.R. § 312.8(a)-(b).)

Incident notice to the LEA. Provider will notify the LEA promptly, and in any event within seventy-two (72) hours, after confirming a security incident involving Student Data (unless a law-enforcement agency directs a delay), will provide the details reasonably available, and will cooperate in investigation and mitigation. The LEA remains responsible for notifying affected individuals; Provider will also comply with Arizona's breach-notification statute, including its 45-day timeline and, where more than 1,000 Arizona residents are affected, notice to the Attorney General, the Director of the Arizona Department of Homeland Security, and the three largest nationwide consumer reporting agencies. (A.R.S. § 18-552.)

Audits. On reasonable prior notice and no more than once per year (or after a confirmed unauthorized access), the LEA may audit or request evidence of Provider's compliance with this DPA's security and data-handling obligations.

For LEAs handling special-education records, Provider supports the LEA's confidentiality obligations under the Individuals with Disabilities Education Act, including role-based access, access logging, supporting parental inspection and amendment, and destroying personally identifiable information on request (with the permanent-record carve-out). (34 C.F.R. §§ 300.610-300.624.)

Provider will not disclose special-education personally identifiable information to a party other than a participating agency except as the LEA directs and FERPA/IDEA permit, and will support the LEA's confidentiality safeguards, including maintaining the access logging the LEA needs for its public access list and cooperating with the LEA's designated responsible official. (34 C.F.R. §§ 300.622(a), 300.612, 300.623.)

Where the Service includes surveys or forms, Provider supports the LEA's obligations under the Protection of Pupil Rights Amendment, including consent for surveys revealing protected categories, annual and specific notices, opt-outs, and parental inspection of third-party surveys, and Provider will not repurpose survey responses or use student information for marketing or sale. (20 U.S.C. § 1232h(b), (c)(1)(A), (c)(1)(C), (c)(1)(E), (c)(2)(A), (c)(2)(C).)

General offer of privacy terms. Provider may make an executed DPA available for adoption by other subscribing LEAs on the same terms, consistent with the National Data Privacy Agreement's General Offer.

Priority and survival. This DPA controls over conflicting terms in the Terms of Service (including the incorporated Acceptable Use Policy), Privacy Policy, or an order. The data-return/destruction, confidentiality, and de-identified-data provisions survive termination.

De-identified data. Provider may use data that is not associated with an identified or identifiable student to operate, secure, analyze, improve, develop, and demonstrate the Service, consistent with A.R.S. § 15-1046(E).

Exhibits. The executed agreement includes the standard exhibits (description of services and data elements, schedule of data, definitions, directive for disposition with destruction certification, general offer, and the cybersecurity framework and any state-specific terms).