RICHARDSON ISD

STUDENT DATA PRIVACY AGREEMENT

Fall 2023 v. 1

This Student Data Privacy Agreement (“DPA”) is entered into on the date of full execution (the “Effective Date”) and is entered into by and between:

Richardson ISD, located at 400 S. Greenville Avenue, Richardson, TX 75081 (“Richardson ISD”) and ___________________________________________________________________________, located at _______________________________________________________________________ (the “Provider”).

WHEREAS, the Provider is providing educational or digital services to Richardson ISD.

WHEREAS, the Provider and Richardson ISD recognize the need to protect personally identifiable student information and other regulated data exchanged between them as required by applicable laws and regulations, such as the Family Educational Rights and Privacy Act (“FERPA”) at 20 U.S.C. § 1232g (34 CFR Part 99); the Children’s Online Privacy Protection Act (“COPPA”) at 15 U.S.C. § 6501-6506 (16 CFR Part 312), applicable state privacy laws and regulations and

WHEREAS, the Provider and Richardson ISD desire to enter into this DPA for the purpose of establishing their respective obligations and duties in order to comply with applicable laws and regulations.

NOW THEREFORE, for good and valuable consideration, RISD and Provider agree as follows:

1. A description of the Services to be provided, the categories of Richardson ISD Student Data that may be provided by Richardson ISD to Provider, and other information specific to this DPA are contained in the Standard Clauses hereto.

2. In the event of a conflict between the SDPC Standard Clauses, the State or Special Provisions will control. In the event there is conflict between the terms of the DPA and any other writing, including, but not limited to the Service Agreement and Provider Terms of Service or Privacy Policy the terms of this DPA shall control.

3. This DPA shall stay in effect the term set forth in the underlying contract for services.

4. The services to be provided by Provider to Richardson ISD pursuant to this DPA are detailed in Exhibit A (the “Services”).

5. Notices. All notices or other communication required or permitted to be given hereunder may be given via e-mail transmission, or first-class mail, sent to the designated representatives below.

The designated representative for Richardson ISD for this DPA is:

Name: ______________________________ Title: ___________________________

Address: _____________________________________________________________________

Phone: ____________________________ Email: _____________________________

The designated representative for the Provider for this DPA is:

Name: _____________________________ Title: __________________________

Address: ____________________________________________________________________

Phone: ____________________________ Email: _________________________

6. Provider acknowledges and agrees that should Provider have a standard privacy policy and a conflict arise between the Provider’s policy and this DPA, the terms set forth in this DPA shall control. Furthermore, should Provider have an adopted data privacy/sharing agreement, this DPA replaces the Provider adopted data privacy/sharing agreement.

ARTICLE I: PURPOSE AND SCOPE

1. Purpose of DPA. The purpose of this DPA is to describe the duties and responsibilities to protect Richardson ISD Student Data including compliance with all applicable federal, state, and local privacy laws, rules, and regulations, all as may be amended from time to time. In performing the Services, the Provider shall be considered a School Official with a legitimate educational interest, and performing services otherwise provided by Richardson ISD. Provider shall be under the direct control and supervision of Richardson ISD, with respect to its use of Richardson ISD Student Data.

2. Richardson ISD Student Data to Be Provided. In order to perform the Services described above, Richardson ISD shall provide Richardson ISD Student Data as identified in the Schedule of Data, attached hereto as Exhibit B.

3. DPA Definitions. The definition of terms used in this DPA is found in Exhibit C. In the event of a conflict, definitions used in this DPA shall prevail over terms used in any other writing, including, but not limited to the Service Agreement, Terms of Service, Privacy Policies etc.

ARTICLE II: DATA OWNERSHIP AND AUTHORIZED ACCESS

1. Richardson ISD Student Data Property of RISD. All Richardson ISD Student Data transmitted to the Provider pursuant to the Service Agreement is and will continue to be the property of and under the control of Richardson ISD. The Provider further acknowledges and agrees that all copies of such Richardson ISD Student Data transmitted to the Provider, including any modifications or additions or any portion thereof from any source, are subject to the provisions of this DPA in the same manner as the original Richardson ISD Student Data. The Parties agree that as between them, all rights, including all intellectual property rights in and to Richardson ISD Student Data contemplated per the Service Agreement, shall remain the exclusive property of Richardson ISD. For the purposes of FERPA, the Provider shall be considered a School Official, under the control and direction of Richardson ISD as it pertains to the use of Richardson ISD Student Data, notwithstanding the above.

2. Parent Access. To the extent required by law, Richardson ISD shall establish reasonable procedures by which a parent, legal guardian, or eligible student may review Education Records and/or Richardson ISD Student Data, correct erroneous information, and procedures for the transfer of student-generated content to a personal account, consistent with the functionality of services.

Provider shall respond in a reasonably timely manner (and no later than ten (10) days from the date of the request or pursuant to the time frame required under state law for Richardson ISD to respond to a parent or student, whichever is sooner) to the Richardson ISD’s request for Richardson ISD Student Data in a student’s records held by the Provider to view or correct as necessary. In the event that a parent of a student or other individual contacts the Provider to review any of the Richardson ISD Student Data accessed pursuant to the Services, the Provider shall refer the parent or individual to Richardson ISD, who will follow the necessary and proper procedures regarding the requested information.

3. Separate Account. If Student-Generated Content is stored or maintained by the Provider, Provider shall, at the request of Richardson ISD, transfer, or provide a mechanism for Richardson ISD to transfer, said Student-Generated Content to a separate account created by the student.

4. Law Enforcement Requests. Should law enforcement or other government entities (“Requesting Party(ies)”) contact Provider with a request for Richardson ISD Student Data held by the Provider pursuant to the Services, the Provider shall notify Richardson ISD in advance of a compelled disclosure to the Requesting Party, unless lawfully directed by the Requesting Party not to inform Richardson ISD of the request.

5. Subprocessors. Provider shall enter into written agreements with all Subprocessors performing functions for the Provider in order for the Provider to provide the Services pursuant to the Service Agreement, whereby the Subprocessors agree to protect Richardson ISD Student Data in a manner no less stringent than the terms of this DPA.

ARTICLE III: DUTIES OF RISD

1. Provide Data in Compliance with Applicable Laws. Richardson ISD shall provide Richardson ISD Student Data for the purposes of obtaining the Services in compliance with all applicable federal, state, and local privacy laws, rules, and regulations, all as may be amended from time to time.

2. Consider Provider as School Official. The Parties agree that, for the purposes of the contracted services, Provider is a “school official” under FERPA and has a legitimate educational interest in personally identifiable information from education records received from Richardson ISD pursuant to the DPA. For purposes of the Service Agreement and this DPA, Provider: (1) provides a service or function for which Richardson ISD would otherwise use employees; (2) is under the direct control of the LEA with respect to the use and maintenance of education records; and (3) is subject to the requirements of FERPA governing the use and redisclosure of personally identifiable information from the education records received from the LEA.

3. Reasonable Precautions. Richardson ISD shall take reasonable precautions to secure usernames, passwords, and any other means of gaining access to the services and hosted Richardson ISD Student Data.

4. Unauthorized Access Notification. Richardson ISD shall notify Provider promptly of any known unauthorized access. Richardson ISD will assist Provider in any efforts by Provider to investigate and respond to any unauthorized access.

ARTICLE IV: DUTIES OF PROVIDER

1. Privacy Compliance. The Provider acknowledges that it has a legal obligation to maintain the confidentiality and privacy of student records in accordance with applicable law and regulations, including but not limited to the Family Educational Rights and Privacy Act (FERPA), the Children’s Online Privacy

Protection Rule (“COPPA”), all Texas laws and regulations pertaining to Richardson ISD data privacy and confidentiality that include but are not limited to the Chapter 32 of Texas Education Code and Chapter 560 of the Texas Government Code, and other applicable federal and local laws, rules, and regulations pertaining to Richardson ISD Student Data privacy and security, all as may be amended from time to time.

2. Authorized Use. The Richardson ISD Student Data shared pursuant to the Service Agreement, including persistent unique identifiers, shall be used for no purpose other than the Services outlined in Exhibit A or stated in the Service Agreement and/or otherwise authorized under the statutes referred to herein this DPA.

3. Provider Employee Obligation. Provider shall require all of Provider’s employees and agents who have access to Richardson ISD Student Data to comply with all applicable provisions of this DPA with respect to the Richardson ISD Student Data shared under the Service Agreement. Provider agrees to require and maintain an appropriate confidentiality agreement from each employee or agent with access to Richardson ISD Student Data pursuant to the Service Agreement.

4. No Disclosure. Provider acknowledges and agrees that it shall not make any re-disclosure of any Richardson ISD Student Data or any portion thereof, including without limitation, user content or other non-public information and/or personally identifiable information contained in the Richardson ISD Student Data without prior written consent from RISD, the parent or eligible student or as permitted by law. This prohibition against disclosure shall not apply to aggregate summaries of De- Identified information, Richardson ISD Student Data disclosed pursuant to a lawfully issued subpoena or other legal process, or to Subprocessors performing services on behalf of the Provider pursuant to this DPA or as allowed by law. Provider will not Sell Richardson ISD Student Data to any third party.

5. De-Identified Data: Provider agrees not to attempt to re-identify De-Identified Richardson ISD Student Data. De-Identified Data may be used by the Provider for those purposes allowed under FERPA and the following purposes without prior written consent: (1) assisting Richardson ISD or other governmental agencies in conducting research and other studies; and (2) research and development of the Provider's educational sites, services, or applications, and to demonstrate the effectiveness of the Services; and (3) for adaptive learning purpose and for customized student learning. Provider's use of De-Identified Data shall survive termination of this DPA or any request by Richardson ISD to return or destroy Richardson ISD Student Data. Except for Subprocessors, Provider agrees not to transfer de-identified Richardson ISD Student Data to any party unless (a) that party agrees in writing not to attempt re-identification, and (b) prior written notice has been given to Richardson ISD who has provided prior written consent for such transfer. Prior to publishing any document that names Richardson ISD explicitly or indirectly, the Provider shall obtain Richardson ISD’s written approval of the manner in which De-Identified Data is presented.

6. Disposition of Data. Upon written request from Richardson ISD, Provider shall dispose of or provide a mechanism for Richardson ISD to transfer Richardson ISD Student Data obtained under the Service Agreement, within sixty (60) days of the date of said request and according to a schedule and procedure as the Parties may reasonably agree. Upon termination of this DPA, if no written request from Richardson ISD is received, Provider shall dispose of all Richardson ISD Student Data after providing Richardson ISD with reasonable prior notice. The duty to dispose of Richardson ISD

Student Data shall not extend to Richardson ISD Student Data that had been De-Identified or placed in a separate student account pursuant to section II 3. Richardson ISD may employ a “Directive for Disposition of Data” form, a copy of which is attached hereto as Exhibit D. If Richardson ISD and Provider employ Exhibit D, no further written request or notice is required on the part of either party prior to the disposition of Richardson ISD Student Data described in Exhibit D.

7. Advertising Limitations. Provider is prohibited from using, disclosing, or selling Richardson ISD Student Data to (a) inform, influence, or enable Targeted Advertising; or (b) develop a profile of a student, family member/guardian or group, for any purpose other than providing the Service to Richardson ISD. This section does not prohibit Provider from using Richardson ISD Student Data (i) for adaptive learning or customized student learning (including generating personalized learning recommendations); or (ii) to make product recommendations to teachers or Richardson ISD employees; or (iii) to notify account holders about new education product updates, features, or services or from otherwise using Richardson ISD Student Data as permitted in this DPA and its accompanying exhibits.

ARTICLE V: DATA PROVISIONS

1. Data Storage. Richardson ISD Student Data shall be stored within the United States. Upon request of Richardson ISD, Provider will provide a list of the locations where Richardson ISD Student Data is stored.

2. Audits. No more than once a year, or following unauthorized access, upon receipt of a written request from Richardson ISD with at least ten (10) business days’ notice and upon the execution of an appropriate confidentiality agreement, the Provider will allow Richardson ISD to audit the security and privacy measures that are in place to ensure protection of Richardson ISD Student Data or any portion thereof as it pertains to the delivery of services to Richardson ISD. The Provider will cooperate reasonably with Richardson ISD and any local, state, or federal agency with oversight authority or jurisdiction in connection with any audit or investigation of the Provider and/or delivery of Services to students and/or Richardson ISD, and shall provide reasonable access to the Provider’s facilities, staff, agents and Richardson ISD’s Richardson ISD Student Data and all records pertaining to the Provider, Richardson ISD and delivery of Services to Richardson ISD. Failure to reasonably cooperate shall be deemed a material breach of the DPA.

3. Data Security. The Provider agrees to utilize administrative, physical, and technical safeguards designed to protect Richardson ISD Student Data from unauthorized access, disclosure, acquisition, destruction, use, or modification. The Provider shall adhere to any applicable law relating to data security. The provider shall implement an adequate Cybersecurity Framework based on one of the nationally recognized standards set forth in Exhibit E. Exclusions, variations, or exemptions to the identified Cybersecurity Framework must be detailed in an attachment to Exhibit E. Additionally, Provider may choose to further detail its security programs and measures that augment or are in addition to the Cybersecurity Framework in Exhibit E. Provider shall provide, in the Standard Schedule to the DPA, contact information of an employee who Richardson ISD may contact if there are any data security concerns or questions.

4. Data Breach. In the event of an unauthorized release, disclosure or acquisition of Richardson ISD Student Data that compromises the security, confidentiality or integrity of the Richardson ISD

Student Data maintained by the Provider, the Provider shall provide notification to Richardson IDS within seventy-two (72) hours of confirmation of the incident, unless notification within this time limit would disrupt investigation of the incident by law enforcement. In such an event, notification shall be made within a reasonable time after the incident. Provider shall follow the following process:

(1) The security breach notification described above shall include, at a minimum, the following information to the extent known by the Provider and as it becomes available:

i. The name and contact information of the reporting Richardson ISD subject to this section.

ii. A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.

iii. If the information is possible to determine at the time the notice is provided, then either (1) the date of the breach, (2) the estimated date of the breach, or (3) the date range within which the breach occurred. The notification shall also include the date of the notice.

iv. Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided; and

v. A general description of the breach incident, if that information is possible to determine at the time the notice is provided.

(2) Provider agrees to adhere to all federal and state requirements with respect to a data breach related to the Richardson ISD Student Data, including, when appropriate or required, the required responsibilities and procedures for notification and mitigation of any such data breach.

(3) Provider further acknowledges and agrees to have a written incident response plan that reflects best practices and is consistent with industry standards and federal and state law for responding to a data breach, breach of security, privacy incident or unauthorized acquisition or use of Richardson ISD Student Data or any portion thereof, including personally identifiable information and agrees to provide Richardson ISD, upon request, with a summary of said written incident response plan.

(4) Richardson ISD shall provide notice and facts surrounding the breach to the affected students, parents or guardians.

(5) In the event of a breach originating from Richardson ISD’s use of the Service, Provider shall cooperate with Richardson ISD to the extent necessary to expeditiously secure Richardson ISD Student Data.

ARTICLE VI: MISCELLANEOUS

1. Termination. Either Party may terminate this DPA with thirty (30) days’ written notice so long as the Service Agreement has lapsed or has been terminated. Either party may terminate this DPA and any service agreement or contract if the other party breaches any terms of this DPA.

2. Effect of Termination Survival. If the Service Agreement is terminated, the Provider shall destroy all of Richardson ISD’s Student Data pursuant to Article IV, section 6.

3. Priority of Agreements. This DPA shall govern the treatment of Richardson ISD Student Data in order to comply with the privacy protections, including those found in FERPA and all applicable privacy statutes identified in this DPA. In the event there is conflict between the terms of the DPA and the Service Agreement, Terms of Service, Privacy Policies, or with any other bid/RFP, license agreement, or writing, the terms of this DPA shall apply and take precedence. In the event of a conflict between Exhibit H, the SDPC Standard Clauses, and/or the Supplemental State Terms, Exhibit H will control, followed by the Supplemental State Terms. Except as described in this paragraph herein, all other provisions of the Service Agreement shall remain in effect.

4. Entire Agreement. This DPA constitute the entire agreement of the Parties relating to the subject matter hereof and supersedes all prior communications, representations, or agreements, oral or written, by the Parties relating thereto. This DPA may be amended and the observance of any provision of this DPA may be waived (either generally or in any particular instance and either retroactively or prospectively) only with the signed written consent of both Parties. Neither failure nor delay on the part of any Party in exercising any right, power, or privilege hereunder shall operate as a waiver of such right, nor shall any single or partial exercise of any such right, power, or privilege preclude any further exercise thereof or the exercise of any other right, power, or privilege.

5. Severability. Any provision of this DPA that is prohibited or unenforceable in any jurisdiction shall, as to such jurisdiction, be ineffective to the extent of such prohibition or unenforceability without invalidating the remaining provisions of this DPA, and any such prohibition or unenforceability in any jurisdiction shall not invalidate or render unenforceable such provision in any other jurisdiction.

Notwithstanding the foregoing, if such provision could be more narrowly drawn so as not to be prohibited or unenforceable in such jurisdiction while, at the same time, maintaining the intent of the Parties, it shall, as to such jurisdiction, be so narrowly drawn without invalidating the remaining provisions of this DPA or affecting the validity or enforceability of such provision in any other jurisdiction.

6. Governing Law; Venue and Jurisdiction. THIS DPA WILL BE GOVERNED BY AND

CONSTRUED IN ACCORDANCE WITH THE LAWS OF THE STATE OF TEXAS, WITHOUT

REGARD TO CONFLICTS OF LAW PRINCIPLES. EACH PARTY CONSENTS AND SUBMITS TO

THE SOLE AND EXCLUSIVE JURISDICTION TO THE STATE AND FEDERAL COURTS FOR

THE COUNTY OF THE LEA FOR ANY DISPUTE ARISING OUT OF OR RELATING TO THIS DPA

OR THE TRANSACTIONS CONTEMPLATED HEREBY.

7. Successors Bound: This DPA is and shall be binding upon the respective successors in interest to Provider in the event of a merger, acquisition, consolidation or other business reorganization or sale of all or substantially all of the assets of such business. In the event that the Provider sells, merges, or otherwise disposes of its business to a successor during the term of this DPA, the Provider shall provide written notice to Richardson ISD no later than sixty (60) days after the closing date of sale, merger, or disposal. Such notice shall include a written, signed assurance that the successor will assume the obligations of the DPA and any obligations with respect to Richardson ISD Student Data within the Service Agreement. The Richardson ISD has the authority to terminate the DPA if it disapproves of the successor to whom the Provider is selling, merging, or otherwise disposing of its business.

8. Authority. Each party represents that it is authorized to bind to the terms of this DPA, including confidentiality and destruction of Richardson ISD Student Data and any portion thereof contained therein, all related or associated institutions, individuals, employees or contractors who may have access to the Richardson ISD Student Data and/or any portion thereof.

9. Waiver. No delay or omission by either party to exercise any right hereunder shall be construed as a waiver of any such right and both parties reserve the right to exercise any such right from time to time, as often as may be deemed expedient.

10. Reimbursement of Expenses Associated with Security Breach. In the event of a Security Breach that is attributable to the Provider, the Provider shall reimburse and indemnify Richardson ISD for any and all costs and expenses that Richardson ISD incurs in investigating and remediating the Security Breach, including but not limited to costs and expenses associated with:

a. Providing notification to Richardson ISD employees or parents of students whose data was compromised and regulatory agencies or other entities as required by law or contract;

b. Providing credit monitoring to Richardson ISD employees or students whose data was exposed in a manner during the Security Breach that a reasonable person would believe may impact the employee’s or student’s credit or financial security;

c. Legal fees, audit costs, fines, and any other fees or damages imposed against Richardson ISD as a result of the security breach; and

d. Providing any other notifications or fulfilling any other requirements adopted by the Texas State Board of Education, Texas Education Agency, or under other State or federal laws.

[REMAINDER OF PAGE INTENTIONALLY LEFT BLANK. SIGNATURE PAGE FOLLOWS.]

By signing, I certify that I have read and agree with the terms of the Data Privacy Agreement an I am authorized to sign and execute on behalf of my institution.

IN WITNESS WHEREOF, Richardson ISD and Provider execute this DPA as of the Effective Date.

Richardson ISD: Provider:

Signature Signature

Printed Name Printed Name

Title Title

Date Date

The following is for internal purposes only.

Technology Department Approved: Technology Department Reviewed:

Henry Hall Robin Gunter Assistant Superintendent of Technology Executive Director Instructional Technology

Date Date

EXHIBIT A

DESCRIPTION OF CONTRACTED SERVICES

See underlying Service Agreement between Richardson ISD and Provider.

EXHIBIT B

SCHEDULE OF DATA

Category of Data Elements Data to be

Shared

Application Technology Meta Data

IP Addresses of users, Use of cookies, etc.

Other application technology meta data-Please specify:

Application Use Statistics Meta data on user interaction with application

Assessment Standardized test scores

Observation data

Other assessment data-Please specify:

Attendance Student school (daily) attendance data

Student class attendance data

Communications Online communications captured (emails, blog entries)

Conduct Conduct or behavioral data

Demographics Date of Birth

Place of Birth

Gender

Ethnicity or race

Language information (native, or primary language spoken by student)

Category of Data

Elements

Data to be Shared

Other demographic information-Please specify:

Enrollment Student school enrollment

Student grade level

Homeroom

Guidance counselor

Specific curriculum programs

Year of graduation

Other enrollment information-Please specify:

Parent/Guardian Contact Information

Address

Email

Phone

Parent/Guardian ID Parent ID number (created to link parents to students)

Parent/Guardian Name First and/or Last

Schedule Student scheduled courses

Teacher names

Special Indicator English language learner information

Low income status

Medical alerts/ health data

Category of Data Elements Data to be

Shared

Student disability information

Specialized education services (IEP or 504)

Living situations (homeless/foster care)

Other indicator information-Please specify:

Student Contact Information

Address

Email

Phone

Student Identifiers Local (School district) ID number

State ID number

Provider/App assigned student ID number

Student app username

Student app passwords

Student Name First and/or Last

Student In App Performance

Program/application performance (typing program-student types 60 wpm, reading program-student reads below grade level)

Student Program Membership

Academic or extracurricular activities a student may belong to or participate in

Student Survey Responses Student responses to surveys or questionnaires

Student work Student generated content; writing, pictures, etc.

Category of Data Elements Data to be

Shared

Other student work data -Please specify:

Transcript Student course grades

Student course data

Student course grades/ performance scores

Other transcript data - Please specify:

Transportation Student bus assignment

Student pick up and/or drop off location

Student bus card ID number

Other transportation data – Please specify:

Other Please list each additional data element used, stored, or collected by your application:

None No Richardson ISD Student Data collected at this time.

Provider will immediately notify Richardson ISD if this designation is no longer applicable.

EXHIBIT C

DEFINITIONS

De-Identified Data and De-Identification: Records and information are considered to be De-Identified when all personally identifiable information has been removed or obscured, such that the remaining information does not reasonably identify a specific individual, including, but not limited to, any information that, alone or in combination is linkable to a specific student and provided that the educational agency, or other party, has made a reasonable determination that a student’s identity is not personally identifiable, taking into account reasonable available information.

Educational Records: Educational Records are records, files, documents, and other materials directly related to a student and maintained by the school or local education agency, or by a person acting for such school or local education agency, including but not limited to, records encompassing all the material kept in the student’s cumulative folder, such as general identifying data, records of attendance and of academic work completed, records of achievement, and results of evaluative tests, health data, disciplinary status, test protocols and individualized education programs.

Metadata: means information that provides meaning and context to other data being collected; including, but not limited to: date and time records and purpose of creation Metadata that have been stripped of all direct and indirect identifiers are not considered Personally Identifiable Information.

Operator: means the operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used for K–12 school purposes.

Any entity that operates an internet website, online service, online application, or mobile application that has entered into a signed, written agreement with Richardson ISD to provide a service to the district shall be considered an “operator” for the purposes of this section.

Provider: For purposes of the DPA, the term “Provider” means provider of digital educational software or services, including cloud-based services, for the digital storage, management, and retrieval of Richardson ISD Student Data. Within the DPA the term “Provider” includes the term “Third Party” and the term “Operator” as used in applicable state statutes.

Student Generated Content: The term “Student-Generated Content” means materials or content created by a student in the services including, but not limited to, essays, research reports, portfolios, creative writing, music or other audio files, photographs, videos, and account information that enables ongoing ownership of student content.

School Official: For the purposes of this DPA and pursuant to 34 CFR § 99.31(b), a School Official is a contractor that: (1) Performs an institutional service or function for which the agency or institution would otherwise use employees; (2) Is under the direct control of the agency or institution with respect to the use and maintenance of Richardson ISD Student Data including Education Records; and (3) Is subject to 34 CFR § 99.33(a) governing the use and re-disclosure of Personally Identifiable Information from Education Records.

Service Agreement: Refers to the Contract, Purchase Order or Terms of Service or Terms of Use.

Richardson ISD Student Data: Richardson ISD Student Data includes any data, whether gathered by Provider or provided by Richardson ISD or its users, students, or students’ parents/guardians, that is descriptive of the student including, but not limited to, information in the student’s educational record or email, first and last name, birthdate, home or other physical address, telephone number, email address, or other information allowing physical or online contact, discipline records, videos, test results, special education data, juvenile dependency records, grades, evaluations, criminal records, medical records, health records, social security numbers, biometric information, disabilities, socioeconomic information, individual purchasing behavior or preferences, food purchases, political affiliations, religious information, text messages, documents, student identifiers, search activity, photos, voice recordings, geolocation information, parents’ names, or any other information or identification number that would provide information about a specific student. Richardson ISD Student Data includes Meta Data.

Richardson ISD Student Data further includes “Personally Identifiable Information (PII),” as defined in 34 C.F.R. § 99.3 and as defined under any applicable state law. Richardson ISD Student Data shall constitute Education Records for the purposes of this DPA, and for the purposes of federal, state, and local laws and regulations. Richardson ISD Student Data as specified in Exhibit B is confirmed to be collected or processed by the Provider pursuant to the Services. Richardson ISD Student Data shall not constitute that information that has been anonymized or De-Identified, or anonymous usage data regarding a student’s use of Provider’s services.

Subprocessor: For the purposes of this DPA, the term “Subprocessor” (sometimes referred to as the “Subcontractor”) means a party other than Richardson ISD or Provider, who Provider uses for data collection, analytics, storage, or other service to operate and/or improve its service, and who has access to Richardson ISD Student Data.

Targeted Advertising: means presenting an advertisement to a student where the selection of the advertisement is based on Richardson ISD Student Data or inferred over time from the usage of the operator's Internet web site, online service or mobile application by such student or the retention of such student's online activities or requests over time for the purpose of targeting subsequent advertisements.

"Targeted Advertising" does not include any advertising to a student on an Internet web site based on the content of the web page or in response to a student's response or request for information or feedback.

Third Party: The term “Third Party” means a provider of digital educational software or services, including cloud-based services, for the digital storage, management, and retrieval of Education Records and/or Richardson ISD Student Data, as that term is used in some state statutes. However, for the purpose of this DPA, the term “Third Party” when used to indicate the provider of digital educational software or services is replaced by the term “Provider.”

EXHIBIT D

DIRECTIVE FOR DISPOSITION OF DATA

Provider to dispose of data obtained by Provider pursuant to the terms of the Service Agreement between Richardson ISD and Provider. The terms of the Disposition are set forth below:

1. Extent of Disposition

Disposition is partial. The categories of data to be disposed of are set forth below or are found in an attachment to this Directive:

Disposition is complete. Disposition extends to all categories of data.

2. Nature of Disposition

Disposition shall be by destruction or deletion of data.

Disposition shall be by a transfer of data. The data shall be transferred to the following site as follows:

3. Schedule of Disposition

Data shall be disposed of by the following date:

As soon as commercially practicable.

By ___________________________________

4. Signature

Authorized Representative of Richardson ISD Date

5. Verification of Disposition of Data

Authorized Representative of Provider Date

EXHIBIT E

DATA SECURITY REQUIREMENTS

Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider .

Cybersecurity Frameworks

MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S)

National Institute of Standards and Technology (NIST)

NIST Cybersecurity Framework Version 1.1

National Institute of Standards and Technology (NIST)

NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-

International Standards Organization

(ISO)

Information technology — Security techniques — Information security management systems (ISO 27000 series)

Secure Controls Framework Council, LLC Security Controls Framework

(SCF)

Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20)

Office of the Under Secretary of Defense for Acquisition and Sustainment

(OUSD(A&S))

Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR)

Please visit http://www.edspex.org for further details about the noted frameworks.

*Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here.

http://www.edspex.org/