13-Amendment 1 Data Sharing Amendment.docx

AMENDMENT 1

Awarded Supplier’s name will go here, Data Sharing Agreement RFP 27009BDC

This Amendment is entered into between XXX(herein referred to as Supplier), having an office at XX and the Clark County School District (herein referred to as “District”), a political subdivision of the State of Nevada, as a licensee and/or provider of educational software and/or educational services as specified within the Family engagement, student progress and school-to-home communication application, RFP 27009BDC executed on TBD. This Amendment augments, modifies, supplements, and/or supersedes those Terms set forth in the identified Agreement for the explicit purpose of addressing contractual requirements relative to the District’s Personally Identifiable Student Information, Student Data and/or other confidential data, herein referred to as Data. To the extent any such changes results in any conflict or inconsistency between the Agreement and this Amendment, this Amendment shall govern and the conflicting Terms of the Agreement shall be of no further force or effect.

This Amendment shall become effective upon execution by both parties and its requirements shall run concurrently with the term of the existing Agreement and remain in effect for up to ninety additional calendar days to support the destruction/removal/return of the District’s Data as required herein.

As used herein, “Agreement” refers to the existing Agreement identified herein.

Attachment A, Schedule of Data, indicates the only Data that the Supplier may use in the performance of this Agreement.

Attachment B, Certificate of Data Destruction/Return, certifies the disposition of the District’s data at the conclusion of this Agreement.

For good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the District and the Supplier agree to the following:

I. DATA BREACH INDEMNIFICATION AND INSURANCE

A. Supplier’s Obligations:

1. Indemnification: Supplier agrees to protect, defend, indemnify and hold harmless the District, and its Trustees officers, employees, agents, and volunteers from and against any and all liability, claims, demands, and expenses, data security related costs, including court costs and attorney fees, which arise out of third party actions, or are attributable to the negligence or willful misconduct of Supplier in storing, using and protecting the District’s Data. Supplier also agrees to work in a professional and collaborative manner with District officials and/or its agents, contractors, etc., with respect to investigating any alleged breach of District data.

2. Supplier shall use best industry practices to protect the District’s personal data and its records in the performance of the Agreement.

3. For the purpose of this Agreement the term Data Security Related Costs means costs incurred as a direct result of a data breach incident which may include, but not be limited to: governmental fines, penalties, hiring of third party forensic/data breach expert(s)/consultant(s), cost of legally required notifications to third parties, costs related to providing credit monitoring to impacted individuals for no less than 12 months, cost of call center support for impacted individuals, and costs of any other measure required under applicable laws.

4. For damages resulting from any act and/or omission by Supplier, and/or that of its subcontractors, agents, partners, affiliates, or other parties providing services under the Agreement that results in the misappropriation or unauthorized disclosure or access by a third party of the District’s Data, Supplier’s limitation of liability will not exceed $1,000,000.00 on a per occurrence basis.

B. District Obligations: Refer to RFP provision 8.15.

C. Mutual Obligation

1. In connection with any claim whereby a party ("Indemnitor") is required to indemnify the other ("Indemnitee") under this section, the Indemnitee will (i) notify the Indemnitor promptly of any claim, (ii) give the Indemnitor the sole control of the defense of the claim and any settlement negotiations (provided such settlement does not impose any liability, obligation, or cost, onto the Indemnitee), and (iii) reasonably cooperate with the Indemnitee in defense of any such claim.

2. In no event will either Party be liable for any indirect, incidental, special, punitive or exemplary damages or any loss of revenue, profits, sales data use, anticipated savings, goodwill or reputation.

D. Supplier Insurance Requirements:

1. Insurance documents shall verify the coverages in RFP provision 7.4.

2. Requirements:

i. The insurance required herein may be provided under primary policies or by a combination of primary and excess policies.

ii. Policy effective dates shall be on or before the effective date of the Agreement or the commencement of services, whichever occurs first.

iii. Insurance shall be continuously maintained throughout the duration of this Agreement.

iv. All insurance coverages shall name the Clark County School District as an additional insured.

v. Failure to deliver the required insurance document(s), or the District’s failure to request the document(s), is not a waiver of the Supplier’s obligation to provide the specified insurance coverages.

3. Claims Made Policy Requirements – If any policies provide coverage on a claims-made basis:

i. The Retroactive Date shall be shown and must precede the effective date of the Agreement or the commencement of services, whichever occurs first.

ii. Insurance must be continuously maintained, and evidence of coverages must be provided for at least three (3) years after termination of this Agreement.

iii. If coverage is canceled or non-renewed, and not replaced with another claims-made policy form with a Retroactive Date prior to the Agreement effective date, or the commencement of services, the Supplier shall purchase and provide “extended reporting” coverage for a minimum of three (3) years after completion of service.

4. Reference Insurance documents to the Clark County School District, Attention: Purchasing Department, 4212 Eucalyptus Avenue, Bldg. #7, Las Vegas, NV 89121, and indicate the Agreement name and number.

II. PRIVACY AND PROTECTION OF STUDENT INFORMATION

A. Privacy of Protection of Pupil Rights Amendment

In the event that the District requires students to submit to a survey, analysis, or evaluation with the Supplier, Supplier shall protect student information under the Protection of Pupil Rights Amendment (“PPRA”) 20 U.S.C. §1232h; 34 C.F.R. Part 98; NRS 392.029; NRS 388.272.

1. PPRA applies to certain surveys, analysis, or evaluations that ask students to respond in any manner that reveals information concerning: (1) political affiliations or beliefs of the student or the student’s family; (2) mental or psychological problems of the student or the student’s family; (3) sex behavior or attitudes; (4) illegal, anti-social, self-incriminating, or demeaning behavior; (5) critical appraisals of other individuals with whom respondents have close family relationships; (6) legally recognized privileged or analogous relationships, such as those of lawyers, physicians, or ministers; (7) religious practices, affiliations, or beliefs of the student or student’s parent; or (8) income. 20 U.S.C. §1232h.

2. PPRA requires parent consent before students are required to submit to a survey, analysis, or evaluation that concerns one of eight (8) protected areas if it is funded in whole or in part by a program of the U.S. Department of Education. If not funded by the U.S. Department of Education, PPRA allows for student participation in certain surveys, analysis, or evaluations that concern one of eight (8) protected areas if parents are provided notice of the survey and are given an opportunity to opt the student out of participation in the survey. 20 U.S.C. §1232h(c)(2); 34 C.F.R. Part 98. The District and Supplier agree to comply with the provisions of the PPRA. Supplier agrees to provide notice if PPRA related student surveys, analysis, or evaluations will be conducted. Under this Agreement, if required in order to comply with the PPRA, the District will either obtain parent consent or provide parents with notice and an opportunity to opt out of the Supplier’s platform.

B. Family Education Rights and Privacy Act

To obtain access to the Data as identified on Attachment A, Schedule of Data, the following terms must be followed.

1. Supplier agrees to protect student education records and other personally identifiable and/or confidential information in accordance with the Family Education Rights and Privacy Act (“FERPA”), 20 U.S.C. §1232g; 34 C.F.R. Part 99; NRS 392.029; NRS 388.272.

i. Personally identifiable information has the same meaning as defined under FERPA at 34 C.F.R. § 99.3.

ii. Education record has the same meaning as defined under FERPA at 34 C.F.R. § 99.3.

iii. School official has the same meaning as defined under FERPA at 34 C.F.R. § 99.31(a) (1), and includes contractors, consultants, volunteers, or other parties to which an educational institution has outsourced institutional services or functions.

iv. De-identified Data, as used in this Agreement, means Data from which all personally identifiable information has been removed or obscured so that a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, would not be able to identify any individual student or parent with reasonable certainty. 34 C.F.R. § 99.31(b)(1); 34 C.F.R. § 99.3.

2. Supplier is a contractor or outside service provider with whom the District has outsourced institutional services or functions that it would otherwise use employees to perform, including, but not limited to: Online English language learning, 20 U.S.C. § 1232g(b)(1); 34 C.F.R. § 99.31(a)(1). For purposes of FERPA, Supplier constitutes a school official with a legitimate educational interest in obtaining access to education records, and will only have access to those particular education records in which they have a legitimate educational interest. 20 U.S.C. §1232g(b)(1); 34 C.F.R. § 99.31(a)(1).

3. Supplier will be under the direct control of the District with respect to the maintenance and use of personally identifiable information from education records provided under this Agreement. 34 C.F.R. § 99.31(a)(1).

4. As a condition precedent to receiving personally identifiable information from education records of students, Supplier warrants and agrees that Supplier will limit the use of, or access to, personally identifiable information from education records of students to the limited scope of information actually needed to complete Supplier’s duties and/or services under the existing Agreement. The District has determined that the Supplier has a legitimate educational interest in receiving only the Data specifically marked and identified in the Schedule of Data included as Attachment A.

5. Supplier will not collect, use, or disclose student personally identifiable information provided under this Agreement except as permitted by this Agreement or as required by law without approval of the District.

6. Supplier shall not use any of the personally identifiable information from education records of students that is provided under this Agreement in violation of any applicable federal or state law, rule, regulation, or District School Board policy.

7. Supplier is subject to the same conditions on the use and redisclosure of personally identifiable information from education records that govern other school officials, including, without limitation, 20 U.S.C. § 1232g; 34 C.F.R. § 99.31(a)(1); 34 C.F.R. § 99.33(a) and (b); NRS 388.272; CCSD Regulation 5125.1 (http://District.net/district/policies-regulations/pdf/5125.1_R.pdf).

8. Supplier will not (i) use student personally identifiable information for advertising purposes; (ii) use student personally identifiable information to amass a profile about a student except in furtherance of the services provided under this Agreement; or (iii) sell student personally identifiable information.

9. Any education records, Data, or content held by the Supplier will be made available to the District upon request by the District.

10. Supplier agrees to perform the following Data Destruction and Return requirements upon the Agreement’s termination/expiration:

Destruction of Data Defined. For the purpose of this Agreement “Destroy" means to remove District Data from the Supplier's systems, paper files, records, databases, and any other media regardless of format, in accordance with the National Institute of Standards and Technology ("NIST") SP 800-88, Revision 1, Guidelines for Media Sanitization to ensure the District’s Data is rendered permanently irretrievable.

Destruction or Return of District Data. With the exception of aggregate and de-identified Data, Supplier shall ensure that all District Data, PII and Agreement Data that was collected, within its control generated, or inferred pursuant to this Agreement, is returned or Destroyed, as directed by the District.

i. If the District requests destruction of the Data, the Supplier shall Destroy all District Data that is in its possession and cause its Subcontractors to Destroy all District Data in their possession.

ii. Requests for Destruction will be completed within fourteen (14) calendar days of the request by an authorized District representative. Thereafter, within seven (7) calendar days the Supplier shall certify that the District’s Data has been destroyed by submitting Attachment B, Certificate of Data Destruction attached hereto to the District Representative (s) named therein.

iii. If the District requests return of the Data, the Supplier shall return all District Data to the specified District Representative, using the means, methods, and format specified by the District, within fourteen (14) calendar days.

iv. Upon successful transfer and receipt of District Data, as confirmed in writing by the District's Designated Representative, Supplier shall Destroy all District Data within fourteen (14) calendar days.

v. Thereafter, within seven (7) calendar days, the Supplier shall certify in writing to District that such District Data has been destroyed by submitting Attachment B, Certificate of Data Destruction attached hereto.

vi. If District fails to provide notice of Data Destruction or Return. If the District fails to provide written direction regarding Data Destruction or Return within sixty (60) calendar days after the Agreement end date (regardless of cause), the Supplier shall Destroy the District’s Data and submit Attachment B, Certificate of Data Destruction, attached hereto, within seven (7) calendar days.

vii. The Data Destruction and Return requirements specified herein shall be performed at no additional cost to the District.

11. Notwithstanding the foregoing, and consistent with FERPA, Supplier may use and disclose both aggregate and de-identified Data; provided, however, that Supplier agrees not to attempt to re-identify the Data and not to disclose such Data to any third party unless that third party agrees not to attempt to re-identify the Data. 34 C.F.R. § 99.3; and 34 C.F.R. § 99.31(b)(1).

12. The District has the right to conduct audits or other monitoring activities of Supplier’s procedures and systems, subject to Supplier’s agreement for frequency and schedule, not to be unreasonably withheld 34 C.F.R. § 99.31(a)(1).

13. Supplier acknowledges that it provides training for its employees about FERPA and how to protect education records, and shall instruct applicable employees/agents to avoid accessing personally identifiable information from education records of students, except for the legitimate purposes recognized under this Agreement. Supplier shall require that all employees/agents accessing the Data must be trained in, and sign an acknowledgement or confidentiality agreement regarding, the confidentiality requirements of FERPA. Supplier also acknowledges that it has appropriate disciplinary policies for employees that violate FERPA.

14. Supplier will only share the information obtained pursuant to this Agreement with the individuals affiliated with the Supplier as officers, directors, employees, subcontractors, and agents under the direct control of the Supplier who actually have a legitimate educational interest in the information (i.e. who are assisting the Supplier in connection with this Agreement). If the Supplier will rely on subcontractors to perform services under this Agreement, the Supplier agrees to share the names of these subcontractors with the District upon request. All subcontractors and successor entities of Supplier will be subject to the terms of this Agreement.

15. Each party is independently required to comply with the requirements of FERPA. Each party agrees that it shall not be liable for any violation of any provision of FERPA directly or indirectly relating to, arising out of, or resulting from, or in any manner attributable to, the actions of the other party.

16. Supplier agrees that all copies of Data of any type, including any modifications or additions, are subject to the provisions of the Agreement in the same manner as the original information.

17. Supplier shall respond in a reasonably timely manner to the District’s request for student data in a student’s records held by the Supplier to view or correct as necessary under FERPA. In the event that a parent of a student or other individual contacts the Supplier to review any of the student data accessed pursuant to the services provided by the Supplier, the Supplier shall refer the parent or individual to the District, who will follow their procedures regarding the requested information.

18. Data Security. Supplier represents and warrants it has a sound data security plan and data stewardship program. Specifically, Supplier will implement and maintain reasonable administrative, physical and technical safeguards for the purpose of preventing any collection, use or disclosure of, or access to the Data shared under this Agreement, except as may be specifically authorized by the District herein, including, without limitation, an information security program that meets commercially reasonable industry practice to safeguard the student data. Such information security program includes: (a) physical security of all premises in which the Data will be processed and/or stored; and (b) reasonable precautions taken with respect to the employment of, access given to, and education and training of any and all personnel furnished or engaged by Supplier to perform any part of the services hereunder.

19. Notices:

A. Breach: Upon the discovery by the Supplier of a breach of security, defined as unauthorized access, that results in the unauthorized release, disclosure, or acquisition of student Data, or the suspicion that such a breach may have occurred, the Supplier shall provide Notice to the District as soon as possible, but not more than seventy two (72) hours after such discovery. The Notice shall be delivered to the District by electronic mail to its Director of Purchasing and Warehousing at PurchasingDirector@nv.ccsd.net and its Chief Technology Officer at ChiefTechnologyOfficer@nv.ccsd.net and shall include the following information, to the extent known at the time of notification:

i. Date and time of the breach;

ii. Names of student(s) whose student data was released, disclosed or acquired;

iii. The nature and extent of the breach;

iv. The Supplier's proposed plan to investigate and remediate the breach.

B. Standard Notices: All non-breach notices shall be delivered to the District by electronic mail to its Director of Purchasing and Warehousing at PurchasingDirector@nv.ccsd.net.

C. Acknowledgement: The Supplier shall request and continue the notification process until it receives acknowledgment of receipt of the Notice from one of the named parties, or one of their successors.

20. Upon discovery by the Supplier of a breach, the Supplier shall conduct an investigation and restore the integrity of its data systems and, without unreasonable delay, but not later than thirty (30) days after discovery of the breach, shall provide the District with a more detailed notice of the breach, including but not limited to the date and time of the breach; name(s) of the student(s) whose student data was released, disclosed or acquired; nature and extent of the breach; and measures taken to ensure that such a breach does not occur in the future.

21. The Parties agree that all rights, including all intellectual property rights, shall remain the exclusive property of the District, and Supplier only has a limited, nonexclusive license solely for the purpose of performing its obligations as outlined in this Agreement. This Agreement does not give Supplier any rights, implied or otherwise, to education records, Data, content, or intellectual property, except as expressly stated in this Agreement. This includes a prohibition on the right of Supplier to sell or trade the education records, data, content, or intellectual property.

22. If the Supplier is required by subpoena or other court order to disclose any Data, Supplier will provide immediate notice of the request to the District and will use reasonable efforts to resist disclosure until an appropriate protective order can be sought or a waiver of compliance with the relevant provisions of the Agreement granted.

23. Pursuant to Nevada Revised Statutes (NRS) 388.272 and its own business practices, the District may terminate this Agreement and seek payment of monetary damages for any intentional or negligent actions leading to noncompliance with the terms of this Agreement related to the privacy and protection of Data.

24. In the event technology services (e.g., student/staff rostering, user provisioning, network service) are required, the Supplier shall use District-approved providers unless otherwise specified in writing by both parties.

25. The Supplier’s obligations under the provisions in support of Data Breach Indemnification and Insurance, applicable PPRA and FERPA requirements, and Data Security shall survive six (6) years after termination.

C. Artificial Intelligence (AI):

1. Use Restrictions: Supplier shall not use, access, disclose, or otherwise process any data provided by or on behalf of the District (“District Data”), including any derivative data, for the purpose of training, fine-tuning, or otherwise improving any artificial intelligence (AI), machine learning (ML), or large language models (LLMs), including generative AI models, whether proprietary or made available to third parties, without the District’s prior written consent.

2. Third-Party Model Training: Supplier expressly agrees that District Data shall not be used—directly or indirectly—to train, test, or enhance any LLMs or AI models that are accessible to parties outside of the District, whether made available commercially, publicly, or through open-source mechanisms.

3. Data Segregation and Protection: Supplier must implement appropriate technical and organizational measures to ensure that District Data remains segregated from any data sets used for AI/ML model training or development not explicitly authorized by the District.

4. Compliance and Audit Rights: Upon reasonable request, Supplier shall provide documentation or attestations verifying compliance with this provision. The District reserves the right to audit the Vendor’s practices related to data handling and model training.

5. Survival: The AI provisions shall survive the termination or expiration of this Agreement.

6. AI Usage Fees: Supplier shall not charge the District for any artificial intelligence related usage based fees, including tokens, prompts, outputs, credits, model calls, or similar usage measurements, unless such fees are expressly stated in a purchase order issued by the District, including any quote referenced in and made part of the purchase order, or in a written amendment to this Agreement. Any artificial intelligence related usage above the amount approved by the District, including any overage, third party artificial intelligence provider cost increase, or change in pricing method, shall be blocked, suspended, or absorbed by Supplier at no additional cost to the District, unless the District provides prior written approval through a purchase order issued by the District or a written amendment to this Agreement. Exhaustion of any artificial intelligence usage allowance shall not result in additional charges, automatic overages, or loss of access to the non artificial intelligence core functionality of the services.

IN WITNESS WHEREOF, the parties have executed this Amendment as of the last day noted below.

Clark County School District

Supplier:

By:

By:

Director of Purchasing

Printed Name & Title:

Phone Number

Phone Number

Date: Date:

Page 10 of 10 DSA Amendment 1 RFP 27009BDC Purchasing Updated 7-17-2025