14-AISDP 0012 - Data Protection Addendum.pdf

Index No. AISDP-0012 Page No. 1 of 4 Issue No. 001

Data Protection Addendum

Amarillo Independent School District (the “District”) and Vendor (as listed on page 4 of this addendum) have entered into an agreement (the “Agreement”). This Data Protection Addendum (“Addendum”) is incorporated into the Agreement by reference.

1. Definitions.

a. “Brand Features” means the trade names, trademarks, service marks, logos, domain names, and other distinctive brand features of each Party, respectively, as secured by such Party from time to time.

b. “District Data” includes all Personally Identifiable Information and other information that is not intentionally made generally available by the District on public websites or publications, including but not limited to business, administrative and financial data, intellectual property, and student and personnel data and metadata, as well as any de-identified, aggregated, or otherwise anonymized data derived from such data.

c. “End User” means the individuals authorized by the District to access and use the Vendor’s services provided by Vendor under the Agreement.

d. “Personally Identifiable Information” (or PII) includes but is not limited to: personal identifiers such as name, address, phone number, date of birth, Social Security number, and student or personnel identification number;

personally identifiable information contained in student education records as that term is defined in the Family Educational Rights and Privacy Act, 20 USC 1232g, as amended (“FERPA”); “personal information” as that term is defined in the Children’s Online Privacy Protection Act of 1998 (“COPPA”); “personal information” as that term is defined in the Protection of Pupil Rights Amendment (“PPRA”); “personally identifiable information” as that term is defined in the Individuals with Disabilities Education Act, as amended (“IDEA”);

“protected health information” as that term is defined in the Health Insurance Portability and Accountability Act, 45 CFR Part 160.103 (“HIPAA”); nonpublic personal information as that term is defined in the Gramm- Leach-Bliley Financial Modernization Act of 1999, 15 USC 6809 (“GLB”); credit and debit card numbers and/or access codes and other cardholder data and sensitive authentication data as those terms are defined in the Payment Card Industry Data Security Standards (“PCI-DSS”); other financial account numbers, access codes, driver’s license numbers; and state- or federal-identification numbers such as passport, visa or state identity card numbers.

e. “Securely Destroy” means taking actions that render data written on physical (e.g., hardcopy, microfiche, etc.)

or electronic media unrecoverable by both ordinary and extraordinary means. These actions must meet or exceed those sections of the National Institute of Standards and Technology (NIST) SP 800-88r1 guidelines relevant to data categorized as high security.

f. “Security Breach” means an event in which District Data is exposed to unauthorized disclosure, access, alteration, or use.

g. “Mining District Data” means to search through, access, or extract District Data, metadata, or information which is not necessary to accomplish the purpose(s) of the Agreement.

2. Rights and License in and to District Data. The Parties agree that as between them, all rights including all intellectual property rights in and to District Data shall remain the sole and exclusive property of the District, and Contractor has a limited, nontransferable, fully-paid, royalty-free, non-sublicenseable, nonexclusive license as provided in the Agreement solely for the purpose of performing its obligations hereunder. This Addendum does not give Vendor or any third party any rights, implied or otherwise, to District Data, content, or intellectual property, except as expressly stated in the Agreement and this Addendum.

3. Data Privacy.

a. Vendor will use District Data only for the purpose of fulfilling its duties under the License Agreement and will not share District Data with or disclose it to any third party without the prior written consent of the District, except as required by law. Any third party will also be subject to the same terms and conditions as in this Addendum.

b. District Data will not be stored outside the United States without prior written consent from the District.

c. Vendor will provide access to District Data only to its employees and subcontractors who need to access the data to fulfill Vendor’s obligations under the Agreement. Vendor will ensure that employees and subcontractors who perform work under the Agreement have received appropriate instruction as to how to comply with the data protection provisions of this Addendum. If Vendor will have access to “education

Page No. 2 of 4 records” for the District’s students as defined under FERPA, the Contractor acknowledges that for the purposes of this Addendum it will be designated as a “school official” with “legitimate educational interests” in the District Education records, as those terms have been defined under FERPA and its implementing regulations, and the Contractor agrees to abide by the FERPA limitations and requirements imposed on school officials.

The Parties agree that: (1) the services/functions to be provided by Vendor are services/functions for which the District would otherwise use its own employees; (2) Vendor is under the District’s direct control with respect to Vendor’s access to and use of the education records; and (3) Vendor is subject to the requirements of 34 C.F.R. 99.33(a) with respect to Vendor’s access to and use of the education records. Vendor will use the education records only for the purpose of fulfilling its duties under the Agreement for District’s and its End User’s benefit, and will not share such data with or disclose it to any third party except as provided for in the Agreement, required by law, or authorized in writing by the District.

d. Vendor will not use District Data (including metadata) for advertising or marketing purposes. Vendor expressly acknowledges Texas Education Code 32.151-32.157 relating to the restriction of the use of covered information, including student personally identifiable information, by an operator of a website, online service, online application or mobile application for a school purpose. Vendor agrees to comply with such restrictions and requirements, to the extent applicable.

e. Vendor agrees to assist District in maintaining the privacy of District Data as may be required by State and Federal law, including but not limited to FERPA, PRRA, IDEA, and COPPA. Vendor shall, upon reasonable request, provide the District with a written summary of the procedures Vendor uses to maintain the privacy of District Data.

f. Vendor is prohibited from Mining District Data for any purposes other than those agreed to by the Parties.

4. Data Security. Vendor will store and process District Data in accordance with commercial best practices, including appropriate administrative, physical, and technical safeguards, to secure such data from unauthorized access, disclosure, alteration, and use. Such measures will be no less protective than those used to secure Contractor’s own data of a similar type, and in no event less than reasonable in view of the type and nature of the data involved. Without limiting the foregoing, Contractor warrants that all electronic District Data will be encrypted in transmission using Transport Layer Security (TLS) for all interfaces transmitting or receiving District data (including all back-end communications and all web interfaces) and stored at no less than 128-bit level encryption. Note: The minimum of TLS 1.1 is required (1.2 is preferred), SSL is no longer sufficient for adequate transmission security. Vendor will use industry-standard and up-to-date security tools and technologies such as anti-virus protections and intrusion detection methods in providing services under the Agreement.

5. Employee and Subcontractor Qualifications. Vendor shall ensure that its employees and subcontractors who have potential access to District Data have undergone appropriate background screening and possess all needed qualifications to comply with the terms of the Agreement including but not limited to all terms relating to data and intellectual property protection. Vendor shall employ only orderly and competent workers, skilled in the performance of the Services performed under this Agreement. Vendor, its employees, subcontractors, and subcontractor’s employees may not use or possess any weapons, alcoholic or other intoxicating beverages, illegal drugs or controlled substances wile on the job or on Customer’s property.

6. Data Authenticity and Integrity. Vendor will take reasonable measures, including audit trails, to protect District Data against deterioration or degradation of data quality and authenticity.

7. Security Breach.

a. Response. As soon as practicable, but no more than three (3) days after becoming aware of a Security Breach, or of unauthorized access to or disclosure or use of District Data, Vendor will notify the District, fully investigate the incident, and cooperate fully with the District’s investigation of and response to the incident.

Except as otherwise required by law, Vendor will not provide notice of the incident directly to individuals whose Personally Identifiable Information was involved, regulatory agencies, or other entities, without prior written permission from the District.

b. Liability. In addition to any other remedies available to the District under law or equity, Vendor will reimburse the District for all costs incurred by the District in investigation and remediation of any Security Breach caused in whole or in part by Vendor or subcontractors, including but not limited to providing notification to individuals whose Personally Identifiable Information was compromised and to regulatory agencies or other

Page No. 3 of 4 entities as required by law or contract and the payment of legal fees, audit costs, fines, and other fees imposed against the District as a result of the Security Breach, provided that such indemnification shall be subject to the limitation of liability contained in the Agreement.

8. Response to Legal Orders, Demands or Requests for Data. Except as otherwise expressly prohibited by law, Contractor will promptly:

i. notify the District of any subpoenas, warrants, or other legal orders, demands or requests received by

Vendor seeking District Data;

ii. reasonably consult with the District regarding Vendor’s response;

iii. cooperate with the District’s reasonable requests in connection with efforts by the District to intervene and quash or modify the legal order, demand or request; and

iv. upon the District’s request, provide the District with a copy of its response.

If the District receives a subpoena, warrant, or other legal order, demand (including a request for information pursuant to the Texas Public Information Act), or other request seeking District Data maintained by Vendor, the District will promptly provide a copy of the request to Vendor. Vendor will promptly supply the District with copies of records or information required for the District to respond, and will cooperate with the District’s reasonable requests in connection with the District’s response.

9. Data Transfer Upon Termination or Expiration.

a. Upon termination or expiration of the Agreement, Vendor will ensure that all District Data are securely returned or destroyed as directed by the District. Following termination or deactivation of a District account, Vendor may retain profile information and content for a commercially reasonable time for backup, archival, or audit purposes, but any and all student data associated with the District will be deleted promptly. Vendor may not maintain anonymized or aggregated data, including usage data, for analytics purposes. Please note that even when records are modified or deleted from Vendor’s active databases, copies may remain in data backups as necessary to comply with business or regulatory requirements. Transfer to the District or a third party designated by the District shall occur within a reasonable period of time, and without significant interruption in service.

Vendor shall ensure that such transfer/migration uses facilities and methods that are compatible with the relevant systems of the District or its transferee, and to the extent technologically feasible, that the District will have reasonable access to District Data during the transition. In the event that the District requests destruction of any District Data, Vendor agrees to Securely Destroy all data in its possession and in the possession of any subcontractors or agents to which the Vendor might have transferred District Data. Vendor agrees to provide documentation of data destruction to the District.

b. Vendor will promptly notify the District of impending cessation of its business and any contingency plans. This includes immediate transfer of any previously escrowed assets and data and providing the District access to Vendor’s facilities as necessary to remove and destroy District-owned assets and data. Vendor shall implement its exit plan and take all necessary actions to ensure a smooth transition of service with minimal disruption to the District. Vendor will also provide a full inventory and configuration of servers, routers, other hardware, and software involved in service delivery along with supporting documentation, indicating which if any of these are owned by or dedicated to the District. Vendor will work closely with its successor to ensure a successful transition to the new equipment, with minimal downtime and effect on the District, all such work to be coordinated and performed in advance of the formal, final transition date.

10. Audits. The District reserves the right in its sole discretion to perform audits of Vendor at the District’s expense to ensure compliance with the terms of this Addendum. Vendor shall reasonably cooperate in the performance of such audits. This provision applies to all agreements under which the Vendor must create, obtain, transmit, use, maintain, process, or dispose of District Data.

11. Institutional Branding. Each Party shall have the right to use the other Party’s Brand Features only as permitted under the Agreement or as approved in writing by the other Party, in advance of such use. Any use of a Party’s Brand Features will inure to the benefit of the Party holding intellectual property rights in and to those features.

12. Compliance. Vendor will comply with all applicable laws and industry standards in performing services under the Agreement. Any of Vendor’s personnel visiting the District’s facilities will comply with all applicable District policies regarding access to, use of, and conduct within such facilities. The District will provide copies of such policies to

Page No. 4 of 4

Vendor upon request. Vendor warrants that any subcontractors used by Contractor to fulfill its obligations under the Agreement will be subject to and will comply with each and every term of this Data Protection Addendum in the same manner that Vendor itself is subject to the terms of this Data Protection Addendum. Vendor warrants that it assesses and improves the core functionality of the products and/or service(s) it will provide to the District on an on-going basis for compliance with relevant laws, regulations, and guidance applicable to Vendor, including but not limited to:

COPPA, FERPA, PPRA, IDEA, HIPAA and Health Information Technology for Economic and Clinical Health Act (HITECH), GLB, PCI DSS, Americans with Disabilities Act (ADA), as amended, and Federal Export Administration Regulations.

13. No End User Agreements. The Agreement and exhibits thereto are the entire agreement between the District (including District employees and other End Users) and Vendor regarding Vendor’s access to, use of, and disclosure of District Date. In the event that Vendor enters into terms of use agreements or other agreements or understandings, whether electronic, click-through, verbal or in writing, with District employees or other End Users, such agreements shall be null, void and without effect, and the terms of this Agreement shall apply.

14. Term and Termination. This Addendum will become effective when Vendor accepts the Agreement. It will continue in effect under the terms in the Agreement. This Addendum will automatically terminate without any further action of the Parties upon the termination or expiration of the Agreement. Certain provisions and requirements of this Addendum will survive its expiration or other termination in accordance with Section 15 herein. Breach of the terms of this Addendum will constitute a material breach of the Agreement.

15. Survival. Vendor’s obligations under Section 9 shall survive termination of the Agreement until all District Data has been returned or Securely Destroyed.

16. Insurance. Vendor represents and warrants that Vendor will maintain any insurance policies required by and in accordance with any insurance requirements specified by the District in the underlying Agreement and further agrees to make the certificates of insurance and insurance policies available to the District upon request.

17. Advertisement. Any and all forms of advertisement in connection with the Agreement, whether directed towards children, parents, guardians or District employees, shall be strictly prohibited.

18. Injunctive Relief. The Parties agree that Vendor’s disclosure or use (or threat to disclose or use) any District Data in breach of this Addendum will cause immediate and irreparable harm to the District and the District shall be entitled to immediate injunctive relief against any actual or threatened violation, in addition to any of its other rights and remedies. In the event of any suit or action arising under this Section 17, Vendor consents to mandatory and exclusive jurisdiction of the courts in Potter County, Texas.

AGREED TO BY:

Vendor’s Legal Business Name – Referred to herein as “Vendor”

Printed Name of Authorized Representative for Vendor Title

Signature of Authorized Representative for Vendor Date