2 Master Price Agreement Template.pdf

MASTER PRICE AGREEMENT

This Contract is made and entered into by and between: Contract No:

(“Provider”) Beaverton School District (“District”) 1260 NW Waterhouse Avenue Beaverton, Oregon 97006 Attention: Procurement and Contracting

Provider and District are each, a “Party” and together the “Parties”.

STATEMENT OF WORK: Provider shall provide the District with the following services: [insert Scope of Work] (“Work”). Work is further described in Exhibit “B”, hereby attached and incorporated by reference.

SUPERSEDING EFFECT:

There are no covenants, promises, Contracts, conditions or understandings between the Parties, either oral or written, other than those contained in this Contract. This Contract and all exhibits and attachments hereto together constitute the entire Contract between the Parties (listed in order of precedence): 1) Student Data Privacy Agreement is incorporated by reference 2) Amendments to this Contract; 3) This Contract including Exhibit A Terms and Conditions; and 4) Exhibit B Statement of Work. 5) RFP, including issued addenda, specifications and attachments are incorporated by reference. 6) Provider’s offer is incorporated by reference.

Any Provider Response (bid/proposals) attached to this Contract are incorporated solely for: (i) any statement of fees and schedule that is consistent with the entire Contract as defined above; and (ii) any statement no other provisions of any proposal are part of this Contract, including without limitation any purported limitation on liability. (iii) To the extent that a proposal term otherwise conflicts with the terms of this Contract or is not included in this Contract, such proposed terms are void and are expressly and wholly subject to the terms of this Contract. (iv) In the event of overlap or inconsistency between the provisions of such proposals and the other terms of this Contract, the provision that provides a better quality or quantity of service to District shall control.

CONSIDERATION:

Provider shall perform/deliver the Work required, on an as needed basis, in consideration for which the District agrees to pay for the Work in a manner further described in the contract and pursuant to the proposal pricing. Individual Task Order are required prior to any work being performed and will be issued by the District on a requirements basis. The District is not required to make any purchases under this Contract.

CONTRACT START DATE: Upon Contract Execution CONTRACT END DATE: , 202X

DISTRICT REPRESENTATIVE: The District Representative for this contract is: Name, Title, email address name_ @beaverton.k12.or.us, (503)356-XXXX.

PROVIDER REPRESENTATIVE: The Provider Representative for this contract is: Name, Title, Email Address, Phone Number. The Provider Representative shall constitute the Provider’s point of contact for all notices and other matters related to this Contract.

CONTACT WITH STUDENTS:

All Providers are subject to Law Enforcement Data System background check. The Provider must not have unsupervised contact with students. When unsupervised contact with students is requested by the District, Provider must be fingerprinted ($75.00 fee).

In consideration of the mutual covenants, stipulations and agreements, the Parties hereto do agree and acknowledge that they have read and understand this Contract and agree to be bound by its terms and conditions:

Beaverton School District:

Provider Name:

Cost Center Authority Signature Date

Provider Authority Signature Date

Print Name

Print Name Title

Contracting Authority Signature Date Procurement and Contracting

Email Phone

Not a valid Contract until all signatories are complete This contract is pursuant to Oregon Revised Statutes (ORS 279 A, B and C) and Beaverton School District Public Contracting Rules.

Requisition # ____________

EXHIBIT A – BEAVERTON SCHOOL DISTRICT PERSONAL SERVICES CONTRACT GENERAL TERMS AND CONDITIONS

These terms and conditions apply to all purchases of services by or on behalf of the Beaverton School District unless specifically provided otherwise in writing.

1. Assignment. Provider shall not subcontract, assign, or transfer any of its interest in this Contract without the District’s prior written consent.

2. Compliance with Laws. Provider certifies that in performing this Contract they will comply with all applicable provisions of federal, state, and local laws, regulations, rules, and orders. Provider expressly agrees to comply with: (i) Title

VI and VII of Civil Rights Act of 1964, as amended; (ii) Sections

503 and 504 of the Rehabilitation Act of 1973, as amended; (iii) the Americans with Disabilities Act of 1990, as amended, and

ORS 659.425; (iv) Executive Order 11246, as amended; (v) The

Age Discrimination in Employment Act of 1967, as amended, and the Age Discrimination Act of 1975, as amended; (vi) The

Vietnam Era Veterans’ Readjustment Assistance Act of 1974, as amended; (vii) ORS Chapter 659, as amended; (viii) all regulations and administrative rules established pursuant to the foregoing laws; (ix) all other applicable requirements of federal and state civil rights and rehabilitation statutes, rules and regulations; and (x) all federal and state laws governing the handling, processing, packaging, storage, labeling, and delivery of food products, if applicable. All laws, regulations and executive orders applicable to the Contract are incorporated by reference where so required by law.

3. Changes. The District may make written changes to this contract. If such change causes an increase or decrease in the consideration or the time required to perform, an equitable adjustment shall be made and the Agreement modified in writing.

4. Force Majeure. Neither the District nor Provider shall be held responsible for delay or default caused by any contingency beyond their control, including, but not limited to war or insurrection, epidemic or pandemic, strikes or lockouts by the parties’ own employees, walkouts by the parties’ own employees, fires, natural calamities, riots, or demands or requirements of governmental agencies other than the

District.

5. Activities away from and/or after normal School hours. In performance of Provider services neither the District nor its employees will be regarded as having assumed and exercised control over the transportation or supervision of students so as to incur any liability in case of injury to the students. Provider assumes responsibility and control of students during all activities in performance of contracted services.

6. Contact With Students: All Providers are subject to Law

Enforcement Data System background check. The Provider must not have unsupervised contact with students. When unsupervised contact with students is requested by the

District, Provider must be fingerprinted ($75.00 fee).

7. Governing Law. The laws of the State of Oregon shall govern this contract. Any action or suit commenced in connection with this contract shall be in the Circuit Court of

Washington District or the Federal District Court for Oregon.

The prevailing party shall be entitled to reasonable attorney fees and costs as awarded by the Court, including any appeal.

All rights and remedies of District and Provider shall be cumulative and may be exercised successively or concurrently.

8. Indemnification and Hold Harmless. Except for claims arising out of acts caused by the sole negligence of the District, its Administrators or employees, the Provider agrees to indemnify and hold harmless the District and its board members, administrators, teachers, employees and agents, from acts or omissions of any nature whatsoever of the

Provider, its agents, servants and employees, causing injury to, or death of person(s) or damage to property during the term of this contract, and from any expense incident to the defense of the District there from. The Provider agrees to indemnify and hold harmless the District and its board members, administrators, teachers, employees and agents, from and to defend it against, any and all claims arising from the purchase, installation, and/or use of the equipment, articles and/or materials which are the subject of this Contract.

9. Independent Contractor. The services provided under this

Contract are those of an independent contractor. Provider is not an officer, employee or agent of the District. Although the

District reserves the right (i) to determine (and modify) the delivery schedule for the Work to be performed and (ii) to evaluate the quality of the completed performance, the

District cannot and will not control the means or manner of

Provider's performance.

10. Insurance. Provider shall purchase and maintain:

a. WORKER'S COMPENSATION as required by law.

b. EMPLOYER'S LIABILITY in the minimum amount of

$1,000,000 when the Provider has one or more employees performing services under the contract.

c. COMPREHENSIVE AUTOMOBILE LIABILITY including owned, non- owned and hired vehicles: $1,000,000

Combined Single Limit Bodily Injury and Property

Damage any one occurrence and in the aggregate.

d. COMPREHENSIVE GENERAL LIABILITY to include premises operations, independent Providers, products/completed operations, and blanket contractual, occurrence-based policy: $1,000,000 per

Single Limit Bodily Injury, Property Damage, and personal injury any one occurrence and $2,000,000 in the aggregate.

e. PROFESSIONAL LIABILITY. Provider shall maintain in force during the duration and through completion of this Contract (and, if it is a claims made policy, for one year following completion of the project) a professional liability policy, in the minimum amount of $1,000,000.

f. CERTIFICATES OF INSURANCE. The District, its employees, officials, and agents shall be named as an

Additional Insured on general liability and automobile policies and shall be provided a copy of the additional insured endorsement. Such insurance shall be primary. Certificates of Insurance shall be issued, prior to the commencement of the contract, to risk@beaverton.k12.or.us Beaverton School District, Attn: Risk Department, 1260 NW Waterhouse Ave, Beaverton, OR 97006. Such insurance shall be maintained in full force and effect throughout the entire term of the contract and any extensions thereto. The Provider agrees to pay for the insurance specified and agrees to provide the District with a 30 days’ notice of cancellation if non- renewal occurs during the contract period. Insurance companies must have a minimum of an A rating.

g. The District reserves the right to require additional insurance which will be delineated in an attachment to this Contract.

11. Ownership of Work Product. All work product of Provider that results from this Contract is the exclusive property of the

District. Provider hereby irrevocably assigns to the District all of its right, title, and interest in and to any and all of the work product, whether arising from copyright, patent, trademark, trade secret, or any other state or federal intellectual property law or doctrine. Provider forever waives any and all rights relating to the work product including any and all rights arising under Title 17 USC §106A or any other rights of identification of authorship or rights of approval, restriction or limitation on use or modifications.

12. Representations. Provider represents and warrants to the

District that:

a. Provider has the power and authority to enter into and perform this Contract,

b. the Work under this Contract shall be performed in a good and workmanlike manner and in accordance with the highest professional standards,

c. Provider shall, at all times during the term of this

Contract, be qualified, professionally competent, and duly licensed to perform the Work.

13. Responsibility for Taxes and Withholding. Provider shall be responsible for all federal or state taxes applicable to compensation paid to Provider under this Contract. The District will not withhold from such compensation any amount(s) to cover Provider's federal or state tax obligations. Provider is not eligible for any social security, unemployment insurance or workers' compensation benefits from compensation paid to

Provider under this Contract.

14. Severability. If any provision of this Contract is declared by a court of competent jurisdiction to be illegal or in conflict with any law, the validity of the remaining terms and provisions shall be construed and enforced as if the Contract did not contain the particular provision held to be invalid.

15. Termination.

a. Terminate For Convenience. This Contract may be terminated at any time by mutual written consent of the parties, or the District may, at its sole discretion, terminate this Contract, in whole or in part, upon 30 days’ notice to Provider.

b. The District's Right to Terminate For Cause. The

District may terminate this Contract, in whole or in part, immediately upon notice to Provider, or at such later date as the District may establish in such notice, upon the occurrence of any of the following events:

(i) The District fails to receive funding, or appropriations, limitations or other expenditure authority at levels sufficient to pay for Provider's

Work;

(ii) Federal or state laws, regulations or guidelines are modified or interpreted in such a way that either the Work under this Contract is prohibited, or the

District is prohibited from paying for such Work from the planned funding source;

(iii) Provider no longer holds any license or certificate that is required to perform the Work; or

(iv) Provider commits any material breach or default of any covenant, warranty, obligation or Contract under this Contract, fails to perform the Work under this Contract within the time specified herein or any extension thereof, or so fails to mailto:risk@beaverton.k12.or.us pursue the Work as to endanger Provider's performance under this Contract in accordance with its terms, and such breach, default or failure is not cured within 10 business days after delivery of the District's notice, or such period as the

District may specify in such notice.

c. Provider's Right to Terminate for Cause. Provider may terminate this Contract upon 30 days' notice to the

District if the District fails to pay Provider pursuant to the terms of this Contract and the District fails to cure within 30 business days after receipt of Provider's notice.

d. Enforcement. Termination under any provision of this

Contract shall not extinguish or prejudice the District’s right to enforce this Contract with respect to any breach of a Provider warranty or any defect in or default of Provider’s performance that has not been cured, including any right of the District to indemnification by Provider. If this Contract is so terminated, Provider shall be paid in accordance with the terms of the contract for services rendered and accepted.

e. Remedies. In the event of termination pursuant to above, Provider's sole remedy shall be a claim for the sum designated for accomplishing the Work multiplied by the percentage of Work completed and accepted by the District, less previous amounts paid.

If previous amounts paid to Provider exceed the amount due to Provider under this subsection, Provider shall pay any excess to the District upon demand.

f. Provider's Tender Upon Termination. Upon receiving a notice of termination of this Contract, Provider shall immediately cease all activities under this Contract, unless the District expressly directs otherwise in such notice of termination. Upon termination of this

Contract, Provider shall deliver to the District all documents, information, works-in-progress and other property that are or would be deliverables had the

Contract been completed.

g. Limitation of Liabilities. Neither party shall be liable for (i) any indirect, incidental, consequential or special damages under the contract or (ii) any damages of any sort arising solely from the termination of this contract in accordance with its terms.

16. Confidential information. Provider acknowledges that it or its employees, sub-contractors, or agents may, in the course of performing their responsibilities under this Contract, be exposed to or acquire information that is the confidential information of District or District’s clients. Any and all information provided by District and marked confidential, or identified as confidential in a separate writing, that becomes available to Provider or its employees, sub-contractors, or agents in the performance of this Contract shall be deemed to be confidential information of District (“Confidential

Information”). Any reports or other documents or items including software, that result from Provider’s use of the

Confidential Information and any Work Product that District designates as confidential are deemed Confidential

Information. Confidential Information shall be deemed not to include information that: (a) is or becomes (other than by disclosure by Provider) publicly known; (b) is furnished by

District to others without restrictions similar to those imposed by this Contract; (c) is rightfully in Provider’s possession without the obligation of nondisclosure prior to the time of its disclosure under this Contract; (d) is obtained from a source other than the District without the obligation of confidentiality; (e) is disclosed with the written consent of the

District; or (f) is independently developed by employees or agents of Provider who can be shown to have had no access to the Confidential Information.

a. NON-DISCLOSURE. Provider agrees to hold

Confidential Information in strict confidence, using at least the same degree of care that Provider uses in maintaining the confidentiality of its own confidential information, and not to copy, reproduce, sell, assign, license, market, transfer or otherwise dispose of, give, or disclose Confidential Information to third parties or use Confidential Information for any purposes whatsoever other than the provision of Services to the District under this Contract, and to advise each of its employees, sub-contractors, and agents of their obligations to keep Confidential Information confidential. Provider shall use its best efforts to assist the District in identifying and preventing any unauthorized use or disclosure of any Confidential

Information. Without limiting the generality of the foregoing, Provider shall advise the District immediately in the event Provider learns or has reason to believe that any person who has had access to Confidential Information has violated or intends to violate the terms of this Contract and Provider will at its expense cooperate with the District in seeking injunctive or other equitable relief in the name of the

District or Provider against any such person. Provider agrees that, except as directed by the District, Provider will not at any time during or after the term of this Contract disclose, directly or indirectly, any

Confidential Information to any person, except in accordance with this Contract, and that upon termination of this Contract or at the District’s request, Provider will turn over to the District all documents, papers, and other matter in Provider's possession that embody Confidential Information.

b. INJUNCTIVE RELIEF. Provider acknowledges that breach of this Section, including disclosure of any

Confidential Information, will give rise to irreparable injury to the District that is inadequately compensable in damages. Accordingly, the District may seek and obtain injunctive relief against the breach or threatened breach of this Section, in addition to any other legal remedies that may be available. Provider acknowledges and agrees that the covenants contained herein are necessary for the protection of the legitimate business interests of the District and are reasonable in scope and content.

17. FERPA.

Provider agrees to comply with both FERPA and corresponding

Oregon law respecting student education records. Personally identifiable information obtained from the District by the

Provider in the performance of their services: (i) will not be disclosed to third parties, except as expressly provided for in

FERPA §§99.31, without signed and dated written consent of the student, or if the student is under eighteen (18) years of age, signed and written consent of the student’s parents/guardians and (ii) will be used only to fulfill the

Provider’s responsibilities under this Contract.

18. Federal Grant Regulations. When this Contract is marked as federally funded, Provider must follow the additional terms and conditions under 2 C.F.R § 200.326 and 2 C.F.R part 200 .

19. Waiver. No failure of either party to exercise any power given to it hereunder or to insist upon strict compliance by the other party with its obligations hereunder, and not custom or practice of the parties at variance with the terms hereof, nor any payment under this Contract shall constitute a waiver of either party’s right to demand exact compliance with the terms hereof.

20. Suspension of Services. The District may suspend

Provider’s right/obligation to provide services without prior notice to the Provider, and at the sole discretion of District, in the event of a declared or de-facto condition which makes continued provision of the services to be not in the best interests of the District. The District will not be obligated to pay for services not provided.

21. Public Health Requirements. The Provider shall comply with any federal, state, county, District, and/or other public health authorities’ rules, requirements, procedures, and guidelines that are in effect during the term of the Contract.

This requirement shall survive the Contract to the extent applicable.

22. Counterparts. This Contract may be executed in several counterparts (electronic or otherwise), each of which shall be an original, all of which shall constitute the same instrument.

23. Rate Adjustments. Rate adjustments are not expected during the term of this Agreement. If the Provider seeks and exception, a written request must be submitted in writing no fewer than thirty (30) days prior to the end of the current Agreement Year.

Any proposed rate adjustment shall in no case exceed the percentage change in the Consumer Price Index for All

Urban Consumers (CPI-U), U.S. City Average, measured over the preceding Agreement Year.

24. Invoicing. Payment will be made within 30 days of receipt of a properly completed invoice for services delivered that includes the Contract number. Invoices will not be processed until services are delivered.

Provider shall include the District Contract number on all invoices and shall submit invoices to Accounts

Payable via email to: ap@beaverton.k12.or.us.

- END (last revised 10/1/23)-https://resources.finalsite.net/images/v1568918708/beavertonk12orus/smyhfa6hbabpr5n9gsuh/GrantsRequiredFederalTCContractClauses2CFR200326and2CFRPart200AppendixII.pdf mailto:ap@beaverton.k12.or.us

SCHOOL NAME SCHOOL TYPE

2025-26

Total

Enrollment

Aloha-Huber

Park School Elementary 892

Kinnaman

Elementary

School Elementary 428

Barnes

Elementary

School Elementary

School 398

Beaver Acres

Elementary

School Elementary

School 701

Bethany

Elementary

School Elementary

School 388

Bonny Slope

Elementary

School Elementary

School 588

Cedar Mill

Elementary

School Elementary

School 358

Chehalem

Elementary

School Elementary

School 360

Cooper

Mountain

Elementary Elementary

School 355

Elmonica

Elementary

School Elementary

School 428

Errol Hassell

Elementary

School Elementary

School 296

Findley

Elementary Elementary

School 504

Fir Grove

Elementary

School Elementary

School 338

Greenway

Elementary

School Elementary

School 249

Hazeldale

Elementary

School Elementary

School 505

Hiteon

Elementary

School Elementary

School 470

Jacob Wismer

Elementary

School Elementary

School 548

McKay

Elementary

School Elementary

School 239

McKinley

Elementary

School Elementary

School 668

Montclair

Elementary

School Elementary

School 264

EXHIBIT 1

Total

Enrollment

Nancy Ryles

Elementary

School Elementary

School 432

Oak Hills

Elementary

School Elementary

School 446

Raleigh Hills

Elementary

School Elementary

School 261

Ridgewood

Elementary

School Elementary

School 340

Rock Creek

Elementary

School Elementary

School 390

Sato Elementary

School Elementary

School 855

Scholls Heights

Elementary

School Elementary

School 620

Sexton

Mountain

Elementary Elementary

School 413

Springville

Elementary

School Elementary

School 710

Springville

Elementary

School Elementary

School 710

Terra Linda

Elementary

School Elementary

School 286

Vose

Elementary Elementary

School 594

West Tualatin

View

Elementary Elementary

School 276

William Walker

Elementary

School Elementary

School 497

Aloha High

School High School 1,578

Beaverton High

School High School 1,392

MountainSide High School 1,778

4 Southridge High

School High School 1,357

Sunset High

School High School 1,764

Westview High

School High School 2,371

Cedar Park

Middle School Middle School 647

Conestoga

Middle School Middle School 808

Five Oaks

Middle School Middle School 767

Total

Enrollment

Highland Park

Middle School Middle School 634

Meadow Park

Middle School Middle School 679

Mountain View

MS Middle School 770

Stoller Middle

School Middle School 1,125

Tumwater

Middle School Middle School 973

Whitford

Middle School Middle School 768

Arts and

Communication

Magnet Option School 697

Beaverton

Academy of

Science and

Engineering Option School 850

FLEX Online

School Option School 399

International

School of

Beaverton Option School 873

Community

School Alternative

School 147

Arco Iris Spanish

Immersion

School Charter School 412

Hope Chinese

Charter School Charter School 401 36,997

Elementary 1837

Middle 619

High School 762

Option/Alternativ e

National Data Privacy Agreement (NDPA), Version 2 Page | 1

STANDARD STUDENT DATA PRIVACY

AGREEMENT

(Oregon National Data Privacy Agreement (NDPA) Standard VERSION 2)

And

Version 2

Authored by Members of the Student Data Privacy Consortium (SDPC) &

Mark Williams, Fagen, Friedman & Fulfrost LLP

© Access 4 Learning (A4L) Community. All Rights Reserved.

This document may only be used by A4L Community members and may not be altered in any substantive manner.

LEGAL NAME OF VENDOR

SAMPLE

O

NLY

EXHIBIT 2

STANDARD STUDENT DATA PRIVACY AGREEMENT Version 2.0

© Access 4 Learning (A4L) Community. All Rights Reserved. Page | 2

This Student Data Privacy Agreement (“DPA”) is entered into on the date of full execution (the “Effective Date”) and is entered into by and between:

located at [ ] (the “LEA”) and located at [ ] (the “Provider”).

PREAMBLE

WHEREAS, the Provider is providing educational or digital Services, as defined in Exhibit “A”, to LEA, which

Services may include: (a) cloud-based Services for the digital storage, management, and retrieval of pupil records; and/or (b) digital educational software that authorizes Provider to access, store, and use pupil records;

and

WHEREAS, the Provider and LEA have entered into a Service Agreement (as defined herein), to provide certain

Services to the LEA as set forth in the Service Agreement, and this DPA (collectively the “Agreement”), WHEREAS, the Provider and LEA recognize the need to protect personally identifiable student information and other regulated data exchanged between them as required by applicable laws and regulations, such as the

Family Educational Rights and Privacy Act (“FERPA”) at 20 U.S.C. 1232g (34 C.F.R. Part 99); the Protection of

Pupil Rights Amendment (“PPRA”) at 20 U.S.C. 1232h; and the Children’s Online Privacy Protection Act

(“COPPA”) at 15 U.S.C. 6501-6506 (16 C.F.R. Part 312), WHEREAS, the Provider and LEA desire to enter into this DPA for the purpose of establishing their respective obligations and duties in order to comply with applicable laws and regulations.

NOW THEREFORE, for good and valuable consideration, LEA and Provider agree as follows:

General Offer of Privacy Terms.

The Provider has signed Exhibit “E” to the SDPC Standard Clauses, otherwise known as “General Offer of

Privacy Terms” enabling other LEAs to enter into the same terms of this DPA with Provider.

Special Provisions. (Check if Required)

[ ] If checked, the Supplemental State Terms attached hereto as Exhibit “G” are hereby incorporated by reference into this DPA in their entirety.

If the Parties desire to change any terms, use the ‘Vendor-Specific’ Agreement or ‘District-Modified’ Agreement.

CITY, STATE, ZIP

SAMPLE

O

© Access 4 Learning (A4L) Community. All Rights Reserved. Page | 3

The designated representative for the LEA for this DPA is:

Name: Title:

Address:

Phone: Email:

The designated representative for the Provider for this DPA is:

Name: Title:

Address:

Phone: Email:

IN WITNESS WHEREOF, LEA and Provider execute this DPA as of the Effective Date.

LEA: [ ]

Signed By: Date:

Printed Name: Title/Position:

PROVIDER: [ ]

Signed By: Date:

Printed Name: Title/Position:

Each Party is responsible to promptly notify the other Party of changes to the notice information.

Notices to Provider

With a copy to (if provided):

Notices to LEA

With a copy to (if provided):

Security Notices to Provider (Required per Section 5.3) Security Notices to LEA (Required per Section 5.3)

Name Role Address Email

Name Role Address Email

Name Address Email

SAMPLE

© Access 4 Learning (A4L) Community. All Rights Reserved. Page | 4

STANDARD CLAUSES

ARTICLE I: PURPOSE AND SCOPE

1.1 Purpose of DPA.

The purpose of this DPA is to describe the duties and responsibilities to protect Student Data including compliance with all applicable federal and state privacy laws, rules, and regulations, all as may be amended from time to time. In performing the Services, the Provider shall be considered a School Official with a legitimate educational interest, and performing Services otherwise provided by the LEA. With respect to its use and maintenance of Student Data, Provider shall be under the direct control and supervision of the LEA as set forth in this DPA and the Service Agreement.

1.2 Description of Products and Services.

A description of all products and services covered by the Agreement, and information specific to this DPA, are listed in Exhibit "A". If a Provider needs to update any information on Exhibit “A” (such as updating with new provided services), they may do so by completing the Addendum template provided by the A4L Community and sending a copy to the LEA.

Provider may add or delete products or services subject to this DPA under the following circumstances:

1. Deleted products or services: The products or services have been discontinued and are no longer available from the Provider.

2. Added products or services: The added products or services are either:

a. a direct replacement, or substantially equivalent to the original products or services listed in the DPA, or

b. the added products or services result in enriched new or enhanced capabilities, new modules, technology advancements and or service categories relating to the listed products or services that Provider did not have at the time the DPA was signed.

If an added product or service requires additional Data Elements, Provider must complete the relevant portion of the Addendum template to update Exhibit “B”.

Provider may not make any change to Exhibit “A” via an Addendum, except adding or deleting products or services. LEA is under no obligation to acquire added products or services, and has no ability under the DPA to prevent deletion of products or services. Subject to the limitations in this section, an Addendum is automatically incorporated into this DPA when LEA is notified by Provider, in accordance with the notification provisions of this

DPA, of the Addendum’s existence and contents.

1.3 Student Data to Be Provided.

In order to perform the services, the Provider shall process Student Data as identified by the Provider in the

Schedule of Data, attached hereto as Exhibit “B”. Student Data may be provided by the LEA or created by students, as set forth fully in the definition of Student Data in Exhibit “C”. If a Provider needs to update any information on Exhibit “B”, they may do so by completing the Addendum template provided by the A4L

Community and sending a copy to the LEA.

Provider may delete data elements from Exhibit “B” if they are no longer used by the Provider.

SAMPLE

© Access 4 Learning (A4L) Community. All Rights Reserved. Page | 5

Provider must add data elements to Exhibit “B”, when a material change has occurred, regardless of whether the added data elements are either one of the following:

1. used to better deliver the original products or services listed in the DPA, or

2. used to deliver added products or services that result in new or enhanced capabilities, new modules, technology advancements and or service categories relating to the listed products or services that Provider did not have at the time the DPA was signed. Such new products or services must be designated in the Addendum template as changes to Exhibit “A”.

The Provider must notify the LEA, in accordance with the notification provisions of this DPA, of the existence and contents of an Addendum modifying Exhibit “B”. The LEA will have thirty (30) days from receipt to object to the Addendum. If no written objection is received it will become incorporated into the DPA between the parties.

1.4 DPA Definitions.

Capitalized terms used in this DPA shall have the meanings set forth in Exhibit “C”. With respect to the treatment of Student Data, in the event of a conflict, definitions used in this DPA shall prevail over terms used in any other writing, including, but not limited to, the Service Agreement.

ARTICLE II: DATA OWNERSHIP AND AUTHORIZED ACCESS

2.1 Student Data Property of LEA.

As between LEA and Provider, all Student Data processed by the Provider, or created by students (as set forth fully in the definition of Student Data in Exhibit “C”), pursuant to the Agreement is and will continue to be the property of and under the control of the LEA. The Provider further acknowledges and agrees that all copies of such Student Data processed by the Provider, including any modifications or additions or any portion thereof from any source, are also subject to the provisions of this DPA in the same manner as the original Student Data.

The Parties agree that as between them, all rights, including all intellectual property rights in and to Student Data contemplated per the Service Agreement, shall remain the exclusive property of the LEA.

2.2 Parent, Legal Guardian and Student Access.

The LEA shall establish reasonable procedures by which a parent, legal guardian, or eligible student (as defined in FERPA) may review Student Data and request deletion or modification, and request delivery of a copy of the

Student Data. In support of this, the Provider shall establish reasonable procedures by which the LEA may access, and correct if necessary, Education Records and/or Student Data, and make a copy of the data available to the LEA or (at the LEA’s direction) to the parent, legal guardian or eligible student directly. If the LEA is not able to review or update the Student Data itself, Provider shall respond in a reasonably timely manner (and no later than thirty (30) days from the date of the request or pursuant to the time frame required under state law for an LEA to respond to a parent, legal guardian or student, whichever is sooner) to the LEA’s request for Student

Data held by the Provider to view or correct as necessary.

In the event that a parent or legal guardian of a student or eligible student contacts the Provider to correct, delete, review or request delivery of a copy of any of the Student Data collected by or generated through the Services, the Provider shall refer that person to the LEA, who will follow the necessary and proper procedures regarding

SAMPLE

© Access 4 Learning (A4L) Community. All Rights Reserved. Page | 6 the requested information. In the event that any person other than those listed contacts the Provider about any

Student Data, the Provider shall refer that person to the LEA, except as provided in Section 4.4.

2.2.1 This NDPA does not impede the ability of students to download, export, or otherwise save or maintain their own Student Generated Content directly from Provider or for Provider to provide a mechanism for such download, export, transfer or saving to students, or the student’s parent or legal guardian. Nor does it impede the ability of Providers to offer LEAs features to allow such ability.

2.2.2 In the event that Student Generated Content is transferred to the control of the student, parent or legal guardian, the copy of such Student Generated Content that is in the control of such person is no longer considered Student Data.

2.3 Subprocessors.

Provider shall enter into a Subprocessor Agreement with all Subprocessors performing functions for the Provider in order for the Provider to provide the Services pursuant to the Service Agreement, whereby the Subprocessors agree to protect Student Data in a manner no less stringent than the terms of this DPA. Every Subprocessor

Agreement must provide that the Subprocessor will not Sell the Student Data. The terms of a Subprocessor

Agreement shall not be materially modified by the Subprocessor unless notice is provided to the Provider.

ARTICLE III: DUTIES OF LEA

3.1 Provide Data in Compliance with Applicable Laws.

LEA shall use the Services and provide Student Data in compliance with all applicable federal and state privacy laws, rules, and regulations, all as may be amended from time to time.

3.2 Annual Notification of Rights.

If the LEA has a policy of disclosing Education Records and/or Student Data under FERPA (34 CFR §

99.31(a)(1)), LEA shall include a specification of criteria for determining who constitutes a School Official and what constitutes a legitimate educational interest in its annual notification of rights.

3.3 Reasonable Precautions.

LEA shall employ administrative, physical, and technical safeguards designed to protect usernames, passwords, and any other means of gaining access to the Services and/or hosted Student Data from unauthorized access, disclosure, or acquisition by an unauthorized person.

3.4 Unauthorized Access Notification and Assistance.

LEA shall notify Provider within seventy-two (72) hours of any confirmed Data Breach to the Services, LEA’s account or any Student Data that poses a privacy or security risk. If requested by Provider, LEA will provide reasonable assistance to Provider in any efforts by Provider to investigate and respond to such Data Breach.

SAMPLE

© Access 4 Learning (A4L) Community. All Rights Reserved. Page | 7

ARTICLE IV: DUTIES OF PROVIDER

4.1 Privacy and Security Compliance.

The Provider shall comply with all laws and regulations applicable to Provider’s protection of Student Data privacy and security, and at the direction of the LEA shall cooperate with any state or federal government initiated audit of the LEA’s use of the Services.

4.2 Authorized Use.

The Student Data processed pursuant to the Services shall be used by the Provider for no purpose other than performing the Services outlined in Exhibit “A”, or as instructed by the LEA.

4.3 Provider Employee Obligation.

Provider shall require all of Provider’s employees who have access to Student Data to comply with all applicable provisions of this DPA with respect to the Student Data shared under the Service Agreement. Provider agrees to require and maintain an appropriate confidentiality agreement from each employee with access to Student

Data pursuant to the Service Agreement.

4.4 No Disclosure.

Provider acknowledges and agrees that it shall not sell or disclose any Student Data or any portion thereof, including without limitation, user content or other non-public information and/or personally identifiable information contained in the Student Data.

4.4.1 Exceptions to No Disclosure.

4.4.1.1 This prohibition against disclosure will not apply to Student Data where disclosure is directed or permitted by the LEA or this DPA.

4.4.1.2 The provision to not sell Student Data shall not apply to a Change of Control.

4.4.1.3 This prohibition against disclosure shall not apply to Student Data disclosed pursuant to a judicial order or lawfully issued subpoena or warrant.

4.4.1.4 This prohibition against disclosure shall not apply to Student Data disclosed to

Subprocessors performing Services on behalf of the Provider pursuant to this DPA.

4.4.1.5 Should law enforcement or other government entities (“Requesting Party(ies)”) provide a judicial order or lawfully issued subpoena or warrant to the Provider with a request for Student Data held by the Provider pursuant to the Services, the Provider shall notify the LEA in advance of a compelled disclosure to the Requesting Party.

4.4.1.6 Notification under 4.4.1.5 is not required if the judicial order or lawfully issued subpoena or warrant states not to inform the LEA of the request.

4.4.1.7 Should the LEA be presented with a judicial order or lawfully issued subpoena or warrant to disclose Student Generated Content or other Student Data, the

Provider shall cooperate with the LEA in delivering such data.

SAMPLE

© Access 4 Learning (A4L) Community. All Rights Reserved. Page | 8

4.4.1.8 This prohibition against disclosure shall not apply to LEA-authorized users of the

Services, which may include parents and legal guardians.

4.4.1.9 This prohibition against disclosure shall not apply to protect the safety of users or others, if and only if, an LEA employee who has specifically been authorized to declare a health or safety emergency has done so and all requirements under 34

CFR §§ 99.31(a)(10) and 99.36 have been fulfilled by the LEA.

4.4.1.10 This prohibition against disclosure shall not apply to protect the integrity or security of the Service, where such disclosure is made to a Subprocessor engaged by

Provider for the specific purpose of investigating a potential Data Breach as set forth in 5.4.

4.5 De-Identified Data

Provider agrees not to attempt to re-identify De-Identified Student Data without the written direction of the LEA.

De-Identified Student Data may be used by the Provider for those purposes allowed under applicable laws, for the purposes allowed for the processing of Student Data under this DPA, as well as the following purposes: (1) assisting the LEA or other governmental agencies in conducting research and other studies; (2) research, development, and improvement of the Provider's educational sites, Services, or applications, and to demonstrate the effectiveness of the Services; and (3) for adaptive learning purpose and for customized student learning.

Provider's use of De-Identified Student Data shall survive termination of this DPA or any request by LEA to return or dispose of Student Data. Except for Subprocessors, Provider agrees not to transfer De-identified Student Data to any third party unless the transfer is expressly directed or permitted by the LEA or this DPA. Such

Subprocessors must be subject to equivalent terms of the DPA including this one. Prior to publishing any document that names the LEA, the Provider shall obtain the LEA’s written approval of the manner in which De-

Identified Student Data is presented. If Provider chooses to create De-Identified Data, its process must comply with either NIST de-identification standards or US Department of Education guidance on de-identification.

4.6 Disposition of Data.

Upon written request from the LEA, Provider shall dispose of or provide a mechanism for the LEA to transfer

Student Data obtained under the Service Agreement, within sixty (60) days of the date of said request and according to a schedule and procedure as the Parties may reasonably agree.

If the Provider has a standard retention and destruction schedule, that schedule shall apply to Student Data as long as this DPA is active. The Provider’s practice relating to retention and disposition of Student Data shall be provided to the LEA upon request.

At the termination of this DPA, the Provider shall, unless directed otherwise by the LEA, dispose of, or delete

Student Data obtained by the Provider under the Agreement within sixty (60) days of termination (unless otherwise required by law). If the Agreement has lapsed or is not terminated, the Student Data shall be deleted when directed or permitted by the LEA, according to Provider’s standard destruction schedule, or as otherwise required by law. The LEA may provide the Provider with special instructions for the disposition of the Student

Data, by transmitting to Provider Exhibit “D”, attached hereto. The duty of the Provider to dispose of or delete

Student Data shall not extend to De-Identified Data or to Student-Generated Content that has been transferred or kept pursuant to Section 2.2.2.

SAMPLE

© Access 4 Learning (A4L) Community. All Rights Reserved. Page | 9

4.7 Advertising Limits.

Provider is prohibited from using, disclosing, or selling Student Data to (a) inform, influence, or enable Targeted

Advertising; (b) develop a profile of a student, family member/guardian or group, for any purpose other than providing the Service to LEA; or (c) for any commercial purpose other than to provide the Service to the LEA, or as authorized by the LEA or the parent/guardian. Targeted Advertising is strictly prohibited. However, this section does not prohibit Provider from using Student Data (i) for adaptive learning or customized student learning

(including generating personalized learning recommendations); or (ii) to make product recommendations to account holders that are not considered Targeted Advertising (this exception does not apply where the Provider is relying on the LEA to provide consent on behalf of the parent under COPPA); or (iii) to notify account holders about new education product updates, features, or Services that are not considered Targeted Advertising or from otherwise using Student Data as permitted in this DPA and its accompanying exhibits.

Before making product recommendations under section (ii) above, Provider must disclose the existence of those recommendations to LEA in writing, in sufficient detail that LEA can fulfill any obligations under applicable law

(e.g. PPRA).

ARTICLE V: DATA SECURITY AND BREACH PROVISIONS

5.1 Data Storage.

If Student Data is stored outside the United States, Provider will provide a list of Countries where data is stored, in Exhibit “B”.

5.2 Security Audits.

Provider will conduct a security audit or assessment no less than once per year, and upon a Data Breach. Upon

10 days’ notice and execution of confidentiality agreement, Provider will provide the LEA with a copy of the audit report, subject to reasonable and appropriate redaction.

5.3 Data Security.

The Provider agrees to utilize administrative, physical, and technical safeguards designed to protect Student

Data from unauthorized access, disclosure, acquisition, destruction, use, or modification. The Provider shall adhere to any applicable law relating to data security of Student Data. The Provider shall implement an adequate

Cybersecurity Framework that incorporates one or more of the nationally or internationally recognized standards set forth in Exhibit “F”. Additionally, Provider may choose to further detail its security programs and measures in

Exhibit “F”. Provider shall provide, in the Preamble to the DPA, contact information of an employee who LEA may contact if there are any data security concerns or questions.

5.4 Data Breach.

In the event that Provider confirms a Data Breach, the Provider shall provide notification to LEA within seventy-two (72) hours of confirmation of the Data Breach, unless notification within these time limits would disrupt investigation of the Data Breach by law enforcement. In such an event, notification shall be made within a reasonable time after the Data Breach. Provider shall follow the following process:

SAMPLE

© Access 4 Learning (A4L) Community. All Rights Reserved. Page | 10

(1) The Data Breach notification described above shall include, at a minimum, the following information to the extent known by the Provider and as it becomes available:

(a) The name and contact information of the Provider subject to this section,

(b) the date of the notice,

(c) the date of the Data Breach, the estimated date of the Data Breach, or the date range within which the Data Breach occurred,

(d) Whether the notification was delayed as a result of a law enforcement investigation, if legally permissible to share that information,

(e) A general description of the Data Breach, if that information is possible to determine at the time the notice is provided,

(f) A description of the Student Data reasonably believed to have been the subject of the Data Breach; and

(g) Identification of impacted individuals.

(2) Provider agrees to adhere to all applicable federal and state laws with respect to a Data Breach related to the Student Data, including any required responsibilities and procedures for notification and mitigation of any such Data Breach.

(3) Provider further acknowledges and agrees to have a written Data Breach response plan that is consistent with applicable industry standards and federal and state law for responding to a Data

Breach, involving Student Data and agrees to provide LEA, upon reasonable written request, with a summary of said written Data Breach response plan.

(4) LEA shall provide notice and facts surrounding the Data Breach to the affected students, parents, or guardians.

(5) In the event of a Data Breach originating from LEA’s use of the Service or otherwise a result of

LEA’s actions or inactions, Provider shall reasonably cooperate with LEA to the extent necessary to expeditiously secure Student Data and may request costs incurred as a result of such Data Breach.

SAMPLE

© Access 4 Learning (A4L) Community. All Rights Reserved. Page | 11

CONTRACT TERMS

Term and Termination. In the event that either Party seeks to terminate this DPA, they may do so by written notice if the Service Agreement has lapsed or has been terminated. Either party may terminate this DPA and any Service Agreement or contract if the other party breaches any terms of this DPA. This DPA shall stay in effect for as long as the Provider retains the Student Data, as set forth in section Article IV, Section 4.6. In the case of a “Change of Control” the LEA has the authority to terminate the DPA if it reasonably believes that the successor cannot uphold the terms and conditions herein or having a contract with the successor would violate the LEA’s policies or state or federal law.

Data…