201-26-045 Administrative Appendix J Virginia Standard Student Data Privacy Agreement.docx

Administrative Appendix J: Virginia Standard Student Data Privacy Agreement STANDARD STUDENT DATA PRIVACY AGREEMENT Version 2.0

VIRGINIA STANDARD STUDENT DATA PRIVACY AGREEMENT

(National Data Privacy Agreement (NDPA) Standard VERSION 2)

[INSERT SCHOOL DISTRICT OR LOCAL EDUCATION AGENCY]

And

[NAME OF PROVIDER]

Version 2

Authored by Members of the Student Data Privacy Consortium (SDPC) & Mark Williams, Fagen, Friedman & Fulfrost LLP

© Access 4 Learning (A4L) Community. All Rights Reserved.

This document may only be used by A4L Community members and may not be altered in any substantive manner.

This Student Data Privacy Agreement (“DPA”) is entered into on the date of full execution (the “Effective Date”) and is entered into by and between:

and

PREAMBLE

WHEREAS, the Provider is providing educational or digital Services, as defined in Exhibit “A”, to LEA, which Services may include: (a) cloud-based Services for the digital storage, management, and retrieval of pupil records; and/or (b) digital educational software that authorizes Provider to access, store, and use pupil records; and WHEREAS, the Provider and LEA have entered into a Service Agreement (as defined herein), to provide certain Services to the LEA as set forth in the Service Agreement, and this DPA (collectively the “Agreement”), WHEREAS, the Provider and LEA recognize the need to protect personally identifiable student information and other regulated data exchanged between them as required by applicable laws and regulations, such as the Family Educational Rights and Privacy Act (“FERPA”) at 20 U.S.C. 1232g (34 C.F.R. Part 99); the Protection of Pupil Rights Amendment (“PPRA”) at 20 U.S.C. 1232h; and the Children’s Online Privacy Protection Act (“COPPA”) at 15 U.S.C. 6501-6506 (16 C.F.R. Part 312), WHEREAS, the Provider and LEA desire to enter into this DPA for the purpose of establishing their respective obligations and duties in order to comply with applicable laws and regulations.

NOW THEREFORE, for good and valuable consideration, LEA and Provider agree as follows:

General Offer of Privacy Terms.

The Provider has signed Exhibit “E” to the SDPC Standard Clauses, otherwise known as “General Offer of Privacy Terms” enabling other LEAs to enter into the same terms of this DPA with Provider.

Special Provisions. (Check if Required) [ ] If checked, the Supplemental State Terms attached hereto as Exhibit “G” are hereby incorporated by reference into this DPA in their entirety.

If the Parties desire to change any terms, use the ‘Vendor-Specific’ Agreement or ‘District-Modified’ Agreement.

The designated representative for the LEA for this DPA is:

Name:

Title:

Address:

Phone:

Email:

The designated representative for the Provider for this DPA is:

Name:

Title:

Address:

Phone:

Email:

IN WITNESS WHEREOF, LEA and Provider execute this DPA as of the Effective Date.

LEA: [ School District Name ] Signed By:

Date:

Printed Name:

Title/Position:

PROVIDER: [ Name of Provider ] Signed By:

Date:

Printed Name:

Title/Position:

Each Party is responsible to promptly notify the other Party of changes to the notice information.

Notices to Provider [ Provider Name ] [ Provider Role ] [ Provider Postal Address ] [ Provider E-mail Address ] With a copy to (if provided):

[ Provider Legal Counsel ] [ Provider Legal Counsel Postal Address ] [ Provider Legal Counsel E-mail Address ] Notices to LEA [ LEA Name ] [ LEA Role ] [ LEA Postal Address ] [ LEA E-mail Address ] With a copy to (if provided):

[ LEA Legal Counsel ] [ LEA Legal Counsel Postal Address ] [ LEA Legal Counsel E-mail Address ]

Security Notices to Provider (Required per Section 5.3) [ Provider Security Name ] [ Provider Security Role ] [ Provider Security Postal Address ] [ Provider Security E-mail Address ] Security Notices to LEA (Required per Section 5.3) [ LEA Security Name ] [ LEA Security Role ] [ LEA Security Postal Address ] [ LEA Security E-mail Address ]

STANDARD CLAUSES

ARTICLE I: PURPOSE AND SCOPE

1.1 Purpose of DPA.

The purpose of this DPA is to describe the duties and responsibilities to protect Student Data including compliance with all applicable federal and state privacy laws, rules, and regulations, all as may be amended from time to time. In performing the Services, the Provider shall be considered a School Official with a legitimate educational interest, and performing Services otherwise provided by the LEA. With respect to its use and maintenance of Student Data, Provider shall be under the direct control and supervision of the LEA as set forth in this DPA and the Service Agreement.

1.2 Description of Products and Services.

A description of all products and services covered by the Agreement, and information specific to this DPA, are listed in Exhibit "A". If a Provider needs to update any information on Exhibit “A” (such as updating with new provided services), they may do so by completing the Addendum template provided by the A4L Community and sending a copy to the LEA.

Provider may add or delete products or services subject to this DPA under the following circumstances:

1. Deleted products or services: The products or services have been discontinued and are no longer available from the Provider.

2. Added products or services: The added products or services are either:

a. a direct replacement, or substantially equivalent to the original products or services listed in the DPA, or

b. the added products or services result in enriched new or enhanced capabilities, new modules, technology advancements and or service categories relating to the listed products or services that Provider did not have at the time the DPA was signed.

If an added product or service requires additional Data Elements, Provider must complete the relevant portion of the Addendum template to update Exhibit “B”.

Provider may not make any change to Exhibit “A” via an Addendum, except adding or deleting products or services. LEA is under no obligation to acquire added products or services, and has no ability under the DPA to prevent deletion of products or services. Subject to the limitations in this section, an Addendum is automatically incorporated into this DPA when LEA is notified by Provider, in accordance with the notification provisions of this DPA, of the Addendum’s existence and contents.

1.3 Student Data to Be Provided.

In order to perform the services, the Provider shall process Student Data as identified by the Provider in the Schedule of Data, attached hereto as Exhibit “B”. Student Data may be provided by the LEA or created by students, as set forth fully in the definition of Student Data in Exhibit “C”. If a Provider needs to update any information on Exhibit “B”, they may do so by completing the Addendum template provided by the A4L Community and sending a copy to the LEA.

Provider may delete data elements from Exhibit “B” if they are no longer used by the Provider.

Provider must add data elements to Exhibit “B”, when a material change has occurred, regardless of whether the added data elements are either one of the following:

1. used to better deliver the original products or services listed in the DPA, or

2. used to deliver added products or services that result in new or enhanced capabilities, new modules, technology advancements and or service categories relating to the listed products or services that Provider did not have at the time the DPA was signed. Such new products or services must be designated in the Addendum template as changes to Exhibit “A”.

The Provider must notify the LEA, in accordance with the notification provisions of this DPA, of the existence and contents of an Addendum modifying Exhibit “B”. The LEA will have thirty (30) days from receipt to object to the Addendum. If no written objection is received it will become incorporated into the DPA between the parties.

1.4 DPA Definitions.

Capitalized terms used in this DPA shall have the meanings set forth in Exhibit “C”. With respect to the treatment of Student Data, in the event of a conflict, definitions used in this DPA shall prevail over terms used in any other writing, including, but not limited to, the Service Agreement.

ARTICLE II: DATA OWNERSHIP AND AUTHORIZED ACCESS

2.1 Student Data Property of LEA.

As between LEA and Provider, all Student Data processed by the Provider, or created by students (as set forth fully in the definition of Student Data in Exhibit “C”), pursuant to the Agreement is and will continue to be the property of and under the control of the LEA. The Provider further acknowledges and agrees that all copies of such Student Data processed by the Provider, including any modifications or additions or any portion thereof from any source, are also subject to the provisions of this DPA in the same manner as the original Student Data. The Parties agree that as between them, all rights, including all intellectual property rights in and to Student Data contemplated per the Service Agreement, shall remain the exclusive property of the LEA.

2.2 Parent, Legal Guardian and Student Access.

The LEA shall establish reasonable procedures by which a parent, legal guardian, or eligible student (as defined in FERPA) may review Student Data and request deletion or modification, and request delivery of a copy of the Student Data. In support of this, the Provider shall establish reasonable procedures by which the LEA may access, and correct if necessary, Education Records and/or Student Data, and make a copy of the data available to the LEA or (at the LEA’s direction) to the parent, legal guardian or eligible student directly. If the LEA is not able to review or update the Student Data itself, Provider shall respond in a reasonably timely manner (and no later than thirty (30) days from the date of the request or pursuant to the time frame required under state law for an LEA to respond to a parent, legal guardian or student, whichever is sooner) to the LEA’s request for Student Data held by the Provider to view or correct as necessary.

In the event that a parent or legal guardian of a student or eligible student contacts the Provider to correct, delete, review or request delivery of a copy of any of the Student Data collected by or generated through the Services, the Provider shall refer that person to the LEA, who will follow the necessary and proper procedures regarding the requested information. In the event that any person other than those listed contacts the Provider about any Student Data, the Provider shall refer that person to the LEA, except as provided in Section 4.4.

Provider shall enter into a Subprocessor Agreement with all Subprocessors performing functions for the Provider in order for the Provider to provide the Services pursuant to the Service Agreement, whereby the Subprocessors agree to protect Student Data in a manner no less stringent than the terms of this DPA. Every Subprocessor Agreement must provide that the Subprocessor will not Sell the Student Data. The terms of a Subprocessor Agreement shall not be materially modified by the Subprocessor unless notice is provided to the Provider.

ARTICLE III: DUTIES OF LEA

3.1 Provide Data in Compliance with Applicable Laws.

LEA shall use the Services and provide Student Data in compliance with all applicable federal and state privacy laws, rules, and regulations, all as may be amended from time to time.

3.2 Annual Notification of Rights.

If the LEA has a policy of disclosing Education Records and/or Student Data under FERPA (34 CFR § 99.31(a)(1)), LEA shall include a specification of criteria for determining who constitutes a School Official and what constitutes a legitimate educational interest in its annual notification of rights.

3.3 Reasonable Precautions.

LEA shall employ administrative, physical, and technical safeguards designed to protect usernames, passwords, and any other means of gaining access to the Services and/or hosted Student Data from unauthorized access, disclosure, or acquisition by an unauthorized person.

3.4 Unauthorized Access Notification and Assistance.

LEA shall notify Provider within seventy-two (72) hours of any confirmed Data Breach to the Services, LEA’s account or any Student Data that poses a privacy or security risk. If requested by Provider, LEA will provide reasonable assistance to Provider in any efforts by Provider to investigate and respond to such Data Breach.

ARTICLE IV: DUTIES OF PROVIDER

4.1 Privacy and Security Compliance.

The Provider shall comply with all laws and regulations applicable to Provider’s protection of Student Data privacy and security, and at the direction of the LEA shall cooperate with any state or federal government initiated audit of the LEA’s use of the Services.

4.2 Authorized Use.

The Student Data processed pursuant to the Services shall be used by the Provider for no purpose other than performing the Services outlined in Exhibit “A”, or as instructed by the LEA.

4.3 Provider Employee Obligation.

Provider shall require all of Provider’s employees who have access to Student Data to comply with all applicable provisions of this DPA with respect to the Student Data shared under the Service Agreement. Provider agrees to require and maintain an appropriate confidentiality agreement from each employee with access to Student Data pursuant to the Service Agreement.

4.4 No Disclosure.

Provider acknowledges and agrees that it shall not sell or disclose any Student Data or any portion thereof, including without limitation, user content or other non-public information and/or personally identifiable information contained in the Student Data.

4.4.1 Exceptions to No Disclosure.

Provider agrees not to attempt to re-identify De-Identified Student Data without the written direction of the LEA. De-Identified Student Data may be used by the Provider for those purposes allowed under applicable laws, for the purposes allowed for the processing of Student Data under this DPA, as well as the following purposes: (1) assisting the LEA or other governmental agencies in conducting research and other studies; (2) research, development, and improvement of the Provider's educational sites, Services, or applications, and to demonstrate the effectiveness of the Services; and (3) for adaptive learning purpose and for customized student learning. Provider's use of De-Identified Student Data shall survive termination of this DPA or any request by LEA to return or dispose of Student Data. Except for Subprocessors, Provider agrees not to transfer De-identified Student Data to any third party unless the transfer is expressly directed or permitted by the LEA or this DPA. Such Subprocessors must be subject to equivalent terms of the DPA including this one. Prior to publishing any document that names the LEA, the Provider shall obtain the LEA’s written approval of the manner in which De-Identified Student Data is presented. If Provider chooses to create De-Identified Data, its process must comply with either NIST de-identification standards or US Department of Education guidance on de-identification.

4.6 Disposition of Data.

Upon written request from the LEA, Provider shall dispose of or provide a mechanism for the LEA to transfer Student Data obtained under the Service Agreement, within sixty (60) days of the date of said request and according to a schedule and procedure as the Parties may reasonably agree.

If the Provider has a standard retention and destruction schedule, that schedule shall apply to Student Data as long as this DPA is active. The Provider’s practice relating to retention and disposition of Student Data shall be provided to the LEA upon request.

At the termination of this DPA, the Provider shall, unless directed otherwise by the LEA, dispose of, or delete Student Data obtained by the Provider under the Agreement within sixty (60) days of termination (unless otherwise required by law). If the Agreement has lapsed or is not terminated, the Student Data shall be deleted when directed or permitted by the LEA, according to Provider’s standard destruction schedule, or as otherwise required by law. The LEA may provide the Provider with special instructions for the disposition of the Student Data, by transmitting to Provider Exhibit “D”, attached hereto. The duty of the Provider to dispose of or delete Student Data shall not extend to De-Identified Data or to Student-Generated Content that has been transferred or kept pursuant to Section 2.2.2.

4.7 Advertising Limits.

Provider is prohibited from using, disclosing, or selling Student Data to (a) inform, influence, or enable Targeted Advertising; (b) develop a profile of a student, family member/guardian or group, for any purpose other than providing the Service to LEA; or (c) for any commercial purpose other than to provide the Service to the LEA, or as authorized by the LEA or the parent/guardian. Targeted Advertising is strictly prohibited. However, this section does not prohibit Provider from using Student Data (i) for adaptive learning or customized student learning (including generating personalized learning recommendations); or (ii) to make product recommendations to account holders that are not considered Targeted Advertising (this exception does not apply where the Provider is relying on the LEA to provide consent on behalf of the parent under COPPA); or (iii) to notify account holders about new education product updates, features, or Services that are not considered Targeted Advertising or from otherwise using Student Data as permitted in this DPA and its accompanying exhibits.

Before making product recommendations under section (ii) above, Provider must disclose the existence of those recommendations to LEA in writing, in sufficient detail that LEA can fulfill any obligations under applicable law (e.g. PPRA).

ARTICLE V: DATA SECURITY AND BREACH PROVISIONS

5.1 Data Storage.

If Student Data is stored outside the United States, Provider will provide a list of Countries where data is stored, in Exhibit “B”.

5.2 Security Audits.

Provider will conduct a security audit or assessment no less than once per year, and upon a Data Breach. Upon 10 days’ notice and execution of confidentiality agreement, Provider will provide the LEA with a copy of the audit report, subject to reasonable and appropriate redaction.

5.3 Data Security.

The Provider agrees to utilize administrative, physical, and technical safeguards designed to protect Student Data from unauthorized access, disclosure, acquisition, destruction, use, or modification. The Provider shall adhere to any applicable law relating to data security of Student Data. The Provider shall implement an adequate Cybersecurity Framework that incorporates one or more of the nationally or internationally recognized standards set forth in Exhibit “F”. Additionally, Provider may choose to further detail its security programs and measures in Exhibit “F”. Provider shall provide, in the Preamble to the DPA, contact information of an employee who LEA may contact if there are any data security concerns or questions.

5.4 Data Breach.

In the event that Provider confirms a Data Breach, the Provider shall provide notification to LEA within seventy-two (72) hours of confirmation of the Data Breach, unless notification within these time limits would disrupt investigation of the Data Breach by law enforcement. In such an event, notification shall be made within a reasonable time after the Data Breach. Provider shall follow the following process:

CONTRACT TERMS

Term and Termination. In the event that either Party seeks to terminate this DPA, they may do so by written notice if the Service Agreement has lapsed or has been terminated. Either party may terminate this DPA and any Service Agreement or contract if the other party breaches any terms of this DPA. This DPA shall stay in effect for as long as the Provider retains the Student Data, as set forth in section Article IV, Section 4.6. In the case of a “Change of Control” the LEA has the authority to terminate the DPA if it reasonably believes that the successor cannot uphold the terms and conditions herein or having a contract with the successor would violate the LEA’s policies or state or federal law.

Data Disposition on Service Agreement Termination. If the Service Agreement is terminated, the Provider shall dispose of all of LEA’s Student Data pursuant to Article IV, Section 4.6 of the Standard Clauses.

Notices. All notices or other communication required or permitted to be given hereunder must be made in writing and may be given via e-mail transmission, or first-class mail, or mutually agreed upon method sent to the designated representatives documented in the Preamble.

Priority of Agreements. This DPA shall govern the treatment of Student Data in order to comply with the privacy protections, including those found in FERPA and all applicable privacy statutes identified in this DPA. With respect to the treatment of Student Data only, in the event there is conflict between the terms of the DPA and the Service Agreement, Terms of Service, Privacy Policies, or with any other bid/RFP, license agreement, or writing, the terms of this DPA shall apply and take precedence. In the event of a conflict between Exhibit “H”, the SDPC Standard Clauses, and/or the Supplemental State Terms in Exhibit “G”, Exhibit “H” will control, followed by Exhibit “G”. Except as described in this paragraph herein, all other provisions of the Service Agreement shall remain in effect.

Entire Agreement. This DPA and the Service Agreement (“the Agreement”) constitute the entire agreement of the Parties relating to the subject matter hereof and supersedes all prior communications, representations, or agreements, oral or written, by the Parties relating thereto. This DPA may be amended and the observance of any provision of this DPA may be waived (either generally or in any particular instance and either retroactively or prospectively) only with the signed written consent of both Parties.

Severability. Any provision of this DPA that is prohibited or unenforceable in any jurisdiction shall, as to such jurisdiction, be ineffective to the extent of such prohibition or unenforceability without invalidating the remaining provisions of this DPA, and any such prohibition or unenforceability in any jurisdiction shall not invalidate or render unenforceable such provision in any other jurisdiction. Notwithstanding the foregoing, if such provision could be more narrowly drawn so as not to be prohibited or unenforceable in such jurisdiction while, at the same time, maintaining the intent of the Parties, it shall, as to such jurisdiction, be so narrowly drawn without invalidating the remaining provisions of this DPA or affecting the validity or enforceability of such provision in any other jurisdiction.

Governing Law; Venue and Jurisdiction. This DPA will be governed by and construed in accordance with the laws of the state of the LEA, without regard to conflicts of law principles. Each party consents and submits to the sole and exclusive jurisdiction to the state and federal courts for the county of the LEA for any dispute arising out of or relating to this DPA or the transactions contemplated hereby.

Successors Bound. This DPA is and shall be binding upon the respective successors in interest to Provider in the event of a Change of Control. In the event of a Change of Control, the Provider shall provide written notice to the LEA no later than sixty (60) days after the closing date of such Change of Control. Such notice shall include a written, signed assurance that the successor will assume the obligations of the DPA and any obligations with respect to Student Data within the Service Agreement.

Authority. Each signatory confirms they are authorized to bind their institution to this DPA in its entirety.

Waiver. No delay or omission by either party to exercise any right here under shall be construed as a waiver of any such right and both parties reserve the right to exercise any such right from time to time, as often as may be deemed expedient.

EXHIBIT A: PRODUCTS AND SERVICES

This DPA covers access to and use of [ Provider Name ]'s existing Services that collect, process, or transmit Student Data, as identified below:

EXHIBIT B: SCHEDULE OF STUDENT DATA

All Data Elements identified in this Exhibit are correct at time of signature.

Data Elements Collected by Product (required and optional):

Category of Data / Data Elements

Application Technology MetaData

IP Addresses of users, use of cookies, etc.

Other application technology metadata

If ‘Other’ checked, please specify below checked box:

Application Use Statistics

Meta data on user interaction with application

Assessment

Standardized test scores

Observation data

Voice recordings

Other assessment data

If ‘Other’ checked, please specify below checked box:

Attendance

Student school (daily) attendance data

Student class attendance data

Communication

Online communication captured (emails, blog entries)

Conduct

Conduct or behavioral data

Demographics

Data of birth

Place of birth

Gender

Ethnicity or race

Language information (native, or primary language spoken by student)

Other demographic information

If ‘Other’ checked, please specify below checked box:

Enrollment

Student school enrollment

Student grade level

Homeroom

Guidance counselor

Specific curriculum programs

Year of graduation

Other enrollment information

If ‘Other’ checked, please specify below checked box:

Parent/Guardian Contact Information

Address

Email

Phone

Parent/Guardian ID

Parent ID number (created to link parents to students)

Parent/Guardian Name

First and/or last

Schedule

Student scheduled courses

Teacher names

Special Indicator

English language learner information

Low-income status

Medical alerts/health data

Student disability information

Specialized education Services (IEP or 504)

Living situations (homeless/foster care)

Other indicator information

If ‘Other’ checked, please specify below checked box:

Student Contact Information

Address

Email

Phone

Student Identifiers

Local (school district) ID number

State ID number

Provider/app assigned student ID number

Student app username

Student app passwords

Student Name

First and/or last

Student In App Performance

Program/application performance (e.g. typing program – student types 60 wpm, reading program – student reads below grade level)

Student Program Membership

Academic or extracurricular activities a student may belong to or participate in

Student Survey Responses

Student responses to surveys or questionnaires

Student Work

Student generated content; writing, pictures, etc.

Other student work data

If ‘Other’ checked, please specify below checked box:

Transcript

Student course grades

Student course data

Student course grades/performance scores

Other transcript data

If ‘Other’ checked, please specify below checked box:

Transportation

Student bus assignment

Student pick up and/or drop off location

Student bus card ID number

Other transportation data

If ‘Other’ checked, please specify below checked box:

Other

Other data collected

If ‘Other’ checked, please list each additional data element used, stored, or collected by your application below checked box:

None

No student data collected at this time. Provider will immediately notify LEA if this designation is no longer applicable.

If Student Data is stored outside the United States, Provider shall list below the Countries where data is stored:

EXHIBIT C: DEFINITIONS

Change of Control: Any merger, acquisition, consolidation or other business reorganization or sale of all or substantially all of the assets of Provider or of the portion of Provider that performs the Services in the Service Agreement.

Contextual Advertising: Contextual advertising is the delivery of advertisements based upon a current visit to a Web page or a single search query, without the collection and retention of data about the consumer’s online activities over time.

De-Identified Data: Records and information are considered to be De-Identified when all personally identifiable information has been removed or obscured, such that the remaining information does not reasonably identify a specific student, including, but not limited to, any information that, alone or in combination is linkable to a specific student.

Data Breach: An unauthorized release, access to, disclosure or acquisition of Student Data that compromises the security, confidentiality or integrity of the Student Data maintained by the Provider in violation of applicable state or federal law.

Educational Records: Educational Records shall have the meaning set forth under FERPA 20 U.S. C. 12 32 g(a)(5)(A). For additional context see also the ‘Student Data’ definition.

LEA: For the purpose of this DPA, the LEA is the educational entity that is a Party to this Agreement. An LEA can be a state agency, an educational service agency, a charter school or school system or a private school or school system, in addition to the federal definition of Local Education Agency (LEA).

Metadata: Means information that provides meaning and context to other data being collected including, but not limited to date and time records and purpose of creation. Metadata that have been stripped of all direct and indirect identifiers are not considered Personally Identifiable Information or Student Data.

Originating LEA: An educational entity otherwise meeting the definition of LEA that originally executes the DPA in its entirety (including the marked checkbox enabling Exhibit “E”) with the Provider.

School Official: For the purposes of this DPA and pursuant to FERPA 34 CFR § 99.31(b), a School Official is a contractor that: (1) Performs an institutional service or function for which the agency or institution would otherwise use employees; (2) Is under the direct control of the agency or institution with respect to the use and maintenance of Student Data including Educational Records; and (3) Is subject to FERPA 34 CFR § 99.33(a) governing the use and re-disclosure of Personally Identifiable Information from Educational Records.

Service Agreement: Refers to the quote, corresponding contract, purchase order or terms of service and/or terms of use.

Student Data: Student Data includes any data, whether gathered, created or inferred by Provider or provided by LEA or its users, students, or students’ parents/guardians, for a school purpose, that is descriptive of the student including, but not limited to, information in the student’s Educational Record, persistent unique identifiers, or any other information or identification number that would provide information about a specific student. Student Data includes Metadata that has not been stripped of all direct and indirect identifiers. Student Data further includes “Personally Identifiable Information (PII),” as defined in 34 C.F.R. § 99.3 and as defined under any applicable state law. Student Data shall constitute Education Records for the purposes of this DPA, and for the purposes of federal, state, and local laws and regulations. Student Data as specified in Exhibit “B” is confirmed to be collected or processed by the Provider pursuant to the Services. Student Data shall not include properly De- Identified Data or anonymous usage data regarding a student’s or LEA’s use of Provider’s Services.

Student Generated Content: The term “Student Generated Content” means materials or content created by a student in the services including, but not limited to, essays, research reports, portfolios, creative writing, music or other audio files, photographs, videos, and account information that enables ongoing ownership of student content. “Student Generated Content” does not include student responses to a standardized assessment where student possession and control would jeopardize the validity and reliability of that assessment.

Subprocessor: For the purposes of this DPA, the term “Subprocessor” (sometimes referred to as the “Subcontractor”) means a party other than LEA or Provider, who Provider uses for data collection, analytics, storage, or other service to operate and/or improve its service, and who has access to or storage of Student Data, including security, storage, analytics, and other processing activities necessary to perform a Provider business purpose.

Subprocessor Agreement: An agreement between Provider and a third party Subprocessor. A Subprocessor Agreement includes either a written agreement or an acceptance of terms and conditions (e.g., click through agreements).

Subscribing LEA: An educational entity otherwise meeting the definition of LEA that was not party to the original Service Agreement and who accepts the Provider’s General Offer of Privacy Terms by executing Exhibit “E”.

Targeted Advertising: Targeted Advertising means presenting an advertisement to a student where the selection of the advertisement is based on Student Data or inferred over time from the usage of the Provider Internet web site, online service or mobile application by such student or the retention of such student's online activities or requests over time for the purpose of targeting subsequent advertisements. "Targeted Advertising" does not include Contextual Advertising.

EXHIBIT D: SPECIAL INSTRUCTIONS FOR DISPOSITION OF DATA

After this DPA takes effect, if the LEA has special requirements for the disposition of Student Data that are not expressed in 4.6 Disposition of Data, the LEA may fill in this form and deliver it to the Provider.

The Provider and the LEA must not fill in this form at the initiation of the DPA.

The Provider shall act on Exhibit “D” from the designated representative of the LEA or their designee (Preamble or Exhibit “E” for Subscribing LEA).

[Insert Name of District or LEA] (“LEA”) instructs Provider to dispose of Student Data obtained by Provider pursuant to the terms of the DPA between LEA and Provider. The terms of the Disposition are set forth below:

1. Extent of Disposition [ ] Disposition is partial. The scope of Student Data to be disposed of is set forth below or found in an attachment to this Directive:

[Insert categories of Student Data here] [ ] Disposition is complete. Disposition extends to all Student Data.

2. Nature of Disposition

[Insert or attach special instructions]

3. Timing of Disposition Student Data shall be disposed of by the following date:

4. De-Identified Data [ ] The Provider certifies that they have De-Identified the data, as defined elsewhere in this Agreement, and disposed of all copies of Student Data that were not De-Identified in accordance with this Schedule and the DPA. The Provider will notify LEA in accordance with the notification requirements of the DPA using this form.

As of [Insert Date]

5. Other:

Signature(s)

Notice of Verified Disposition of Data

Authorized Representative of LEA

Date

Authorized Representative of Provider

Date

EXHIBIT E: GENERAL OFFERS OF TERMS

Page 1 of 2: OFFER OF TERMS Provider and the Subscribing LEA (named below) agree by signing this General Offer of Privacy Terms (“General Offer”) that they are bound by the same terms as the DPA between Provider and ________________________________________________ (“Originating LEA”) dated _______________.

Provider and Subscribing LEA agree that the information below will be replaced throughout the DPA with the information specific to the Subscribing LEA filled in below for the Subscribing LEA. This General Offer shall extend only to the terms set forth in this DPA and shall not necessarily bind Provider or Subscribing LEA to any other terms entered into between Provider and Originating LEA. Any commercial terms, such as price, term, or schedule of Services, relating to Subscribing LEA’s use of the Provider’s Services shall be determined solely between Provider and Subscribing LEA.

If Provider makes changes to Exhibit “A” or Exhibit “B” in accordance with sections 1.2 and 1.3 respectively, Provider must complete the Addendum template provided by the A4L Community and notify the Originating LEA and all Subscribing LEAs in accordance with the notification provisions of this DPA, of the Addendum’s existence and contents. With regard to a Subscribing LEA, an Addendum is automatically incorporated into this DPA when Subscribing LEA is notified by Provider. If an Addendum modifies Exhibit “B”, the LEA will have thirty (30) days from receipt to object. If no written objection is received it will become incorporated into the DPA between the parties.

The Provider may withdraw the General Offer (for future use or for LEAs that have not already accepted it) in the event of: (1) a material change in the applicable privacy statutes; or (2) a material change in the Services and products listed in the Service Agreement. Notification of a withdrawal shall be submitted to ndpa_requests@A4L.org.

Subscribing LEAs shall send the signed Exhibit “E” to Provider at the following email address: _______________________________________________ The below signatory confirms they are authorized to bind their institution to this DPA as in its entirety.

RESOURCE NAME(S):

[ Insert all Resource Names covered by Originating DPA ]

PROVIDER: [ Insert Name of Provider ] Signed By:

Date:

Printed Name:

Title/Position:

Exhibit “E” (continued) Originating LEA: _______________________________________________ Resource Names: ______________________________________________ Provider Name: ________________________________________________ Page 2 of 2: [INSERT NAME] “SUBSCRIBING LEA” A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the Originating LEA and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER.** Please note, by signing this Exhibit you are also agreeing to any language that may be included in Exhibits to the Originating DPA beyond this Exhibit “E”. The below signatory confirms they are authorized to bind their institution to this DPA as in its entirety.

Subscribing LEA: [Insert Name of Subscribing LEA] Signed By:

Date:

Printed Name:

Title/Position:

School District Name:

Designated Representative of LEA:

Name:

Title:

Address:

Telephone:

Email:

Notices to Subscribing LEA: The Provider and Subscribing LEA are each responsible to promptly notify the other Party of changes to the notice information.

Security Notices to Subscribing LEA [ Subscribing LEA Security Name ] [ Subscribing LEA Security Role ] [ Subscribing LEA Security Postal Address ] [ Subscribing LEA Security E-mail Address ]

[ Subscribing LEA Name ] [ Subscribing LEA Role ] [ Subscribing LEA Postal Address ] [ Subscribing LEA E-mail Address ] With a copy to (if provided):

[ Subscribing LEA Legal Counsel ] [ Subscribing LEA Legal Counsel Postal Address ] [ Subscribing LEA Legal Counsel E-mail Address ]

EXHIBIT F: ADEQUATE CYBERSECURITY FRAMEWORKS

Provider must mark one or more frameworks with which it complies.

The Provider may change which framework it complies with without invalidating or changing the DPA, but must notify the LEA of such change in accordance with the notification requirements of the DPA.

FRAMEWORK(S)

Global Education Security Standard - https://sdpc.a4l.org/gess/

NIST Cybersecurity Framework (CSF)

NIST SP 800-53 Security and Privacy Controls for Information systems and organizations

NIST SP 800-171 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

ISO 27000 series, Standards for implementing organization security and management practices

CIS Center for Internet Security Critical Security Controls

Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR)

This space is provided for optional security programs and measures as noted in section 5.3:

EXHIBIT G: Supplemental SDPC State Terms for Virginia LEA and Provider agree to the following additional or replacement terms and modifications to the DPA:

1. Replacement of Terms. The parties intend for this DPA to apply to all Personally Identifiable Information provided to Provider by or on behalf of LEA or is otherwise generated through use of the Services, including but not limited to employee PII and Student Data, as applicable under the circumstances. To that end, except as set forth in the provisions identified in (a) through (d) below or otherwise expressly provided herein, all references to the term “Student Data” in the DPA and in Exhibits A through F shall be deemed to be replaced with the term “Division Data,” as such term is defined in Section 2(a) below.

References to the term “Student Data” in the following Sections of the DPA and the above-referenced Exhibits shall remain unaffected by the foregoing change:

a. Section 2.2;

b. Section 3.2;

c. Exhibit B, provided that Provider shall list all types or categories of employee-related data collected or processed as part of the Services under the item “Other data collected;” and

d. The definitions of “Educational Records,” “School Official,” and “Student Data” in Exhibit, all of which shall be retained in their original form.

2. Amendments to Defined Terms on Exhibit C.

a. The following new definition is hereby added to Exhibit C of the DPA:

Division Data. Division Data means and includes all business, employment, operational and Personally Identifiable Information that LEA provides to Provider or is generated by the Service, and that is not intentionally made generally available by LEA on public websites or publications, including but not limited to business, administrative and financial data, intellectual property, and student, employee, and personnel data and records, user-generated content (including Student-Generated Content) and metadata, but specifically excludes properly De-Identified Data, anonymous usage data, and Provider data.

b. The definition of “De-Identified Data” on Exhibit C is amended as follows to replace the final term “student” with the term “individual:”

De-Identified Data: Records and information are considered to be De-Identified when all personally identifiable information has been removed or obscured, such that the remaining information does not reasonably identify a specific student, including, but not limited to, any information that, alone or in combination is linkable to a specific individual.

3. .Amendments to the DPA.

a. Section 1.1. Section 1.1 of the DPA is amended to clarify that Provider’s designation as a School Official applies in the event that LEA provides Student Data to Provider under the Service Agreement. To that end, Section 1.1 is hereby revised to read in its entirety as follows:

The purpose of this DPA is to describe the duties and responsibilities to protect Division Data, including compliance with all applicable federal and state privacy laws, rules, and regulations, all as may be amended from time to time. In the event that Personally Identifiable Information from Student Data is transmitted to Provider from LEA during performance of the Services, the Provider shall be considered a School Official with a legitimate educational interest, and performing services otherwise provided by the LEA. With respect to its use and maintenance of Student Data, Provider shall be under the direct control and supervision of the LEA as set forth in this DPA. Provider shall be bound by the terms of this DPA for so long as Provider maintains any Division Data.

b. Section 1.3. The second sentence of Section 1.3 of the DPA is revised to read as follows:

Division Data (including Student Data) may be provided by the LEA or created by students or other LEA users, as set forth fully in the definitions of Division Data, Student Data, and Student-Generated Content in Exhibit “C,” as amended by Exhibit “G.”

In addition, the second paragraph of Section 1.3 is revised to read as follows:

Provider may delete data elements from Exhibit “B” upon providing notice to the LEA in accordance with Exhibit “D.”

c. Section 4.1. Section 4.1 is revised to read as follows:

The Provider shall comply with all laws and regulations applicable to Provider’s protection of Division Data privacy and security, and at the direction of the LEA, shall cooperate with any state or federal government, or any LEA initiated audit of the LEA’s use of the Services.

d. Section 4.5. The second sentence of Section 4.5 is revised to read as follows:

Provider agrees not to transfer de-identified Student Data to any third party unless the transfer is expressly directed or permitted by the LEA or this DPA and the third party agrees in writing not to attempt re-identification.

e. The Provider’s written practice or policy relating to retention and disposition of Student Data and other types of Personally Identifiable Data shall be provided to the LEA upon request. Disposition will include (1) the shredding of any hard copies of any Division Data, (2) erasing, or (3) otherwise modifying the personal information in those records to make it unreadable or indecipherable by human or digital means.