# Canadian School Data Privacy Agreement

### Canada — Student Data Privacy Agreement (PIPEDA / Law 25 / provincial PIPA)

> **Template notice.** This is a starting template, not legal advice. Have it
> reviewed by qualified Canadian counsel before signing. Replace every
> `[BRACKETED]` placeholder. It is designed to sit alongside — not replace — any
> provincial or board-mandated agreement your school already uses.

---

This Student Data Privacy Agreement (the "Agreement") is entered into as of
**[EFFECTIVE DATE]** between:

- **Service Provider:** **[YOUR LEGAL COMPANY NAME]**, operator of the
  **[PRODUCT NAME]** math-learning platform ("Provider," "we," "us"); and
- **Educational Institution:** **[SCHOOL / BOARD LEGAL NAME]** (the "School").

The School engages the Provider to deliver adaptive mathematics instruction to
its students. This Agreement establishes the privacy relationship required by
Canadian law.

---

## 1. Roles and Purpose

1.1 The School determines the purposes for which student personal information is
processed and remains accountable to students and parents/guardians. The
Provider acts as the School's **service provider**, processing student personal
information solely to deliver and support the platform under the School's
direction.

1.2 The Provider does not use student personal information for its own purposes,
including advertising or building non-educational profiles.

## 2. Consent and Authority (Law 25; provincial requirements)

2.1 The School represents that it has the authority, and has obtained or
coordinated any parental consent required by applicable law (including consent
from a person with parental authority for students **under 14** in Québec), to
provide student information to the Provider for educational purposes.

2.2 Where the School relies on a "school authority" or educational-mandate basis
in place of individual parental consent, it confirms that basis is valid under
its governing provincial legislation.

## 3. Data Collected (Minimization)

3.1 The Provider collects only: student **first name or nickname**, display
name, grade level, and learning activity (attempts, mastery, progress). It does
**not** collect students' full legal names, home addresses, phone numbers, or
exact dates of birth (only birth month and year, transiently, to set the consent
age).

3.2 The School will not upload or transmit sensitive personal information beyond
what the platform requires.

## 4. Ownership and Use

4.1 As between the parties, student personal information remains under the
control of the **School** (and the students/parents it serves). The Provider
claims no ownership and will use the information only as this Agreement permits.

## 5. Disclosure and Subprocessors

5.1 The Provider will not disclose student personal information except to its
vetted service providers listed at **[PRODUCT URL]/subprocessors**, each bound to
comparable protections, or as required by law.

5.2 If compelled by law to disclose student information, the Provider will,
where legally permitted, notify the School first.

## 6. Cross-Border Processing

6.1 Student personal information may be processed or stored **outside Canada**,
including in the United States and the European Union. The Provider has
conducted the privacy impact assessment required by Québec Law 25 for such
transfers and applies contractual and technical safeguards. The School
acknowledges this location of processing.

## 7. Security

The Provider maintains encryption in transit (TLS) and at rest via a managed
database, row-level access controls scoping each user to their own records,
least-privilege administrative access, rate limiting, and automated bot
protection on authentication.

## 8. Data Subject Requests

8.1 Students and parents/guardians may access, correct, or delete student
information through the School. The Provider gives the School self-service export
and deletion tooling and assists with requests it cannot fulfil directly.

## 9. Retention and Deletion

9.1 The Provider retains active-account data while in use; deletes inactive
student accounts after **24 months**; and deletes support-chat transcripts
**90 days** after the last message. On the School's request or on termination,
the Provider will delete or return student personal information within
**[NUMBER]** days and direct its subprocessors to do the same, except where
retention is required by law.

## 10. Confidentiality Incidents (Breach)

10.1 The Provider will notify the School **without undue delay** and no later
than **[NUMBER, e.g. 48] hours** after becoming aware of a confidentiality
incident involving student personal information, with enough information for the
School to meet its obligations to the Commission d'accès à l'information (Québec)
and/or the Office of the Privacy Commissioner of Canada, and to affected
individuals. See the Breach-Response Runbook.

## 11. Term and Termination

11.1 This Agreement remains in effect for the term of the services. On
termination, Section 9 governs the disposition of student personal information.

## 12. Governing Law

12.1 This Agreement is governed by the laws of the Province of **[PROVINCE]** and
the federal laws of Canada applicable therein.

---

## Signatures

**Service Provider — [YOUR LEGAL COMPANY NAME]**

- Signature: ______________________________
- Name: **[NAME]**  · Title: **[TITLE]**  · Date: **[DATE]**

**Educational Institution — [SCHOOL / BOARD LEGAL NAME]**

- Signature: ______________________________
- Name: **[NAME]**  · Title: **[TITLE]**  · Date: **[DATE]**