# Data Processing Agreement (DPA)

### Student Data Privacy — COPPA & FERPA Aligned

> **Template notice.** This is a starting template, not legal advice. Have it
> reviewed by qualified legal counsel before you send or sign it. Replace every
> `[BRACKETED]` placeholder. You can open and edit this file directly, or paste
> it into Google Docs / Microsoft Word and export a PDF for signing.

---

This Data Processing Agreement (the "Agreement") is entered into as of
**[EFFECTIVE DATE]** by and between:

- **Provider:** [YOUR LEGAL COMPANY NAME], operator of the [PRODUCT NAME]
  math-learning platform ("Provider," "we," "us"); and
- **School District / Educational Agency:** **[DISTRICT LEGAL NAME]**, located at
  **[DISTRICT ADDRESS]** ("District," "you").

Provider and District are each a "Party" and together the "Parties."

---

## 1. Purpose and Roles

1.1 The District uses the Provider platform to deliver adaptive mathematics
instruction to students in Kindergarten through Grade 12.

1.2 With respect to **student education records**, the District is the entity
that controls the data. The Provider acts as a **"school official"** performing an
institutional service under the Family Educational Rights and Privacy Act
("FERPA", 20 U.S.C. § 1232g; 34 CFR Part 99), under the District's direct control.

1.3 With respect to students under 13, the District provides consent on behalf of
parents for the collection and use of student personal information **for
educational purposes only**, consistent with the Children's Online Privacy
Protection Act ("COPPA", 15 U.S.C. §§ 6501–6506; 16 CFR Part 312). The Provider
relies on this school-based consent and does not use student data for any
commercial purpose.

## 2. Definitions

- **Student Data** — any information collected through the platform that relates
  to an identifiable student, including a first name, display name, grade level,
  and learning activity (attempts, mastery, progress).
- **Education Record** — Student Data that constitutes an "education record" under
  FERPA.
- **De-identified Data** — data from which all personally identifiable information
  has been removed such that it cannot reasonably identify a student.

## 3. Data the Provider Collects

3.1 The platform is designed for **data minimization**. For a student the Provider
stores only:

- first name and a display name (the display name is shown on leaderboards);
- grade level;
- learning activity (exercise attempts, mastery scores, progress); and
- for a family self-serve account, the **parent/guardian/tutor email** used to
  create and manage the account — never the child's own email.

3.2 The Provider does **not** knowingly collect a student's last name, home
address, phone number, date of birth (a date of birth is used transiently at
sign-up to determine age and is not stored), or precise geolocation.

## 4. Use and Disclosure

4.1 The Provider will use Student Data **only** to provide and improve the
educational service for the District, and for no other purpose.

4.2 The Provider will **not**:

- sell, rent, or trade Student Data;
- use Student Data for targeted advertising to students;
- build a personal profile of a student except in furtherance of the educational
  purpose; or
- disclose Student Data to third parties except to subprocessors under Section 7,
  or as required by law.

4.3 Ownership of Student Data remains with the District and, as applicable, the
student and their parent/guardian.

## 5. Security

5.1 The Provider maintains administrative, physical, and technical safeguards
appropriate to the sensitivity of Student Data, including:

- encryption of data in transit (TLS);
- row-level access controls so a user can access only their own records;
- restriction of privileged access to authorized personnel; and
- use of a reputable cloud infrastructure and managed database provider.

5.2 **Data Breach.** The Provider will notify the District without undue delay,
and no later than **[NUMBER]** business days, after confirming a breach affecting
Student Data, and will cooperate with the District's notification obligations.

## 6. Data Retention and Deletion

6.1 **Active accounts.** Student Data is retained while the account is active and
in use by the District.

6.2 **Inactive accounts.** Student accounts with no sign-in activity for
**24 months** are automatically deleted.

6.3 **Support chat transcripts.** Support chat conversations are automatically
purged **90 days** after they are closed.

6.4 **On request / termination.** Upon the District's written request, or within
**[NUMBER]** days of termination of this Agreement, the Provider will delete or
return all Student Data and direct any subprocessor to do the same, except
de-identified data and data the Provider must retain by law.

6.5 **Self-service deletion.** Parents/guardians managing a family account may
permanently delete the account and all associated Student Data at any time from
within the platform. Records owned by the District (students enrolled in a
District class) are deleted by the District rather than by the student.

## 7. Subprocessors

7.1 The Provider may use vetted third-party subprocessors (for example, cloud
hosting, database, email delivery, and payment processing) to operate the
service. A current list is published at **[PRODUCT URL]/subprocessors** and is
available on request.

7.2 The Provider remains responsible for its subprocessors' compliance with this
Agreement and will bind them to substantially similar obligations.

## 8. Parent and Student Rights

8.1 The Provider will support the District in responding to requests from parents,
guardians, or eligible students to **review, correct, or delete** Student Data, as
required by FERPA and applicable state law.

## 9. Term and Termination

9.1 This Agreement takes effect on the Effective Date and continues while the
District uses the platform.

9.2 Either Party may terminate for material breach not cured within **[NUMBER]**
days of written notice. Section 6 (Retention and Deletion) survives termination.

## 10. General

10.1 This Agreement is governed by the laws of **[STATE / PROVINCE]**, without
regard to conflict-of-laws rules.

10.2 If any provision conflicts with FERPA, COPPA, or applicable state student-
privacy law, the statutory requirement controls.

---

## Signatures

**Provider — [YOUR LEGAL COMPANY NAME]**

- Signature: ______________________________
- Name: **[NAME]**
- Title: **[TITLE]**
- Date: **[DATE]**

**School District — [DISTRICT LEGAL NAME]**

- Signature: ______________________________
- Name: **[NAME]**
- Title: **[TITLE]**
- Date: **[DATE]**