DATA PROCESSING AGREEMENT (DPA)

1. Purpose

Provider processes Student Data solely to provide the Service as directed by the School.

Provider acts as a School Official with a legitimate educational interest under FERPA.

2. Legal Compliance

Provider complies with:

• FERPA
• COPPA
• Applicable U.S. state student data privacy laws

For students under 13, the School provides consent under COPPA's school-consent exception.

3. Data Ownership

• Student Data remains the property of the Student and/or the School
• Provider does not claim ownership of Student Data

4. Use Limitations

Provider shall not:

• Sell or rent Student Data
• Use Student Data for advertising or marketing
• Create behavioral profiles of students
• Use Student Data to train artificial intelligence or machine-learning systems

5. Subprocessors

Provider may engage subprocessors solely to operate the Service and requires them to meet equivalent data protection obligations.

6. Data Security

Provider implements reasonable administrative, technical, and physical safeguards to protect Student Data.

All Student Data is stored in the United States.

7. Retention and Deletion

• Student Data is retained only as necessary to provide the Service
• Schools may request deletion at any time
• Data will be deleted or returned upon request, subject to legal obligations

8. Access and Correction

Provider will assist the School in accessing, correcting, or deleting Student Data upon request.

9. Data Breach Notification

Provider will promptly notify the School of any data security incident involving Student Data and cooperate in reasonable remediation efforts.

10. Term

This Agreement remains in effect for the duration of the School's use of the Service.

11. Contact Information

Quackenworth Inc.
info@quackenworth.com