School Student Data Privacy Addendum

1. Parties and Scope

This School Student Data Privacy Addendum ("Addendum") is between EduOnTrack LLC ("EduOnTrack") and the school, district, local educational agency, or other educational organization identified in the document incorporating this Addendum ("Customer"). It applies to School Data processed through DeviceOnTrack or ClassOnTrack for Customer.

2. Definitions

• School Data means information Customer submits to, generates in, or directs EduOnTrack to process through a covered service, including education-record information, classroom information, managed-device information, and related administrator records.
• Student Data means School Data directly related or reasonably linkable to a current or former student, including information that may constitute personally identifiable information from education records or children's personal information.
• Security Incident means confirmed unauthorized acquisition of, access to, use of, disclosure of, alteration of, or material loss of School Data in EduOnTrack's custody or control. It does not include unsuccessful attempts that do not compromise School Data or acquisition of encrypted data when the applicable keys, credentials, and other means of access were not compromised and the data is reasonably believed to remain inaccessible.
• Services means the DeviceOnTrack or ClassOnTrack products identified in Customer's order form or written agreement.
• Subprocessor means a third party engaged by EduOnTrack to process School Data on EduOnTrack's behalf when providing the Services.

3. Ownership, Control, and Instructions

As between the parties, Customer owns and controls School Data. EduOnTrack acquires no ownership interest in School Data. Customer exercises direct control over its use and maintenance through the order form, this Addendum, service settings, authorized-administrator actions, and documented support or deletion instructions.

EduOnTrack will process School Data only to provide, secure, support, and maintain the Services; follow Customer's documented instructions; prevent or investigate misuse; comply with law; and perform obligations expressly stated in the agreement. EduOnTrack will notify Customer if an instruction cannot be followed or would, in EduOnTrack's reasonable view, violate applicable law.

4. FERPA

To the extent Customer discloses education records under FERPA's school official exception, Customer designates EduOnTrack as performing an institutional service or function for which Customer would otherwise use its own employees. EduOnTrack will remain under Customer's direct control regarding the use and maintenance of those records, use them only for the purpose for which they were disclosed, and comply with applicable FERPA use and redisclosure restrictions. Customer determines whether its annual FERPA notice and school-official criteria cover the deployment.

5. COPPA and Children Under 13

Where legally permitted, Customer may authorize EduOnTrack's collection of children's personal information on behalf of parents for the school-authorized educational or device-management purpose described in the agreement. EduOnTrack will provide Customer with notice of the information collected, how it is used, how it is disclosed, and the applicable retention schedule.

EduOnTrack remains responsible for every COPPA obligation that applies to it as an operator and does not transfer that responsibility to Customer, teachers, parents, or students. School authorization does not permit EduOnTrack to use children's information for an unrelated commercial purpose. Upon a verified request, Customer may review or request correction or deletion of a child's information and may direct EduOnTrack to stop further collection.

6. Prohibited Uses

EduOnTrack will not:

• Sell or rent School Data or Student Data.
• Use Student Data for targeted or behavioral advertising.
• Build a student profile for an unrelated commercial purpose.
• Use Student Data, education records, classroom activity, managed-device data, or precise student-linked location to train an artificial-intelligence or machine-learning model.
• Use School Data for marketing to students or parents.
• Disclose School Data except to authorized Customer users, approved Subprocessors, as Customer directs, to address a Security Incident, or as legally required.
• Attempt to reidentify information that Customer and EduOnTrack have agreed is de-identified.

7. Data Minimization and Product Limits

EduOnTrack will limit collection to information reasonably needed for the selected Services and settings. ClassOnTrack is not designed to collect student dates of birth, home addresses, grades, government identifiers, keystrokes, passwords, messages, files, camera audio, microphone audio, or general browsing history outside an active classroom workflow. DeviceOnTrack is not designed to collect browsing history, page content, classroom work, grades, messages, documents, screenshots, camera or microphone content, keystrokes, passwords, or biometric identifiers.

8. Authorized Access and Confidentiality

EduOnTrack will limit access to School Data to personnel and Subprocessors who need it to provide, secure, support, or maintain the Services. Personnel with such access must be subject to confidentiality obligations and may not use School Data for another purpose. Customer is responsible for its own account approvals, administrator roles, join-code distribution, managed deployment, and credential security.

9. Security Measures

EduOnTrack will maintain reasonable administrative, technical, and organizational measures appropriate to the nature of School Data. Current measures include encrypted network transport, authenticated administrative access, organization and role scoping, private snapshot storage, row-level or server-side authorization, signed and scoped device or extension credentials, rate limiting, audit or operational logs, secret management, dependency and build checks, configurable support access where available, and retention and deletion controls. The current public Security Overview provides additional detail without expanding this contractual standard.

10. Security Incident Response

EduOnTrack will promptly investigate a suspected Security Incident; take reasonable steps to contain and remediate it; preserve reasonably available evidence; and document corrective action. EduOnTrack will notify affected Customer contacts without unreasonable delay after confirming an incident involving Customer's School Data and within any shorter period required by applicable law or the executed agreement. Where Alabama law applies to EduOnTrack as a third-party agent, notice will be made no later than 10 days after EduOnTrack determines or has reason to believe a qualifying breach occurred.

Notice will include reasonably available information needed for Customer to understand the nature and timing of the incident, categories of affected data, mitigation taken, and a contact for follow-up. EduOnTrack will cooperate with Customer's legally required notices. EduOnTrack will not identify Customer in a public incident statement without Customer's permission unless required by law.

11. Subprocessors and External Services

Customer authorizes the providers identified under "Subprocessors" on EduOnTrack's Service Providers and External Services page for the described functions. EduOnTrack will require a Subprocessor that processes identifiable School Data on its behalf to protect that information consistently with EduOnTrack's applicable obligations and remains responsible for the Subprocessor's performance to the extent required by the agreement or law.

Services identified under "External Services" are not authorized as Subprocessors by this paragraph and may operate under their own public terms. EduOnTrack will describe any necessary external data flow on that page and will not represent that it has contractual controls it does not hold. Public map-tile requests do not include DeviceOnTrack asset tags, serial numbers, account emails, or organization names. Precise device coordinates will not be sent to a public reverse-geocoding service unless the page and applicable product policy expressly disclose that configuration.

EduOnTrack may replace a provider as the Services change and will update the list before or promptly after a material new provider begins processing School Data. Customer may raise a reasonable data-protection objection; the parties will work in good faith on a technically and commercially reasonable solution.

12. Access, Correction, Export, and Parent Requests

Customer may access and correct School Data through available product controls and may request reasonable assistance with a verified export, correction, or deletion. Exports will use an available standard format, such as CSV, where technically appropriate. Parents, guardians, eligible students, and students should ordinarily direct education-record requests to Customer. EduOnTrack may refer a direct request to Customer and will not disclose School Data until identity, authority, and applicable rights are verified.

13. Retention Schedule

The following schedule applies unless the order form or a signed district addendum specifies a shorter or different period. EduOnTrack will not retain Student Data indefinitely merely because storage remains available.

14. Termination, Return, and Destruction

Customer may request an export during the service term and for 30 days after termination unless the order form states another period. After that period, EduOnTrack will delete or de-identify School Data from active production systems within 60 days, subject to the retention schedule, a valid legal hold, security evidence, billing records, and provider backups. Upon written request, EduOnTrack will provide a reasonable written confirmation that production deletion has been completed.

15. De-Identified Information

EduOnTrack may create aggregated or de-identified operational information only if it is not reasonably linkable to a student, teacher, school account, or managed device. EduOnTrack will maintain de-identification controls, will not attempt reidentification, and will not disclose de-identified information with a key or other mechanism intended to permit reidentification. De-identified information may be used for service reliability, capacity planning, security, or product improvement, but not student advertising or AI or machine-learning training.

16. Legal Requests and Unauthorized Disclosure

If EduOnTrack receives legal process seeking Customer's School Data, it will, unless legally prohibited, notify Customer and provide a reasonable opportunity to seek protection. EduOnTrack will disclose only the information legally required. EduOnTrack will notify Customer of another unauthorized disclosure as required by the Security Incident section.

17. Security Information and Cooperation

Upon reasonable written request, EduOnTrack will provide Customer information reasonably needed to assess the security and privacy practices for the Services, subject to confidentiality and protection of other customers and system security. This may include the public policies, provider list, security overview, relevant questionnaire responses, and information about a material control. This Addendum does not promise a certification, penetration-test report, or audit report that EduOnTrack has not obtained.

18. Order of Precedence and Changes

If documents conflict regarding School Data protection, a signed district DPA or NDPA controls, followed by this Addendum, then the applicable order form or district agreement, product-specific terms, general EduOnTrack Terms, and the Privacy Policy. The Privacy Policy continues to govern EduOnTrack's public privacy representations. EduOnTrack will not materially reduce the protections in this Addendum during an active order term without Customer's written agreement unless required by law.

19. Term and Survival

This Addendum begins when incorporated or executed and continues while EduOnTrack processes Customer's School Data. Duties concerning confidentiality, prohibited uses, incident cooperation, deletion, legal process, and de-identification survive termination for as long as EduOnTrack retains the applicable information.

20. Acceptance and Contact

The parties may accept this Addendum through an order form that incorporates it, a district contracting system, or signatures below. Privacy and contract questions may be sent to privacy@eduontrack.com.