Data Privacy Agreement

This Data Privacy Agreement ("DPA") is entered into by and between EX in Education, LLC, an Indiana limited liability company based in Noblesville, Indiana (notice address provided in the executed agreement) ("Provider"), and [District / LEA Legal Name] ("District" or "LEA"), effective as of the last signature date below ("Effective Date"). It governs Provider's handling of data the District provides or makes accessible in connection with the EX in Education platform (the "Service") under the parties' underlying service agreement (the "Service Agreement").

Recitals

The District wishes to use the Service and may provide or make accessible certain data, including data protected by the Family Educational Rights and Privacy Act ("FERPA", 20 U.S.C. 1232g) and applicable state student- and staff-privacy laws. The parties agree the protections below govern Provider's processing of that data and control over any conflicting terms in the Service Agreement.

Article I — Purpose and Scope

Provider will use District Data solely to provide and support the Service as described in Exhibit A and for no other purpose. Provider acts as a "school official" with a "legitimate educational interest" under FERPA and under the District's direction and control with respect to any education records it processes.

Article II — Data Ownership and Authorized Access

• Ownership. All District Data remains the property of and under the control of the District. Provider obtains no ownership rights in it.
• District access & portability. The District may access, export, and obtain a copy of its data in a commonly used format at any time during the term, and upon request.
• No secondary use. Provider will not use District Data for any purpose other than providing the Service. Provider will not sell District Data and will not use it for targeted advertising or to build a profile other than to serve the District.

Article III — Duties of Provider

3.1 Privacy compliance

Provider will comply with FERPA and applicable state privacy laws with respect to District Data and will limit access to authorized staff and subprocessors with a need to know.

3.2 Authorized use & no sale

Provider will not (a) sell District Data; (b) use or disclose it for advertising or to amass a profile of a student except in furtherance of the Service; or (c) use it for any commercial purpose unrelated to the Service.

3.3 Subprocessors

Provider may engage subprocessors to operate the Service, each bound by written confidentiality and data-protection obligations no less protective than this DPA. A current subprocessor list (see Exhibit D) is available to the District on request, and Provider will provide a means for the District to be notified of material changes.

3.4 Employees & contractors

Provider will require staff and contractors with access to District Data to be subject to confidentiality obligations and appropriate background and security practices.

Article IV — Duties of the District

• The District will provide data only through methods permitted by the Service and consistent with FERPA and District policy.
• The District is responsible for obtaining any consents and for the accuracy of, and its authority to share, the data it provides.
• The District will maintain its own user-access controls (e.g., promptly deactivating departed staff).

Article V — Data Provisions

5.1 Data security

Provider will maintain administrative, physical, and technical safeguards designed to protect District Data, as described in Exhibit C, including encryption in transit and at rest, least-privilege access controls, multi-tenant isolation, and cloud infrastructure operated by Amazon Web Services with verified backup and recovery.

5.2 Data breach

Following confirmation of a security incident affecting District Data, Provider will notify the District without unreasonable delay and within [X, e.g., 72] hours, cooperate in investigation and remediation, and provide information reasonably necessary for the District to meet its own notification obligations.

5.3 Return or destruction of data

Upon termination or expiration of the Service Agreement, or upon the District's written request, Provider will, at the District's election, return and/or securely destroy District Data within [X, e.g., 60] days, and certify destruction on request, except for data Provider must retain by law (which remains protected by this DPA).

Article VI — Miscellaneous / General Offer

This DPA, including its Exhibits, is incorporated into the Service Agreement and controls where conflicting. It is governed by the laws of the State of Indiana, without regard to conflict-of-laws rules. If any provision is held unenforceable, the remainder stays in effect. Provider may extend a General Offer of Privacy Terms (Exhibit E) allowing other districts to accept these terms.

Exhibit A — Description of Services

EX in Education is an educator-experience platform for schools and districts (e.g., evaluations and observations, professional development tracking, coaching, surveys, recognition, onboarding, and related workflows for District staff). [Trim/expand to the specific modules licensed by this District.]

Exhibit B — Schedule of Data

EX in Education is a staff/educator platform and does not require student personally identifiable information to function. The categories of data processed are:

Exhibit C — Data Security Requirements

• Encryption in transit (TLS) and at rest.
• Least-privilege, role-based access controls; access limited to authorized personnel.
• Multi-tenant data isolation; every request scoped to the District's tenant.
• Cloud infrastructure operated by Amazon Web Services (AWS) in the United States.
• Automated daily backups with a periodically verified restore procedure.
• Incident response and breach-notification process (Article 5.2).
• [Add only what is true today; do not list certifications (e.g., SOC 2) unless held.]

Exhibit D — Subprocessors

Exhibit E — General Offer of Privacy Terms

Provider may, at its option, extend the terms of this DPA to any other District ("Subscribing LEA") that accepts this General Offer in writing, by signing the acceptance below or its NDPA equivalent. [Remove this Exhibit if not offering general terms.]

Signatures

Questions about this DPA: eric@exineducation.com. This document is a starting template, not legal advice.