This Data Processing Addendum (“DPA”) forms part of the MSA (“Underlying Agreement”) between SchoolAI and Client, effective as of the date last signed by either party that causes the DPA to be fully signed and returned to legal@schoolai.com (“Effective Date”). Except as modified below, the terms of the Underlying Agreement shall remain in full force and effect including the limitations of liability provisions therein. In the event of any conflict or inconsistency between this DPA and the Underlying Agreement regarding the processing of Client Personal Data, the terms of this DPA shall prevail to the extent of such conflict or inconsistency.
The terms used in this DPA with special meaning, are defined below. Capitalized terms not otherwise defined herein shall have the meaning given to them in the Underlying Agreement.
Except where the context requires otherwise, references in this Addendum to the Underlying Agreement are to the Underlying Agreement as amended by, and including, this Addendum.
1.1.1. “SchoolAI Account Data” means the personal data that relates to SchoolAI’s relationship with Client, including the names or contact information of individuals authorized by Client to access Client’s account and billing information (e.g. SchoolAI Technology admin, contract point of contact, etc.). SchoolAI Account Data also includes any data SchoolAI may need to collect for the purpose of managing its relationship with Client, identity verification, or as otherwise required by applicable laws and regulations.
1.1.2. “SchoolAI Usage Data” means SchoolAI Technology usage data collected and processed by SchoolAI in connection with the provision of services, including without limitation data used to identify the source and destination of a communication, activity logs, and data used to optimize and maintain performance of the services, and to investigate and prevent system abuse. SchoolAI Usage Data also include De-Identified Data, as defined in the Underlying Agreement.
1.1.3. “Controller” shall have the meaning provided in the GDPR. Where applicable, Controller includes “business” as defined by the California Privacy Laws.
1.1.4. “Client Data” means (i) data provided by Client in connection with the Product, including educational materials; and (ii) data generated by Authorized Users’ use of the Products that may or may not be associated with an individual person, consumer, or household. Client Data also includes any confidential information that is not Client Personal Data, but does not include De-Identified Data or Usage Data, transaction or other similar statistical or analytical data.
1.1.5. “Client Personal Data” means any Client Data that identifies (or can be used to identify) a particular natural person and that is considered “personal data,” “personal information,” or a like characterization under Data Protection Laws. Where the California Privacy Laws apply, ‘Personal Data’ includes “personal information” as defined by the California Privacy Laws. Personal Data does not include anonymous or De-Identified Data or Usage Data, transaction, aggregated, or other similar statistical or analytical data derived from Personal Data.
1.1.6. “Data Exporter” means Client.
1.1.7. “Data Importer” means SchoolAI, Inc. and/or SchoolAI.
1.1.8. “Data Protection Laws” means, as applicable: (1) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the “GDPR”); (2) European Union regulations and EEA Member State laws, other than GDPR, requiring a contract governing the processing of personal data, identical to or substantially similar to the requirements specified in Article 28 of the GDPR; (3) The UK Data Protection Act 2018, as amended by The Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (the “UK GDPR”); (4) California Civil Code Sec. 1798.100, et seq. (also known as the California Consumer Privacy Act of 2018) (“CCPA”), as amended and expanded by the California Privacy Rights Act of 2020 (“CPRA”) (collectively the “California Privacy Laws”); or (5) the revised Swiss Federal Act on Data Protection (revFADP), in force as of 1 September 2023, and its implementing Ordinance (as amended or superseded from time to time) (the “Swiss DPA”).
1.1.9. “Data Subject” means a particular identified or identifiable natural person. Where applicable, Data Subject includes “Consumer” as defined by the California Privacy Laws.
1.1.10. “EEA” means the European Economic Area;
1.1.11. “Model Clauses” means, as applicable, either: (i) the EC Standard Contractual Clauses as published in the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (the “SCCs”); or (ii) the SCCs as modified by the international data transfer addendum, effective March 21, 2022, under the UK Data Protection Act 2018, as amended by The Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (together, the “UK GDPR”), attached to this DPA as Schedule B (“IDTA Addendum”).
1.1.12. “Parties” refers to both Client and SchoolAI. Additionally, each, as context may require, shall be referred to as a “Party”.
1.1.13. “Process,” “Processes,” and “Processing” means (performing) any operation or set of operations on Client Personal Data, whether or not by automated means.
1.1.14. “Processor” means a natural person or legal entity which Processes Client Data; and, with respect to the Processing of Client Personal Data pursuant to this DPA. Where applicable, Processor includes “service provider” as defined by the California Privacy Laws.
1.1.15. “Sub-Processor” means any Processor appointed by SchoolAI to assist with SchoolAI’s Processing of Client Personal Data.
1.1.16. “Supervisory Authority” means a government agency responsible for enforcement of the Data Protection Laws, with competent jurisdiction over the parties.
1.1.17. “Restricted Transfers” means (i) where the EU GDPR applies, a transfer of Client Personal Data from the EEA to a country outside of the EEA which is not subject to an adequacy determination by the European Commission; (ii) means the disclosure, grant of access or other transfer of Client Personal Data to any person located in any country or territory outside the UK which does not benefit from an adequacy decision from the UK Government which would be prohibited without a legal basis under the UK GDPR (“UK Restricted Transfer”); and (iii) where the Swiss DPA applies, a transfer of Personal Data from Switzerland to any other country which is not determined to provide adequate protection for Personal Data by the Federal Data Protection and Information Commission or Federal Council (as applicable);
1.1.18. “Underlying Agreement” or “MSA” means the Master Subscription Agreement.
Each Party shall comply with all applicable Data Protection Laws applicable to it in its respective Processing of Client Personal Data under the Underlying Agreement.
2.1.1. SchoolAI as Processor. The Parties acknowledge and agree that, with respect to Client Personal Data contained in the Client Data: (i) Client is the Controller and SchoolAI is the Processor (or Service Provider for purposes of California Privacy Laws); and (ii) SchoolAI shall Process such Client Personal Data strictly on behalf of Client for the purposes described in the Underlying Agreement, as otherwise agreed in writing by the Parties, or as otherwise requested by Client, including Client providing instructions via configuration tools and APIs made available by SchoolAI within the SchoolAI Technology. Client, as Controller, appoints SchoolAI as a Processor to Process the Client Personal Data as described in the Underlying Agreement or in order to comply with applicable law. For purposes of California Privacy Laws, SchoolAI shall comply with the California Privacy Laws and understands and shall comply with the prohibitions on Service Providers set forth in the California Privacy Laws with respect to such Client Personal Data, including, without limitation and to the extent applicable in each case: (i) selling or sharing any Client Personal Data (as the terms “sell” and “share” are each defined within the California Privacy Laws) where the sale or sharing of such Client Personal Data is restricted by the California Privacy Laws; (ii) disclosing such Client Personal Data to any party outside of the direct business relationship between SchoolAI and Client (excluding SchoolAI Sub-Processors); (iii) retaining, using or disclosing such Client Personal Data for a commercial purpose other than performing the Services as set forth in the MSA with Client, or as otherwise expressly permitted under this DPA or the Underlying Agreement; (iv) it shall not combine Client Personal Data with personal information that SchoolAI receives from, or on behalf of, any other person, or collects from its own interaction with the consumer, except as permitted under the California Privacy Laws (the “no-combining” restriction); and (v) SchoolAI shall promptly notify Client in writing if it makes a determination that it can no longer meet its obligations under the California Privacy Laws, in which case Client shall have the right to take reasonable and appropriate steps under the California privacy Laws to stop and remediate any unauthorized use of Client Personal Data.
2.1.2. SchoolAI as Controller. Notwithstanding anything to the contrary in this DPA or otherwise, the parties agree that SchoolAI is an independent controller, not a joint controller, with Client solely regarding SchoolAI Account Data and SchoolAI Usage Data. SchoolAI will process SchoolAI Account Data and SchoolAI Usage Data as a controller (i) to manage the relationship with the Client; (ii) to carry out SchoolAI’s core business operations, such as accounting, audits, tax preparation and filing and compliance purposes; (iii) to monitor, investigate, prevent and detect fraud, security incidents and other misuse of the SchoolAI Technology, and to prevent harm to Client; (iv) for identity verification purposes; (v) to comply with legal and regulatory obligations applicable to the processing and retention of Personal Data to which SchoolAI is subject; and (vi) as otherwise permitted under applicable Data Protection Laws in accordance with this DPA and the Underlying Agreement. SchoolAI may also use SchoolAI Usage Data as a controller (including but not limited to the anonymized data) to provide, optimize, and maintain the SchoolAI Technology, to the extent permitted by the Data Protection Laws. Any processing by SchoolAI as a controller shall be in accordance with SchoolAI’s Privacy Notice available at: www.schoolai.com/privacy.
2.2. From time to time Client may provide additional instructions in writing to SchoolAI with regard to Processing of Client Personal Data in accordance with Data Protection Laws. Any such additional instructions must relate to SchoolAI’s performance of the Services and must be agreed to by both parties in writing. Subject to such mutual agreement, SchoolAI shall comply with such instructions to the extent necessary for it to: (i) comply with its obligations as Processor of Client Personal Data under applicable Data Protection Laws; and (ii) reasonably assist Client in complying with Client’s obligations under applicable Data Protection Laws. In addition, SchoolAI shall promptly inform Client in writing if, in its reasonable opinion, an instruction (whether existing or proposed) infringes the applicable Data Protection Law.
2.3. Client may view a current list of SchoolAI Sub-Processors at: https://trust.schoolai.com and Client consents to SchoolAI engaging the Sub-Processors for the purposes set forth in the Underlying Agreement. Subject to Section 2.4 below, Client hereby agrees SchoolAI may generally engage additional Sub-Processors and add such Sub-Processors to the list above. SchoolAI shall take commercially reasonable steps to ensure any Sub-Processor that Processes Client Personal Data hereunder is bound by terms comparably protective to the applicable terms set forth in this DPA as they apply to SchoolAI hereunder. SchoolAI will be responsible for the acts and omissions of its Sub-Processors in connection with their Processing of Client Personal Data hereunder.
2.4. SchoolAI shall give Client reasonable prior written notice of the appointment of any new Sub-Processor. If, within ten (10) days of receipt of such notice, Client notifies SchoolAI in writing of a reasonable objection to the proposed appointment due to a good faith concern such Sub-Processor will adversely impact Client’s ability to comply with applicable Data Protection Laws, SchoolAI shall work with Client in good faith to make available commercially reasonable alternative(s), including in the modification of the Services which avoids the use of that proposed Sub-Processor. If SchoolAI, in its sole discretion, cannot provide any such alternatives, or if Client does not agree to any such alternative(s) provided, either party may terminate, in whole or in part, the Underlying Agreement. Termination of the Agreement pursuant to this Section 2.4 shall not relieve Client of any fees due or owed to SchoolAI under the Underlying Agreement. Upon such termination, Client shall not make Client Personal Data available to Processor. If Client does not object to the proposed appointment of a Sub-Processor in accordance with this Section 2.4, such Sub-Processor shall be deemed an authorized Sub-Processor for the purposes of this DPA.
2.5. SchoolAI will provide reasonable assistance to Client to enable Client to comply with its obligations under applicable Data Protection Laws in respect of the Client Personal Data, including if and to the extent required by the applicable Data Protection Law, in the event a Data Subject requests: (i) access to such Data Subject’s Client Personal Data Processed by SchoolAI hereunder; (ii) deletion of such Data Subject’s Client Personal Data; (iii) information with respect to the categories and specific pieces of Personal Data collected by Client and related to such Data Subject; and (iv) information with respect to the categories of sources from which Client Personal Data is collected by Client. Subject to Section 2.7 below, within ninety (90) days of termination or expiration of the Underlying Agreement and written request for same, SchoolAI shall delete all Client Personal Data not permitted to be retained in accordance with the Agreement. Nothing in this DPA shall be read to limit any obligations of SchoolAI to assist Client with Client’s reasonable and appropriate efforts to ensure that SchoolAI Processes such Client Personal Data in a manner consistent with each party’s obligations under the California Privacy Laws, including the obligation to immediately notify Client if SchoolAI determines it can no longer meet its obligations under the California Privacy Laws with respect to such Client Personal Data.
2.6. SchoolAI shall not be required to delete Client Personal Data to the extent: (i) Client is required by applicable law or order of a government/regulatory body to retain some or all the Client Personal Data; (ii) Client Personal Data is archived on back-up systems, which Client Personal Data shall be securely isolated and protected from any further Processing, except to the extent required by applicable law; and/or (iii) it is otherwise permitted to be retained by SchoolAI under the Underlying Agreement.
2.7. Within a commercially reasonable period of time (and in all cases, within the time period required by Data Protection Laws), SchoolAI will comply with any request from Client requiring SchoolAI to amend, transfer or delete Client Personal Data, unless otherwise required by applicable law.
2.8. In the event SchoolAI receives any complaint, notice or communication from a Supervisory Authority or a Data Subject which relates to the Processing of Client Personal Data, SchoolAI shall notify Client thereof within a commercially reasonable period of time (and in all cases, within the time period required by applicable Data Protection Laws) and shall provide Client and the Supervisory Authority, if applicable, with full cooperation and assistance in relation to any such complaint, notice or communication. Any assistance provided to Client by SchoolAI pursuant to this Section 2.8 shall be at Client’s sole cost and expense.
2.9. Except as required by applicable law or permitted under the Agreement, SchoolAI will not disclose Client Personal Data to any Data Subject or to a third party, other than an approved Sub-Processor, without Client’s prior written consent.
2.10. SchoolAI will notify Client without undue delay (and in all cases, within the time period required by applicable Data Protection Laws) upon becoming aware of any unauthorized or unlawful Processing (“Security Incident”), loss of, damage to, or destruction of any Client Personal Data Processed by SchoolAI. For the avoidance of doubt, Security Incident does not include unsuccessful or unverified attempts or activities that do not compromise the security of Client Personal Data, including unsuccessful login attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.
2.11. SchoolAI will maintain all appropriate records of Processing carried out in respect of Client Personal Data in accordance with this DPA as well as with applicable Data Protection Laws (the “Records”).
2.12. Within a commercially reasonable period of time after receiving a written request from Client and no more than once per calendar year, unless otherwise required by applicable law or a Supervisory Authority, SchoolAI will provide Client with information demonstrating its compliance with this Section 2. Notwithstanding the immediately preceding sentence, in the event that SchoolAI produces a SOC 2 Type 2 report, or similar, such report shall be deemed acceptable evidence of compliance of this Section 2 in lieu of any separate requests for evidence.
2.13. SchoolAI will take appropriate technical, administrative and organizational measures designed to protect against the unauthorized or unlawful Processing of Client Personal Data, and against the loss or destruction of, or damage to Client Personal Data while Processed by SchoolAI. SchoolAI’s current list of technical, administrative, and organizational measures is set out at: https://schoolai.com/trust. To the extent that the California Privacy Laws apply to the processing of the Client Personal Data, the Client has determined that the technical and organizational measures provided by SchoolAI are no less than the level of security required by the California Privacy Laws.
2.14. Confidentiality of Personnel. SchoolAI shall ensure that all personnel authorized to Process Client Personal Data on its behalf (including employees, contractors, and Sub-Processor personnel) are bound by written confidentiality obligations no less restrictive than those set forth in the Underlying Agreement, or are subject to an appropriate statutory duty of confidentiality, as required by applicable law.
2.15. If and as necessary to effect the transfer of such Client Personal Data, as directed by Client, SchoolAI may Process, access, or direct Client Personal Data anywhere in the world. Client explicitly agrees that SchoolAI’s primary processing operations take place in the United States, and that the transfer of Client Personal Data to the United States is a necessary requirement for the provision of the services to Client.
2.16. With respect to the transfer of Client Personal Data by Client, other than from within the U.S., to SchoolAI in a Third Country (as defined herein), the parties agree SchoolAI is a “data importer” and Client is the “data exporter” under the Model Clauses. With respect to the transfer of Client Personal Data by SchoolAI to a Sub-Processor in a Third Country, SchoolAI shall take commercially reasonable steps to ensure such Sub-Processor complies with the data importer and Sub-Processor obligations under the Model Clauses. To the extent SchoolAI or a Sub-Processor Processes any Client Personal Data that originates from the EEA, in a country that has not been designated by the European Commission as providing an adequate level of protection for Personal Data, the parties agree to rely on the Model Clauses (as more particularly described in Section 2.16.1, below) to permit the transfer of Client Personal Data and to provide adequate protection for such transfer. For purposes hereof, “Third Country” means a country not recognized by the European Commission as providing a suitable level of data protection.
2.16.1. Transfers from EEA. The Parties agree that transfers from the EEA to a Third Party are made pursuant to the Model Clauses, which are hereby incorporated by reference and deemed entered into as follows:
2.16.1.1. Module One (Controller to Controller) of the SCCs apply when SchoolAI is processing Personal Data as a controller pursuant to Section 2.1.2.
2.16.1.2. Module Two (Controller to Processor) of the SCCs apply when SchoolAI is processing Personal Data as a controller pursuant to Section 2.1.1.
2.16.1.3. For each Module, where applicable, the following selections apply:
2.16.2. Transfers from the UK. Notwithstanding the foregoing, to the extent SchoolAI or a Sub-Processor Processes any Client Personal Data that originates from the United Kingdom in a country without ‘essentially equivalent’ privacy laws, the parties agree to rely on the IDTA Addendum Exhibit “B” to permit such transfer of Client Personal Data and to provide adequate protection for such transfer. SchoolAI’s obligations to Client under the DPA are only those express obligations imposed by the UK GDPR on a Data Processor for the benefit of a Data Controller (each, as defined under the UK GDPR).
2.16.3. Transfers from Switzerland. Additionally, to the extent SchoolAI or a Sub-Processor Processes any Client Personal Data that originates from Switzerland in a country without ‘essentially equivalent’ privacy laws, the Parties agree that the Model Clauses, as amended below, will apply to permit such transfer of Client Personal Data and to provide adequate protection for such transfer:
2.16.4. To the extent SchoolAI is self-certified under the EU-U.S. Data Privacy Framework (DPF), the UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF (collectively, the “Data Privacy Framework”), the Parties may rely on SchoolAI’s DPF certification as an additional lawful transfer mechanism for Restricted Transfers from the EEA, the United Kingdom, and Switzerland. SchoolAI shall (i) maintain its active self-certification with the FTC and comply with the DPF Principles in respect of Client Personal Data, (ii) promptly notify Client if SchoolAI is no longer able to comply with the DPF Principles or if its certification lapses, withdraws or is removed, and (iii) in the event of any such lapse, withdrawal, or removal, immediately revert to the Model Clauses (and, where applicable, the UK IDTA and Swiss adaptations set out in this DPA) as the operative transfer mechanism without any further action by Client. Nothing in this Section limits Client’s ability to suspend transfers or terminate the DPA if the Data Privacy Framework is invalidated.
SchoolAI complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. SchoolAI certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. SchoolAI has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.
Under the terms of the Framework, SchoolAI is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).
Third Parties to Which SchoolAI Discloses Personal Data, and the Purposes for Doing So. SchoolAI discloses personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to the following types of third parties, for the following purposes: (i) Sub-Processors — the current list of which is available at https://trust.schoolai.com — including cloud hosting, storage, security, communications, analytics, customer support, and artificial intelligence and speech-to-text providers, for the purpose of hosting, securing, supporting, and otherwise providing the SchoolAI Technology on Client’s behalf; (ii) SchoolAI’s corporate parent, subsidiaries, and affiliates, for the purpose of administering, supporting, and securing the SchoolAI Technology and the Client relationship; (iii) SchoolAI’s professional advisors (such as attorneys, accountants, insurers, and bankers) and independent auditors, for the purpose of obtaining professional services and demonstrating compliance (for example, SOC 2 attestation); (iv) third parties designated or authorized by Client, such as a district administrator or a state board of education, at Client’s direction and on Client’s instructions; (v) public authorities, as described in the paragraph below; and (vi) an actual or prospective acquirer, successor, or assignee, and their advisors, in connection with a merger, acquisition, financing, reorganization, or sale of assets, for the purpose of evaluating and completing that transaction. SchoolAI does not sell personal data, does not use it for targeted advertising, and does not disclose it for any purpose that is materially different from the purposes described in this DPA and the Underlying Agreement.
Disclosures to Public Authorities. SchoolAI’s adherence to the DPF Principles is subject to the limitations set out in the DPF Principles. SchoolAI may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. Where SchoolAI receives such a request for Client Personal Data, SchoolAI will, to the extent legally permitted, notify Client, challenge requests that appear unlawful or overbroad, and disclose only the minimum amount of personal data necessary to respond.
Choice: Limiting the Use and Disclosure of Personal Data. Individuals whose personal data SchoolAI receives in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. DPF may choose (opt out of) whether their personal data is (i) disclosed to a third party, other than a third party acting as an agent to perform tasks on behalf of and under the instructions of SchoolAI, or (ii) used for a purpose that is materially different from the purpose(s) for which it was originally collected or subsequently authorized by the individual. Where sensitive personal data is involved, SchoolAI will obtain affirmative express consent (opt in) before such a disclosure or materially different use. An individual may exercise these choices, at any time and free of charge, by contacting SchoolAI at privacy@schoolai.com. Where SchoolAI Processes Client Personal Data as a Processor on Client’s behalf, SchoolAI will refer the individual’s request to Client and will assist Client in responding to it in accordance with Section 2.5 of this DPA; where SchoolAI acts as a controller of SchoolAI Account Data or SchoolAI Usage Data under Section 2.1.2, SchoolAI will honor the request directly.
Onward Transfer Liability. SchoolAI may transfer personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to third parties acting as agents on our behalf. SchoolAI remains responsible and liable under the DPF Principles if an agent that we engage to process such personal data on our behalf does so in a manner inconsistent with the DPF Principles, unless we prove that we are not responsible for the event giving rise to the damage.
SchoolAI commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU and UK individuals and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact SchoolAI at privacy@schoolai.com.
In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, SchoolAI, Inc. commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, you may contact the relevant European data protection authority — the panel established by the EU DPAs, the ICO, or the FDPIC, as applicable — for more information or to file a complaint. The services of these data protection authorities are provided to you free of charge.
If your dispute or complaint related to your Personal Data that we received in reliance on the Data Privacy Framework cannot be resolved by us, nor through the dispute resolution mechanism mentioned above, you may have the right to require that we enter into binding arbitration with you under the Data Privacy Framework “Recourse, Enforcement and Liability” Principle and Annex I of the Data Privacy Framework.
2.17. In the event Client reasonably determines that any Processing activity related to SchoolAI’s Processing of Client Personal Data is likely to result in high risk to the rights and freedoms of a Data Subject, SchoolAI and Client shall reasonably cooperate, at Client’s sole cost and expense, to conduct a data protection impact assessment of such Processing activity, with such impact assessment to be conducted in a manner so as not to interfere with SchoolAI business operations.
3.1. Client agrees: (i) it will comply with its obligations under Data Protection Laws in the performance of its obligations under the Underlying Agreement, this DPA, and any Order Forms executed by the parties, including with respect to any Processing instructions it issues to SchoolAI; (ii) it will obtain all consents and rights necessary under Data Protection Laws for SchoolAI to Process Client Personal Data; and (iii) it does not sell Client Personal Data to SchoolAI in connection with the Agreement or this DPA. Client warrants to SchoolAI that Client’s instructions and actions with respect to the Client Personal Data, including its appointment of SchoolAI as a Processor, have been or will be authorized by the relevant Data Subject to the extent required under applicable law.
3.2. Client acknowledges it is responsible for its use of the SchoolAI Technology, including making appropriate use of the SchoolAI Technology to ensure a level of security appropriate to the risk in respect of the Client Personal Data, securing its account authentication credentials, protecting the security of Client Personal Data when in transit to and from the SchoolAI Technology, and taking any appropriate steps to securely encrypt or backup any Client Personal Data transmitted to the SchoolAI Technology.
3.3. SchoolAI has no obligation to protect Client Personal Data stored or transferred by Client outside of the SchoolAI Technology (e.g., offline or on-premises storage).
3.4. Notices and Consents. Client shall provide all notices and obtain all voluntary and explicit consents required under applicable Data Protection Laws from the Data Subjects to share the Client Personal Data with SchoolAI via the SchoolAI Technology in order for SchoolAI to Process in accordance with the terms of this DPA (collectively, the “Notice and Consents”). Client represents and warrants on an ongoing basis that it has obtained and will maintain the Notices and Consents for all Data Subjects through the entire Term of the Underlying Agreement; including but not limited to prior to obtaining the demographic information, as stated in Section 3.5, below.
3.5. Sensitive Data. Client represents and agrees that before entering Sensitive Data in the SchoolAI Technology, Client has already obtained the voluntary and explicit consent of the Data Subjects whose demographic data Client seeks to collect and have SchoolAI, including SchoolAI’s Sub-Processors, Process on behalf of Client.
4.1. The Records are SchoolAI’s Confidential Information.
4.2. SchoolAI shall permit Client and its respective third party representatives (at Client’s sole cost and expense), on reasonable prior written notice during normal business hours, subject to agreement with SchoolAI’s onsite confidentiality and security procedures and policies, no more than once per calendar year or as otherwise required by law, to gain access to, and receive copies of, the relevant portions of the Records, for the sole purposes of assessing Client’s compliance with Data Protection Laws and assessing SchoolAI’s compliance with its obligations under this DPA. Client shall conduct any such review within a reasonable timeframe so as not to unreasonably interfere in SchoolAI business operations. Notwithstanding the immediately preceding sentence, in the event that SchoolAI produces a SOC 2 Type 2 report, or similar, such report shall be deemed acceptable evidence of compliance of this Section 2 in lieu of any separate requests for evidence.
4.3. Access by any third-party representative of Client shall be subject to such representative’s agreement to confidentiality obligations no less restrictive than those set forth in the Underlying Agreement with respect to the Records and information obtained in connection with such review, provided that all such Records and information may be disclosed to Client.
5.1. This DPA shall remain in effect until the termination or expiration of the Underlying Agreement; provided, this DPA shall remain in effect as to any Client Personal Data for so long as Client Personal Data remains in the custody or control of SchoolAI. If SchoolAI Processes Client Personal Data under one or more agreements in addition to the Underlying Agreement, this DPA shall terminate upon expiry of the last agreement between the parties related to the Processing of Client Personal Data to expire or terminate.
6.1. Except as necessary under applicable Data Protection Laws, a person who is not a party to this DPA may not enforce any of its terms against a party to this DPA.
6.2. The Underlying Agreement’s choice of law and venue provision apply to this DPA unless otherwise required by law.
ANNEX I: TO THE STANDARD CONTRACTUAL CLAUSES
Data exporter(s): [Identity and contact details of the data exporter(s) and, where applicable, of its/their data protection officer and/or representative in the European Union]
| Name: | [Client] |
| Address: | [Client address] |
| Contact person’s name, position and contact details: | [Client contact] |
| Signature and Date: | |
| Role (Controller/Processor): | Controller |
Data importer(s):
| Name: | SchoolAI, Inc. |
| Address: | 2000 Ashton Blvd., #500, Lehi, UT 84043 |
| Contact person’s name, position and contact details: | General Counsel, privacy@schoolai.com |
| Signature and Date: | |
| Role (Controller/Processor): | Processor |
| Categories of data subjects whose personal data is transferred: | Authorized Users of the SchoolAI Technology, including administrators, teachers and students of Client. |
| Categories of personal data transferred: | The categories of personal data outlined in the “What Personal Information do we collect?” section of our Children’s Privacy Notice and COPPA Disclosure (“COPPA Notice”). |
| Sensitive Data | The categories of personal data outlined in the “What Personal Information do we collect?” section of our Children’s Privacy Notice and COPPA Disclosure (“COPPA Notice”). |
| The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): | Continuous while using the SchoolAI Technology |
| Nature of the processing: | The setup and maintenance of our service to enable the Exporter and its permitted users to use the SchoolAI Technology per the terms of the Underlying Agreement. |
| Purpose(s) of the data transfer and further processing: | Personal data may be received, processed, and stored in order to: (a) provide the Services in accordance with the Underlying Agreement; (b) to communicate with data exporter; and (c) to otherwise fulfill obligations under the Underlying Agreement. |
| The data importer may process personal data for the following purposes: | The objective of the processing of personal data by SchoolAI is the performance of the Services and fulfillment of its obligations under the Underlying Agreement. |
| The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: | The term of the contract. |
| For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing: | SchoolAI transfers data to sub-processors who provide support, infrastructure and analytic activities that are required for the operation of our service. The nature and duration of processing are the same as SchoolAI’s. |
In relation to Personal Data that is subject to the U.K. GDPR, the competent supervisory authority is the United Kingdom Information Commissioner’s Office, subject to the additional terms set forth in the International Data Transfer Addendum to the EU Model Clauses attached hereto.
Description of the technical and organisational security measures implemented by the data importer in accordance with the Clauses is set out at: https://schoolai.com/trust/compliance.
In accordance with the Clauses, Client hereby authorizes the Sub-Processors set out at: https://trust.schoolai.com to process Client Personal Data.
For purposes of data transfers originating in the UK Restricted Transfers, the Parties agree that the following changes to the Model Clauses apply:
1. Tables 1, 2 and 3 of Part 1 of the UK Transfer Addendum are deemed populated with the corresponding details set out in Annex 1 to the DPA and the foregoing provisions of Part 1 of Annex 2 (subject to the variations effected by the Mandatory Clauses described in (b) below); and
2. In Table 4 of the U.K. Addendum, if the ICO issues any revisions to the U.K. Addendum after the Effective Date (“ICO Revision”), SchoolAI shall have the right to terminate this IDTA Addendum in accordance with the U.K. Addendum, the DPA, and the Underlying Agreement. Upon such termination of this IDTA Addendum:
The Parties agree to be bound by the Mandatory Clauses of the UK Transfer Addendum.
In relation to any UK Restricted Transfer to which they apply, where the context permits and requires, any reference in the DPA to the SCCs shall be read as a reference to those SCCs as varied in the manner set out in this Section II.
