Data Processing Agreement

Recitals

A. Provider is StoryPass LLC, a wholly-owned subsidiary of Bardic Learning Systems, Inc. Provider offers personalized educational technology services to partner organizations under the name “StoryPass.”

B. Customer is an educational program — a school, school district, tutoring center, microschool, learning co-op, or other organization providing educational services to children. Customer wishes to use StoryPass services to deliver personalized educational content to students in Customer’s care.

C. The delivery of these services involves the processing of personal information about children, including children under the age of 13, in a manner that engages the Children’s Online Privacy Protection Act (“COPPA”), the Family Educational Rights and Privacy Act (“FERPA”) where Customer is a FERPA-covered institution, and applicable state student-data-privacy laws.

D. The parties agree to the terms set forth below to govern Provider’s processing of student personal information on Customer’s behalf.

1. Definitions

Capitalized terms used in this Agreement have the following meanings:

“Acceptance Date” means the date on which Customer accepts this Agreement through the StoryPass Partner Admin Dashboard.

“Authorized User” means an educator, administrator, or other natural person authorized by Customer to access the StoryPass Services on Customer’s behalf.

“Children’s Personal Information” means personal information of a child under the age of 13, as defined in 16 C.F.R. § 312.2.

“Customer Data” means all data, including Student Personal Information, that Customer or its Authorized Users upload to, generate within, or transmit through the StoryPass Services.

“Education Records” has the meaning given to that term in 20 U.S.C. § 1232g(a)(4) and 34 C.F.R. § 99.3.

“FERPA” means the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, and its implementing regulations at 34 C.F.R. Part 99.

“Process,” “Processing,” and “Processed” mean any operation performed on Customer Data, including collection, recording, organization, structuring, storage, retrieval, use, disclosure by transmission, or destruction.

“School Official” has the meaning given in 34 C.F.R. § 99.31(a)(1)(i)(B).

“Services” means the StoryPass platform and related services made available to Customer under Customer’s subscription, including the consumer-facing application, the Partner Admin Dashboard, and any APIs.

“Student” means a child whose profile is created on Customer’s account.

“Student Personal Information” means personal information of a Student, including Children’s Personal Information and Education Records.

“Sub-processor” means a third party engaged by Provider to Process Customer Data for the Services.

2. Scope and Roles

2.1 Scope. This Agreement applies to all Processing of Customer Data by Provider under the Services from the Acceptance Date until this Agreement is terminated.

2.2 Roles. Customer is the controller of Customer Data and, for FERPA-covered Customers, the educational agency or institution that holds the Education Records. Provider Processes Customer Data on Customer’s behalf as Customer’s processor and, for FERPA-covered Customers, as a School Official under 34 C.F.R. § 99.31(a)(1)(i)(B).

2.3 Direct control. Provider Processes Customer Data only on Customer’s documented instructions, including those given through the Partner Admin Dashboard (such as student-roster changes, retention settings, deletion requests, and feature toggles), or as required by applicable law. Customer’s subscription to the Services and acceptance of this Agreement constitutes Customer’s general instruction to Provider to Process Customer Data as necessary to deliver the Services.

2.4 No independent purpose. Provider does not Process Customer Data for Provider’s own purposes, except for (a) operating, maintaining, and securing the Services, and (b) producing aggregated, de-identified analytics that do not identify any Student or Customer and are not derived from Student Personal Information in a manner that could reasonably be re-identified.

3. Permitted Uses and Restrictions

3.1 Permitted uses. Provider may Process Customer Data only:

• (a) to provide and improve the Services to Customer and its Authorized Users and Students;
• (b) to detect, prevent, and respond to security incidents, fraud, abuse, or violations of Provider’s terms of service;
• (c) to comply with applicable law and respond to lawful requests from public authorities;
• (d) for internal operations of Provider that are necessary to the Services, including system monitoring, debugging, and quality assurance, provided that such operations do not involve disclosing Student Personal Information to third parties other than Sub-processors engaged in accordance with Section 4; and
• (e) for the limited purpose of producing aggregated, de-identified analytics described in Section 2.4.

3.2 Prohibited uses. Provider will not, and will not permit any Sub-processor to:

• (a) sell, rent, lease, license, or trade Customer Data;
• (b) use Customer Data to engage in targeted advertising or behavioral marketing to Students or their parents or guardians;
• (c) create personal profiles of Students for any purpose other than to provide the Services;
• (d) use Customer Data to train, fine-tune, or otherwise improve any artificial intelligence or machine learning model, except for narrowly scoped Service-internal personalization that operates only on Customer’s tenant data and that produces no derivative model artifact retained outside Customer’s tenant;
• (e) Process Customer Data in any manner inconsistent with this Agreement or Customer’s documented instructions; or
• (f) disclose Customer Data to any party other than Sub-processors engaged in accordance with Section 4, except as required by law and only after providing Customer with prompt notice (unless legally prohibited from doing so).

3.3 Notice of conflict. Provider will promptly notify Customer if Provider concludes that an instruction from Customer violates applicable law, and Provider may decline to follow that instruction until the conflict is resolved.

4. Sub-processors

4.1 Authorized Sub-processors. Customer authorizes Provider to engage the Sub-processors listed in Schedule B for the Processing described therein.

4.2 Sub-processor obligations. Provider will:

• (a) enter into a written agreement with each Sub-processor that imposes data-protection obligations substantially similar to those in this Agreement;
• (b) remain responsible to Customer for the acts and omissions of each Sub-processor as if they were Provider’s own; and
• (c) maintain a current list of Sub-processors and update Schedule B when a Sub-processor is added or replaced.

4.3 New Sub-processors. Provider will provide Customer with at least thirty (30) days’ prior notice through the Partner Admin Dashboard of the engagement of any new Sub-processor that will Process Student Personal Information. Customer may object to the new Sub-processor by giving written notice within the notice period. If Customer reasonably objects on data-protection grounds and the parties cannot agree on a resolution within thirty (30) days of the objection, Customer may terminate this Agreement and Customer’s subscription as Customer’s sole remedy.

4.4 Children’s Personal Information limits. Provider will not engage any Sub-processor to Process Children’s Personal Information unless that Sub-processor is contractually prohibited from doing any of the following with Children’s Personal Information: training AI models, selling or sharing the information, or using it for targeted advertising.

5. Data Security

5.1 Information Security Program. Provider maintains a written Information Security Program designed to meet the requirements of 16 C.F.R. § 312.8 and to provide reasonable protection for Customer Data. A summary of the program is set forth in Schedule C.

5.2 Security measures. Provider implements technical and organizational measures including:

• (a) encryption of Customer Data in transit (TLS 1.2 or higher) and at rest;
• (b) access controls limiting Customer Data to Provider personnel with a need to access it;
• (c) audit logging of administrative access to Customer Data;
• (d) regular vulnerability scanning of Provider’s infrastructure;
• (e) annual review of the Information Security Program by Provider’s designated Information Security Coordinator;
• (f) personnel security and confidentiality obligations applicable to all Provider staff with access to Customer Data;
• (g) multi-factor authentication for all Provider staff with administrative access to Customer Data, including all StoryPass Super Administrators; and
• (h) sub-processor security oversight as described in Section 4.

5.3 Customer-side controls. Customer is responsible for managing access to the Partner Admin Dashboard by Customer’s Authorized Users. Provider makes available, and Customer may require, multi-factor authentication for Customer’s Authorized Users.

6. Breach Notification

6.1 Notification. Provider will notify Customer of any confirmed unauthorized access to, acquisition of, use of, disclosure of, or destruction of Customer Data (“Security Incident”) without undue delay and in any event within seventy-two (72) hours after Provider becomes aware of the Security Incident, except where a shorter notification window applies under a State Addendum.

6.2 Notification content. The notification will include, to the extent then known:

• (a) the nature of the Security Incident, including the categories and approximate number of Customers and Students affected;
• (b) the categories of Customer Data affected;
• (c) the likely consequences of the Security Incident;
• (d) the measures taken or proposed by Provider to address the Security Incident and mitigate its possible adverse effects; and
• (e) the name and contact details of Provider’s Information Security Coordinator.

6.3 Cooperation. Provider will cooperate reasonably with Customer with respect to Customer’s obligations to notify regulators, parents, and other affected parties, including by providing information and assistance reasonably required for Customer’s notifications.

6.4 No required notification of trivial events. This Section does not require Provider to notify Customer of events that do not constitute Security Incidents, including pings, port scans, unsuccessful login attempts, denial-of-service attacks, and similar non-substantive events.

7. Children’s Personal Information

7.1 Direct compliance. Provider complies with COPPA in its capacity as an operator under 16 C.F.R. § 312.2 with respect to Children’s Personal Information, including the requirements of 16 C.F.R. §§ 312.4 (notice), 312.5 (parental consent), 312.7 (no conditioning), 312.8 (security), and 312.10 (retention).

7.2 Parental consent through Customer. For Children’s Personal Information Processed under Customer’s account, the parties acknowledge that Customer is providing parental consent on behalf of parents and guardians of Students. This consent is given under the school-authorization model contemplated by 16 C.F.R. § 312.5(b)(1) and Federal Trade Commission guidance, to the extent that model is applicable to Customer. Customer represents that:

• (a) Customer has notified parents and guardians, in a manner consistent with Customer’s policies, that Customer uses third-party educational technology services that may collect Children’s Personal Information from Students;
• (b) Customer is authorized under applicable law and Customer’s policies to provide consent on behalf of parents and guardians for the educational use of the Services; and
• (c) Customer will direct parents or guardians who wish to review, amend, or delete Children’s Personal Information to Provider’s privacy contact at [email protected] or to Customer’s designated administrator.

7.3 Data minimization. Provider collects only the Children’s Personal Information necessary to deliver the Services, as described in Schedule A. Provider does not collect persistent identifiers for advertising purposes, voice or video recordings of Students, precise geolocation data, or Students’ last names.

8. FERPA-Specific Provisions

8.1 Applicability. This Section 8 applies if Customer is an “educational agency or institution” within the meaning of FERPA and the Education Records of Students are involved.

8.2 School Official designation. Customer designates Provider as a “School Official” with a “legitimate educational interest” in Education Records to the extent necessary to provide the Services, in accordance with 34 C.F.R. § 99.31(a)(1)(i)(B). Provider:

• (a) performs an institutional service or function for which Customer would otherwise use its own employees;
• (b) is under the direct control of Customer with respect to the use and maintenance of Education Records, as described in Section 2.3; and
• (c) is subject to the requirements of 34 C.F.R. § 99.33(a) governing the use and re-disclosure of personally identifiable information from Education Records.

8.3 No re-disclosure. Provider will not re-disclose personally identifiable information from Education Records to any party other than Sub-processors engaged in accordance with Section 4, except as permitted or required by FERPA and only with Customer’s direction or consent.

8.4 Data destruction. On Customer’s request, and in any event upon termination of this Agreement subject to the export window in Section 10, Provider will destroy or return all Education Records in Provider’s possession.

8.5 Annual notification cooperation. Provider will provide information that Customer reasonably needs to include in Customer’s annual FERPA notification to parents, including the categories of information disclosed to Provider and the purposes of the disclosure.

9. Data Subject Rights

9.1 Parental rights through Customer. Provider will route parental requests for access to, correction of, or deletion of Student Personal Information to Customer in the first instance, except where Provider receives a direct request from a parent or guardian for which Customer is not the appropriate party to respond first under applicable law.

9.2 Direct requests. If Provider receives a request from a parent, guardian, Student, or other data subject relating to Customer Data, Provider will:

• (a) not respond to the substance of the request except to confirm receipt and to direct the requester to Customer where appropriate;
• (b) notify Customer of the request without undue delay; and
• (c) provide reasonable assistance to Customer in responding.

9.3 Provider tooling. Provider provides Customer with tooling through the Partner Admin Dashboard to enable Customer to fulfill data-subject rights without Provider intervention where practicable, including roster export, profile deletion, and audit log review.

10. Retention and Deletion

10.1 Retention. Provider retains Customer Data in accordance with Provider’s then-current Data Retention Policy and Customer’s instructions given through the Partner Admin Dashboard. Provider’s Data Retention Policy is incorporated by reference and may be updated from time to time consistent with applicable law and this Agreement.

10.2 Deletion on request. Customer may request deletion of all or part of Customer Data at any time. Provider will complete the deletion within thirty (30) days of the request, subject to legal-hold exceptions and the backup-window disclosure in Provider’s Data Retention Policy.

10.3 Termination. On termination of this Agreement or Customer’s subscription:

• (a) Customer will have thirty (30) days following termination to export Customer Data through the Partner Admin Dashboard or by written request to Provider;
• (b) After the thirty-day export window, Provider will delete Customer Data from Provider’s active systems within thirty (30) additional days;
• (c) Backup copies of Customer Data will be deleted in accordance with Provider’s then-current backup-rotation schedule, which is described in Provider’s Data Retention Policy;
• (d) Provider may retain Customer Data as required by applicable law or to enforce Provider’s rights under the Master Subscription Agreement, in which case the retained Customer Data remains subject to the protections of this Agreement until destroyed.

10.4 Subscription suspension. Suspension of Customer’s subscription, including suspension for non-payment, does not constitute termination of this Agreement. Customer Data is retained during suspension in accordance with Provider’s Data Retention Policy and remains accessible to Customer’s administrators for export. If Customer’s subscription is not reinstated within the suspension period defined in Provider’s then-current policy, Customer Data is treated under the termination provisions of Section 10.3.

11. Audit Rights

11.1 Compliance information. Provider will, on Customer’s reasonable written request and not more than once per year, provide Customer with:

• (a) the most recent summary of Provider’s Information Security Program (Schedule C as then-current);
• (b) the most recent third-party security attestation that Provider holds, if any (such as a SOC 2 report or ISO 27001 certificate of Provider’s data-hosting Sub-processor);
• (c) a list of current Sub-processors (Schedule B as then-current); and
• (d) responses to a documented procurement security questionnaire of reasonable scope.

11.2 On-site audit. If the compliance information provided under Section 11.1 is reasonably insufficient to address Customer’s documented concerns, Customer may, on at least thirty (30) days’ prior written notice and not more than once per year, conduct an on-site audit of Provider’s relevant facilities and records during normal business hours. The on-site audit will be conducted by Customer’s representatives. At Provider’s option, an independent third-party auditor mutually agreed by the parties may conduct the audit instead. Customer is responsible for the costs of the on-site audit unless the audit identifies material non-compliance with this Agreement, in which case Provider will reimburse Customer’s reasonable audit costs.

12. State-Specific Addenda

12.1 Applicable State Addenda. For Customers operating in jurisdictions that impose specific contractual requirements on processors of student data, the applicable State Addendum is incorporated into this Agreement. State Addenda available as of the date of this template:

• (a) New York Education Law § 2-d Addendum (to be published; required for Customers operating in New York State);
• (b) Additional State Addenda will be published as Provider expands service to additional jurisdictions.

12.2 Conflict resolution. If there is a conflict between this Agreement and an applicable State Addendum, the State Addendum prevails to the extent of the conflict for Processing of Customer Data subject to that jurisdiction’s law.

12.3 Designation of jurisdiction. Customer designates its primary state of operation during account setup. Customer is responsible for notifying Provider of any change in the primary jurisdiction that would activate additional State Addenda.

13. Term and Termination

13.1 Term. This Agreement begins on the Acceptance Date and continues for the duration of Customer’s subscription, unless terminated earlier under this Section 13.

13.2 Termination for breach. Either party may terminate this Agreement for material breach by the other party that is not cured within thirty (30) days after written notice describing the breach.

13.3 Termination for change. Customer may terminate this Agreement (and Customer’s subscription) under the circumstances described in Section 4.3 (new Sub-processor objection).

13.4 Survival. Sections 1, 6 (with respect to pre-termination Security Incidents), 7.1, 8.3, 9, 10, 11.1, 14, and 16 survive termination.

14. Liability

14.1 Cap and exclusions. The limitations and exclusions of liability set forth in the Master Subscription Agreement between the parties apply to this Agreement.

14.2 Carve-outs. Notwithstanding Section 14.1, the limitations of liability in the Master Subscription Agreement do not limit either party’s liability for:

• (a) breach of the prohibited-uses provisions of Section 3.2;
• (b) breach of confidentiality obligations relating to Student Personal Information; or
• (c) indemnification obligations expressly set forth in the Master Subscription Agreement.

15. Indemnification

15.1 By Provider. Provider will defend, indemnify, and hold Customer harmless from and against any third-party claim arising out of Provider’s breach of its prohibited-uses obligations in Section 3.2 or its security obligations in Section 5.

15.2 By Customer. Customer will defend, indemnify, and hold Provider harmless from and against any third-party claim arising out of (a) Customer’s failure to provide parental consent or notice required by applicable law where Customer is responsible for doing so, (b) Customer’s use of the Services in violation of applicable law, or (c) Customer Data that Customer was not authorized to upload to the Services.

16. General Provisions

16.1 Governing law. This Agreement is governed by the laws of the State of Arizona, without regard to its conflict-of-laws principles.

16.2 Entire agreement regarding data processing. This Agreement, together with any applicable State Addenda, is the complete agreement between the parties regarding the Processing of Customer Data and supersedes any prior agreement on the same subject. The remainder of the parties’ commercial relationship is governed by the Master Subscription Agreement.

16.3 Order of precedence. If there is a conflict among the documents governing the parties’ relationship, the order of precedence is: (a) the applicable State Addendum, (b) this Agreement, (c) the Master Subscription Agreement, (d) the Terms of Service.

16.4 Notices. Notices to Provider may be sent to [email protected] or to StoryPass LLC, Attn: Privacy, 2942 N 24th St Ste 115, Phoenix, AZ 85016. Notices to Customer may be sent to the email address on file for Customer’s primary administrator.

16.5 Assignment. Neither party may assign this Agreement without the other party’s prior written consent, except that either party may assign this Agreement as part of a merger, acquisition, or sale of all or substantially all of its assets to a successor that assumes all of the assigning party’s obligations.

16.6 Severability. If any provision of this Agreement is held unenforceable, the remaining provisions remain in full force, and where permitted by law the unenforceable provision will be modified to the minimum extent necessary to make it enforceable.

16.7 No waiver. A party’s failure to enforce a provision of this Agreement is not a waiver of its right to do so later.

16.8 Counterparts. This Agreement may be accepted electronically through the Partner Admin Dashboard. Electronic acceptance has the same legal effect as a signed counterpart.