Data Processing Agreement

• "Personal Data" means any information relating to an identified or identifiable natural person, including student educational records
• "Processing" means any operation performed on Personal Data
• "Data Subject" means the individual to whom Personal Data relates, including students, parents, and educators
• "Educational Records" means records directly related to a student and maintained by an educational agency or institution
• "Sub-processor" means any third party engaged by Classroom Pulse to process Personal Data

2.1 Scope of Processing

Classroom Pulse processes Personal Data on behalf of the Customer for:

• Providing behavior tracking and analysis services
• Generating reports and insights for educational purposes
• Facilitating communication between educators and parents
• Maintaining and improving the service

2.2 Categories of Data

• Student names and identifiers
• Behavioral observations and assessments
• Educational progress data
• Teacher and staff information
• Parent/guardian contact information

Classroom Pulse shall:

1. Process Personal Data only on documented instructions from the Customer
2. Ensure that persons authorized to process Personal Data have committed to confidentiality
3. Implement appropriate technical and organizational measures to ensure security
4. Not engage Sub-processors without prior authorization
5. Assist the Customer in responding to data subject requests
6. Delete or return all Personal Data at the end of the service provision

4.1 Technical Measures

• Encryption of data in transit (TLS) and at rest
• Authentication for administrative access
• Regular security updates and patch management
• Secure backup procedures

4.2 Organizational Measures

• Access controls and principle of least privilege
• Confidentiality agreements with personnel
• Incident response and breach notification procedures

The Customer agrees to the use of the following Sub-processors:

Classroom Pulse shall notify Customer of any intended changes concerning Sub-processors at least 30 days in advance.

Classroom Pulse shall assist the Customer in fulfilling data subject requests for:

• Access to Personal Data
• Rectification of inaccurate data
• Erasure of Personal Data
• Data portability

For FERPA compliance, Classroom Pulse acknowledges that:

• Parents have the right to inspect and review their child's education records
• Parents may request corrections to inaccurate records
• Schools must obtain consent before disclosing personally identifiable information

In the event of a Personal Data breach, Classroom Pulse shall:

1. Notify the Customer without undue delay
2. Provide details about the nature of the breach
3. Cooperate with the Customer in investigating the breach
4. Implement measures to prevent future breaches

Upon termination of services, Classroom Pulse shall:

• Provide Customer with opportunity to export all data
• Delete or anonymize all Personal Data within a reasonable timeframe
• Retain only data required by law

This DPA shall:

• Come into effect upon acceptance of the Terms of Service
• Remain in effect for the duration of the service agreement
• Automatically terminate upon termination of the Terms of Service