Data Privacy Addendum | Ori Learning

SpecialNeedsWare, Inc. dba Ori Learning · Version v2026.09 · Effective September 23, 2026

Download this document as a PDF (v2026.09)

1. Scope, parties and relationship to other documents

1.1 Parties and purpose. This Data Privacy Addendum (this “DPA”) is between SpecialNeedsWare, Inc. dba Ori Learning, a Delaware corporation, with its principal place of business at 66 Summit Ave, Chatham, NJ 07928 (“Ori Learning”), and the Customer identified on the Order Form. It governs the collection, use, disclosure, security, retention and Deletion of Customer Data, including Student Data, for the Services, Products, Sites and states identified on the Order Form.

1.2 What this DPA consists of. This DPA consists of Sections 1 to 17, Annex A (the Data Schedule), Exhibit 1 (the Security & Incident Exhibit), Exhibit 2 (the Subprocessor Schedule) and Exhibit 3 (the Retention & Deletion Schedule), each in the version the Order Form identifies, except that Exhibit 2 applies in its current published version, which is the version the Order Form identifies as amended by changes made under Section 9.6 during the Subscription Term. The Exhibits are separate documents: Exhibits 2 and 3 are published at orilearning.com/legal/, and Exhibit 1 is provided to the Customer under the confidentiality terms of the Agreement and summarized publicly; each is available as a dated PDF, and the dated PDF of each version is the contractual artifact. A reference to this DPA includes its Annex and Exhibits.

1.3 Order of precedence. If the documents that make up the Agreement conflict, the document listed higher below controls to the extent of the conflict:

(a) a Data Privacy Agreement executed by both the Customer and Ori Learning, including a National Data Privacy Agreement, a state form, or a Customer-authored agreement, as to the treatment of Student Data, and as to a term of Section 11, 12, 13 or 14 of the Master Subscription Agreement only where it names the term it varies;

(b) a State Addendum executed for the Customer, as to its subject matter;

(d) the Order Form, with its Schedule 1 and any award-specific addendum attached under it, except that a term the award-specific addendum identifies as one the federal award or cooperative contract makes mandatory controls a conflicting term of any document listed here to the extent the law requires and no further;

(e) the Master Subscription Agreement;

(f) the Accessibility Exhibit and the Acceptable Use Policy, in that order; and

(g) the Authorized User Terms and any posted notice or policy, which bind only the individual who accepts them, whether an Authorized User or the holder of an Independent Account, and never the Customer.

The Ori Learning Definitions control the meaning of a capitalized term in every document listed above, except where a document at (a) or (b) defines the term for its own subject matter. An Order Form varies the Master Subscription Agreement only by language that identifies the section varied; a commercial field completed on the Order Form is not a variation. An Order Form varies the Data Privacy Addendum, a State Addendum, or an Exhibit only by language that identifies the section varied and is signed by both parties. A certification, disclosure or form that the Customer’s law requires binds Ori Learning only where the Order Form identifies it or a signed amendment adopts it, and then as part of the Order Form. A purchase order’s printed terms do not vary the Agreement. Nothing in this order of precedence limits a right or remedy that applicable law does not permit to be limited.

1.4 A Customer’s own Data Privacy Agreement. Where the Customer’s law prescribes a form, supplement or plan, Section 16.2 applies. Where the Customer requires its own privacy form, or a National Data Privacy Agreement with its state supplement (executed directly or by a General Offer), Ori Learning will review it and, where it can honor the commitments it contains, execute it. Once executed, that Data Privacy Agreement controls as to the treatment of Student Data to the extent of any conflict, as Section 1.3 states, and this DPA continues to apply to every matter on which it is silent. Annex A is drafted to serve as the schedule of student data such an agreement requires, and Exhibits 1 to 3 as its descriptions of security, Subprocessors and disposition.

1.5 Duties that apply regardless. The duties that Applicable Law places on Ori Learning as an operator or provider of an online service used for K-12 school purposes bind Ori Learning whether or not this DPA or a Data Privacy Agreement is executed. Nothing in the Agreement limits, waives or transfers them to the Customer.

1.6 No Student Data before agreement. Neither party provides, and Ori Learning does not accept or roster, Student Data before both an Order Form has been accepted and the governing privacy instrument is in place: this DPA as the Order Form incorporates it or, where the Customer uses its own, an executed Data Privacy Agreement.

1.7 Public notices. The Student & Education Privacy Notice and the COPPA Direct Notice to Schools are the notices Applicable Law requires Ori Learning to give; they are the statutory floor, and this DPA adds to them. As between the parties, this DPA states the contractual commitments, and where a notice and this DPA differ it is this DPA that governs their contractual rights. Ori Learning reconciles each notice with this DPA before publishing it.

1.8 Compliance with law. Each party must comply with the Applicable Law that binds it in performing this DPA. Sections 3 to 14 state what Ori Learning does to support the Customer’s duties under FERPA, PPRA, IDEA and the student-privacy law of its state, and to meet the duties those laws and COPPA place on Ori Learning itself.

2. Definitions

2.1 Defined terms. Capitalized terms in this DPA have the meanings given in the Ori Learning Definitions, which form part of the Agreement and are published with it (the “Definitions”). Every document that makes up the Agreement uses the Definitions with the same meaning, and they apply to this DPA whether or not the Master Subscription Agreement is executed with the Customer.

2.2 Terms this DPA defines or applies. “Definitions” is defined in Section 2.1, “IDEA Data” in Section 8.1, and “Privacy Contact” in Section 17.3; “Roster” and “Use” are the source labels Annex A defines. “National Data Privacy Agreement”, “General Offer” and “Designated Representative” have the meanings given in the Definitions, the last applied by Section 4.3. The Student & Education Privacy Notice and the COPPA Direct Notice to Schools are the notices so titled that Ori Learning publishes. “In writing” includes email to a contact identified under Section 17.3.

3. Roles, designation and direct control

3.1 Designation by the Customer. Where FERPA applies to the Customer, the Customer, by accepting the Order Form and providing Student Data, designates Ori Learning as a school official with a legitimate educational interest under 34 C.F.R. §99.31(a)(1)(i)(B). The Customer, not Ori Learning, determines that the designation is available under its policies, its annual FERPA notification and Applicable Law; Ori Learning does not designate itself, and no notice or policy of Ori Learning creates direct control or a legitimate educational interest the Customer has not conferred.

3.2 The school-official conditions. Ori Learning: (a) performs an institutional service or function for which the Customer would otherwise use its own employees; (b) is under the Customer’s direct control with respect to the use and maintenance of Education Records, as Section 3.3 describes; (c) uses Education Records only for the purposes for which the Customer disclosed them, which are the purposes in Section 5; and (d) does not redisclose personally identifiable information from Education Records except as this DPA permits, with the Customer’s written permission, or as a court order or Applicable Law requires, subject to 34 C.F.R. §99.33.

3.3 Direct control. Ori Learning processes Student Data only on the Customer’s documented instructions: this Agreement, the configuration the Customer’s Administrators and Teachers set in the Platform, and the Customer’s written directions. The Customer controls which Students and staff have Accounts, which Products and Sites each may use, how classes are rostered, whether Collaboration Boards are enabled and moderated, which Curriculum Content is assigned, and when Student Data is corrected, exported or Deleted within this DPA. If Ori Learning believes an instruction would breach Applicable Law, it tells the Customer before acting on it.

3.4 Access limited to a legitimate educational interest. The Platform is designed and configured to limit each Authorized User’s access to the Student Data that the user’s role and the Customer’s organization, Site and class configuration allow, and Ori Learning supports the Customer’s reasonable methods for meeting 34 C.F.R. §99.31(a)(1)(ii) for the Platform through that control. Ori Learning’s own Personnel access Student Data only as Section 10.2 provides.

3.5 Use and redisclosure. Ori Learning uses Education Records only for the purposes of the disclosure and discloses Student Data only: (a) to Subprocessors under Section 9, and to the services Part B of the Subprocessor Schedule lists as Section 5.8 describes; (b) at the Customer’s written direction; (c) as Section 14 permits; or (d) to a successor bound under Section 15.2. Ori Learning keeps a record of each disclosure under (b) or (c) and provides it to the Customer on request for the Customer’s record under 34 C.F.R. §99.32.

3.6 How the parties meet FERPA together. The Customer determines whether the school-official exception is available, includes school officials such as Ori Learning in its annual FERPA notification of rights, and answers requests to inspect, review and amend Education Records; Ori Learning maintains Student Data as Education Records on the Customer’s behalf and performs Sections 3.4, 3.5, 5, 7, 10, 12 and 13.

3.7 Uses that need consent. Ori Learning performs no use or disclosure of Student Data outside this DPA unless the Customer directs it in writing and confirms that it has obtained the written consent that 34 C.F.R. §99.30 or the law of its state requires.

3.8 Ownership and control. Customer Data, including Student Data, is under the Customer’s control, and Ori Learning holds it as the Customer’s records custodian, service provider and school official. As between the parties, ownership of Customer Data is stated in Master §8.2; who holds the rights in Student-Generated Content is determined as Master §9.3 states, by the Customer’s policies and Applicable Law. Ori Learning claims no ownership of, and acquires no right in, Customer Data or Student-Generated Content; the only license it holds in them is the license in Master §9.4. Master §9 states Ori Learning’s ownership of the Platform and the Curriculum Content, and Master §8.3 and Section 6 govern the De-identified Data and Aggregate Data it creates.

3.9 Customers to which FERPA does not apply. Where FERPA does not apply to the Customer, Ori Learning gives the same commitments as contractual commitments, and references to FERPA rights are read as references to the corresponding rights under Applicable Law and, where the Customer has supplied a policy of its own in writing and Ori Learning has accepted it in writing, through Schedule 1 to the Order Form or a written amendment under Master §15.3, under that policy.

4. COPPA school authorization

4.1 Ori Learning is the operator. Ori Learning is the operator of the Platform under the Children’s Online Privacy Protection Act and its rule, 16 C.F.R. Part 312, as to Personal Information collected from Students, every one of whom it treats as a child under Section 4.9, and keeps every duty the rule places on an operator. Nothing in the Agreement transfers, waives or limits those duties, and the Customer gives no warranty about Ori Learning’s compliance with them.

4.2 The school’s authorization. Consistent with the Federal Trade Commission’s guidance on educational technology in schools, the Customer, as the school, authorizes Ori Learning, as the operator, to collect Personal Information from Students for the School-Authorized Educational Purpose and for no other purpose. The Customer gives that authorization in the school context, in place of the Parents of its Students and only to that extent, and confirms that it has the authority to do so; Ori Learning receives the authorization as the operator and keeps every operator duty. Any other use would need the Parent’s verifiable consent, which Ori Learning does not seek through the Platform and does not perform.

4.3 Designated Representative. The Designated Representative is the school official who signs the Order Form for the Customer or whom the Order Form names, and is the school representative whose authorization Ori Learning relies on. Ori Learning records that individual’s name and title, the date of the authorization and the version of the COPPA Direct Notice to Schools the Customer received, with the Order Form, before it rosters any Student.

4.4 Direct notice and online notice. Ori Learning gives the Customer its complete direct notice, the COPPA Direct Notice to Schools, with the Order Form that incorporates this DPA and again before any material change to the practices it describes; the Customer acknowledges receipt of the current notice by accepting the Order Form. Ori Learning’s online notice is the Student & Education Privacy Notice. Ori Learning places and maintains a clear and prominent link to that notice on the landing screen of the Student Portal and at each surface where Personal Information is collected from a Student; the Customer may also provide the notice to Parents.

4.5 Age information Ori Learning holds. The Platform collects no date of birth and has no age gate. The Customer’s roster, including grade level, and the Products on the Order Form are the information Ori Learning holds about a Student’s age band; Ori Learning uses it only to route requests and administer Section 7, and applies this Section to every Student as Section 4.9 states. The Customer keeps its roster accurate.

4.6 No conditioning. Ori Learning does not condition a Student’s participation in an activity on disclosing more Personal Information than is reasonably necessary to participate in it, and does not condition any Student’s or Authorized User’s access to the Services on a waiver of a privacy or confidentiality right.

4.7 Parents’ rights. A Parent of a Student under 13 may ask Ori Learning directly to review the Personal Information collected from the Student, to Delete it, and to refuse further collection or use. These are the Parent’s rights under 16 C.F.R. §312.6; the Customer’s authorization does not extinguish them. On such a request Ori Learning: (a) acknowledges it within 5 Business Days; (b) verifies the requester’s identity and authority as the Student’s Parent by a method reasonably designed for that purpose, which may include the Customer’s confirmation; (c) notifies the Customer and coordinates the response with it; and (d) answers a verified request within 30 days after receiving it. Where a verified Parent refuses further collection or use, Ori Learning stops collecting and using the Student’s Personal Information once the request is verified, completes any Deletion the refusal requires, notifies the Customer and, within 10 Business Days, disables the Student’s Account; the Customer may choose among the technically available arrangements that collect and use no further Personal Information from the Student, including ending the affected Service for that Student. The Customer may reassign the affected seat; fees on the Order Form are not reduced.

4.8 Minimization, retention, security and service providers. Ori Learning collects from Students no more Personal Information than is reasonably necessary for the School-Authorized Educational Purpose, and only the elements in Annex A; retains it only as Section 12 and the Retention Schedule state, which together are its written retention policy for children’s Personal Information; secures it under the written Information Security Program in Section 10 and the Security Exhibit; and discloses it only as Sections 3.5 and 9 permit.

4.9 Every Student treated as a child. Ori Learning treats every Student as a child for the operator duties in Sections 4.1, 4.2, 4.4, 4.6 and 4.8, whatever the Student’s age, and applies no grade-level or age test; that is the one audience classification the Services carry. Section 4.7 states the direct rights of the Parent of a Student under 13; a request about a Student who is 13 or older is routed under Section 7.

5. Authorized purposes and prohibited uses

5.1 Purpose limitation. Ori Learning collects, uses, discloses and retains Student Data only for the School-Authorized Educational Purpose and the purposes this Section explicitly authorizes, and for no other purpose without the Customer’s prior written consent and any Parent or Eligible Student consent that Applicable Law requires. Ori Learning collects no more Student Data than is reasonably necessary for the School-Authorized Educational Purpose, and collects no elements beyond those Annex A lists, which Ori Learning updates as the Platform changes.

5.2 Authorized purposes. Ori Learning may collect, use and disclose Student Data to: (a) provide the Services to the Customer and its Authorized Users as the Customer configures them; (b) create and administer Accounts, organizations, Sites, classes and rosters; (c) deliver Curriculum Content, assignments, assessments, check-ins and, where the Customer enables them, Collaboration Boards; (d) record Students’ responses, work, progress and results and report them to the Student and to the Customer’s Teachers and Administrators; (e) deliver the Curriculum Content the Customer assigns to a Student and, where a Product provides it, adapt or personalize instruction for that Student; (f) process Audio Data as Section 5.6 states; (g) provide support, training, customer-success and other communications about the Services to the Customer and its Authorized Users; (h) operate, maintain, secure, support, diagnose and repair the Platform, including monitoring for security, performance and errors and the product-usage and customer-success analytics that Subprocessors identified on the Subprocessor Schedule perform (for Students, only on usage events under a pseudonymous identifier, never a Student’s name, username or contact details) to operate the Services and to report to the Customer; (i) comply with Applicable Law and this DPA, including Section 14; and (j) perform any other purpose the Customer directs in writing that is lawful, within the School-Authorized Educational Purpose and the Services, and that Ori Learning has accepted in writing, subject to Ori Learning’s capability, to data minimization, to any consent Applicable Law requires and to any implementation terms and fees the parties agree.

5.3 Improvement of the Services. Ori Learning develops and improves the Services using De-identified Data and Aggregate Data only, under Section 6. It does not use identifiable Student Data to develop new products or improve the Services, other than to diagnose and repair the Services for the Customer under Section 5.2(h).

5.4 Prohibited uses. Ori Learning must not, and must not permit any Subprocessor or other recipient to: (a) sell, rent or trade Student Data, a prohibition that carries no exception, and disclose Student Data only as Section 3.5 permits, no disclosure this DPA permits being a Sale (Sections 5.9 and 15.2); (b) use Student Data or Persistent Identifiers for Targeted Advertising, on or off the Services; (c) engage in Profiling; (d) use Student Data to market to a Student or a Parent, or to anyone on the basis of Student Data, or use a Student’s name, image, voice, likeness or work in any marketing or promotional material; (e) use Student Data for any purpose other than providing the Services under the Agreement for the School-Authorized Educational Purpose, or for any independent or unrelated commercial purpose; (f) use the Customer’s identifiable Student Data for analytics, benchmarking or research across customers for Ori Learning’s own purposes; (g) use identifiable Student Data for product research, efficacy studies or case studies except at the Customer’s written direction and within Applicable Law; (h) combine Student Data with data from any other source except as needed to provide the Services, such as through a roster integration the Customer elects; (i) use Student Data to train, develop or improve an artificial-intelligence or machine-learning model, as Section 5.5 states; or (j) use Student Data for any purpose the law of the Customer’s state prohibits. Ori Learning places no advertising of any kind in the Platform.

5.5 Artificial intelligence. Ori Learning must not use Student Data or Persistent Identifiers to train, develop, test or improve any artificial-intelligence or machine-learning model, including a generative model, and must not authorize any Subprocessor to do so. The Platform contains no generative artificial-intelligence feature, chatbot, tutor or automated grading by a language model. The text-to-speech and translation services the Platform uses are narrow processing services identified on the Subprocessor Schedule: text-to-speech receives lesson text and returns synthesized audio; translation receives lesson and Curriculum Content text and any Student-written text the Platform sends for translation, and Ori Learning treats the translation service as a Subprocessor that receives Student Data. Ori Learning does not authorize any of those services to use what it sends them for training. Ori Learning’s internal content-authoring tools operate on Curriculum Content before publication and are not part of the Services. Ori Learning will not enable for the Customer any further feature that processes Student Data with artificial intelligence without first giving notice by email to the Customer’s privacy and security contact identified under Section 17.3 and, where the feature is a material change to the collection, use or disclosure of Student Data, obtaining the Customer’s renewed authorization under Section 15.4.

5.6 Audio Data. Audio Data is Student Data, and Ori Learning Deletes it no later than the Student’s response it belongs to, as the Retention Schedule states for its category 4.

5.7 Sensitive information. The Platform does not request a Student’s date of birth, health information, Social Security number, financial information, race, gender, home language, or any information about a Parent. A Student’s responses to Curriculum Content, including emotional-well-being check-ins and reflections, may reveal information about the Student’s feelings, experiences or circumstances; Ori Learning treats every such response as Student Data, uses it only under Section 5.2, and applies Section 8 to it.

5.8 Persistent Identifiers and Usage Data. Ori Learning uses Persistent Identifiers and Usage Data linked to a Student only for the purposes in Section 5.2, including security, performance and error monitoring; the Subprocessor Schedule identifies each Subprocessor that receives them. Ori Learning does not use, and does not authorize any Subprocessor to use, a Persistent Identifier of a Student for Targeted Advertising, for tracking a Student across other websites or services, or for a profile outside the School-Authorized Educational Purpose. Platform pages load fonts and similar resources from the providers listed on the Subprocessor Schedule, which receive the network information a browser sends with any web request; Ori Learning evaluates each such service and uses it only in compliance with Applicable Law and this DPA.

5.9 Consent-based uses. Where Applicable Law permits a use or disclosure of Student Data with consent, Ori Learning relies only on consent the Customer confirms in writing it has obtained from the Parent or, where rights have transferred, from the Eligible Student, and only for the use the consent describes. No consent authorizes a Sale.

6. De-identified Data and Aggregate Data

6.1 Standard. Ori Learning creates De-identified Data only by removing or obscuring all direct and indirect identifiers so that the remaining information does not identify a Student and there is no reasonable basis to believe it can be used to identify a Student, determined under 34 C.F.R. §99.31(b)(1) taking into account other reasonably available information and, where the law of the Customer’s state states a stricter standard, under that standard. Ori Learning documents the method and describes it to the Customer on request.

6.2 Permitted uses. Ori Learning may use: (a) De-identified Data to operate, maintain, support, develop and improve the Services, including internal research into the efficacy of the Curriculum Content that identifies no Customer, Site, Authorized User or Student; (b) Aggregate Data to report to the Customer on the use and outcomes of its own Students; and (c) De-identified Data or Aggregate Data in an external publication, marketing material, case study or testimonial, or in any use that would name the Customer or a Site, only with the Customer’s prior written approval, which the Customer may withdraw prospectively at any time. No use under this Section identifies a Student, a Parent or an Authorized User: information that identifies one is neither De-identified Data nor Aggregate Data, and any identifiable research or publicity use is a consent-based use under Section 5.9 requiring the consent Applicable Law demands of the rights-holder. Section 6.4 governs disclosure to a third party.

6.3 No re-identification. Ori Learning must not re-identify De-identified Data or Aggregate Data, attempt to do so, or combine it with other data for that purpose, and must not permit any recipient to do so.

6.4 Recipients. Ori Learning discloses De-identified Data only to a recipient bound in writing not to re-identify it and to use it only for a purpose Section 6.2 permits Ori Learning. Before disclosing De-identified Data derived from the Customer’s Student Data to a third party other than a Subprocessor, Ori Learning notifies the Customer and obtains its consent where the Customer’s law requires it.

6.5 Retention after Deletion. Ori Learning may retain De-identified Data and Aggregate Data after Deleting the Student Data from which they were derived only where they meet Section 6.1 and are used only under Section 6.2.

6.6 Identifier-bearing data. Ori Learning treats data that carries a Student’s name, username, Account identifier or Persistent Identifier as Student Data and not as De-identified Data, whatever its use or recipient.

7. Student populations and rights routing

7.1 The operating rule. Rights in Student Data belong to the Parent, or transfer to the Student, by operation of Applicable Law; FERPA, PPRA and IDEA each state their own transfer test (Section 7.7). Every Student is treated as a minor whose rights are exercised through the Customer unless the Customer identifies the Student to Ori Learning as an Eligible Student, stating under which law. The Customer’s roster and identifications are Ori Learning’s routing signal only: Ori Learning acts on the identification it holds, does not assume parental authority over a Student identified as an Eligible Student, does not represent that any Student consents for themselves, and tells the Customer where it has reliable information that the identified rights-holder is wrong.

7.2 Rights-holders and routing. (a) The Parent holds the rights Applicable Law gives a Parent until they transfer to the Student under Section 7.7. The Customer is the records custodian and the default channel for every request, and holds the authority FERPA and the law of its state give it; it does not hold the Parent’s or the Student’s rights, and every direct statutory route, including Section 7.3(b), is preserved. (b) For a Student under 13, the Parent also holds the rights in Section 4.7 directly against Ori Learning. (c) Ori Learning processes every Student’s Personal Information only for the School-Authorized Educational Purpose and the operational uses Sections 5.2(g) and (h) reserve. (d) Where a Student holds their own rights under IDEA, as the Customer determines under 34 C.F.R. §300.520 and the law of its state, Section 8 applies.

7.3 Where requests go. A Parent, Student or Eligible Student makes a request about Student Data to the Customer, which holds the records and the authority to answer. A request that reaches Ori Learning is acknowledged within 5 Business Days, referred to the Customer’s privacy and security contact identified under Section 17.3, and assisted under Section 7.4. Ori Learning does not release Student Data directly to a requester except: (a) in response to a verified request under Section 4.7; (b) where the law of the Customer’s state gives a Parent, Student or Eligible Student a right to make the request directly to Ori Learning, in which case Ori Learning honors it after verification and notifies the Customer; or (c) at the Customer’s written direction.

7.4 Assistance and clocks. Ori Learning completes a Customer-directed access, correction, export or Deletion request within 30 days after receiving it, or within the shorter period Section 16.3 applies, and gives the Customer the information and records it needs to meet its own deadlines under Applicable Law. The assistance this Section and Applicable Law ordinarily require is included in the subscription at no fee. Where a request is extraordinary, repetitive or requires custom work, Ori Learning may charge a reasonable fee the parties agree in advance, to the extent Applicable Law and the Customer’s executed Data Privacy Agreement, where one exists, permit.

7.5 Verification. Before acting on a request from an individual, Ori Learning verifies the individual’s identity and authority by a method reasonable in light of the sensitivity of the Student Data involved; the Customer’s written confirmation satisfies this Section. Ori Learning releases nothing to a requester it cannot verify.

7.6 Correction. The Customer corrects roster and Account information through its Administrator tools. For other Student Data, Ori Learning corrects or annotates the record at the Customer’s direction within the period in Section 7.4 and confirms the correction in writing; where it cannot make a requested change, it tells the Customer why.

7.7 Transfer of rights. Rights transfer by operation of law under the test of the law concerned: the rights FERPA gives Parents transfer when the Student turns 18 or attends a postsecondary institution (34 C.F.R. §99.5); the rights PPRA gives Parents transfer when the Student turns 18 or is an emancipated minor (20 U.S.C. §1232h(c)(5)(B)); and the rights IDEA gives Parents transfer at the age of majority under the law of the Customer’s state, where that law provides for the transfer, subject to its exceptions (34 C.F.R. §300.520). The Customer tells Ori Learning when a transfer has occurred so that requests are routed correctly.

7.8 Requests after the Term. Ori Learning honors requests under this Section for as long as it holds the Student Data concerned; after Deletion, it confirms the Deletion in place of any other response.

8. IDEA Part B and PPRA safeguards

8.1 IDEA Data. Student Data that is collected, maintained or used to deliver, document, evaluate or maintain a service, plan or transition activity for a Student under Part B of the Individuals with Disabilities Education Act is “IDEA Data”, whether or not the Customer has labeled it; the Customer’s written notice or the Platform configuration it sets (Master §4.5) serves to identify the records concerned, not to define them. Because the Services are used to deliver services under individualized education programs, Ori Learning applies the safeguards in Section 8.2 to all Student Data. An indicator that a Student has an individualized education program or a Section 504 plan is the only special-education element Ori Learning receives; it receives no plan, accommodation record or other special-education document.

8.2 Safeguards. Ori Learning: (a) protects the confidentiality of IDEA Data at collection, storage, disclosure and destruction under Section 10, the Security Exhibit and the Retention Schedule; (b) assigns responsibility for its confidentiality to one official, the Privacy Contact in Section 17.3; (c) instructs each of its Personnel who collect or use IDEA Data, before their first access and with completion recorded, on the confidentiality requirements of 34 C.F.R. Part 99 and §§300.610 to 300.627 and on the policies and procedures of the Customer’s State under 34 C.F.R. §300.123 to the extent the Customer supplies them; (d) keeps, from the date the Security Exhibit states, a current list of the names and positions of the Personnel, and of the Subprocessor roles, that may access IDEA Data, supplies it to the Customer on request for the Customer’s own public-inspection duty, and keeps a record of the name, date and purpose of every other party that obtains access to IDEA Data, other than a Parent or an authorized employee of the Customer whom 34 C.F.R. §300.614 exempts, contractors, Subprocessor personnel and downstream providers included, which it supplies on request; (e) Deletes IDEA Data the Customer directs it to Delete following a request from a Parent or rights-holder, on the Customer’s determination that the data is no longer needed, leaving to the Customer any permanent record its law allows; and (f) routes every request under Section 7 to the Customer, which identifies the rights-holder.

8.3 Protected information surveys. Ori Learning designs the Curriculum Content not to ask Students to reveal information in the categories listed in 20 U.S.C. §1232h(b). A Customer that believes an item does may ask Ori Learning to review it, and at the Customer’s direction Ori Learning removes the item from the Customer’s assignments.

9. Subprocessors

9.1 Authorization and the Subprocessor Schedule. The Customer authorizes Ori Learning to engage the Subprocessors listed on the Subprocessor Schedule in the version the Order Form identifies, as changed during the Subscription Term under Section 9.6; the Schedule is published at orilearning.com/legal/subprocessors/ and states for each Subprocessor its legal entity, function, the categories of data it receives, whether it receives Student Data, its processing location and the terms under which it processes. Roster and sign-in integrations the Customer chooses and contracts for separately, such as Clever, ClassLink, Google Sign-In and Microsoft sign-in, are the Customer’s own arrangements under Master §3.4 and are not Subprocessors; Ori Learning exchanges Student Data with them only as the Customer’s integration requires and directs.

9.2 Subprocessor diligence and terms. Before a Subprocessor receives Student Data, Ori Learning evaluates its ability to protect the data and ensures that its written terms, which may be its standard published data-protection terms, require it to protect Student Data consistent with this DPA and limit its use to providing its services to Ori Learning. Ori Learning takes reasonable steps to disclose Student Data only to Subprocessors capable of maintaining its confidentiality, security and integrity whose terms provide assurances that they will do so (16 C.F.R. §312.8). Ori Learning does not authorize any Subprocessor to use Student Data to train an artificial-intelligence or machine-learning model.

9.3 The chain. Ori Learning relies on each Subprocessor’s terms for the protection of Student Data by any further subprocessor it engages.

9.4 Responsibility. Ori Learning remains responsible to the Customer for each Subprocessor’s performance as if it were its own; a Subprocessor’s act or omission is Ori Learning’s under this DPA.

9.5 A Subprocessor in breach. If a Subprocessor materially breaches the terms described in Section 9.2, Ori Learning promptly suspends or ends its access to Student Data and, where the Customer’s Student Data is affected, notifies the Customer under Section 11.

9.6 Changes. Ori Learning keeps the Subprocessor Schedule current and notifies the Customer’s privacy and security contact identified under Section 17.3 by email of changes to it. A Customer that objects to a change on reasonable grounds relating to the protection of Student Data may terminate the affected Services on written notice and receive a refund of prepaid Fees for the remainder of the Subscription Term.

9.7 Recipient history. On request, Ori Learning lists, from the records it keeps and to the extent reasonably available, the Subprocessors and other recipients that received the Customer’s Student Data during the period the Customer specifies within the three years before the request, including recipients no longer engaged. Where the Customer’s law requires a recurring update of the recipient list, Ori Learning provides it on the dates that law states.

9.8 Development and support. Development of the Platform is performed in the United States under the direction of Ori Learning’s Chief Technology Officer, by Personnel bound by written confidentiality terms. A software-development contractor Ori Learning engages is a Subprocessor, listed on the Subprocessor Schedule with its function, its country and the scope of its access, and Sections 9.2 to 9.6 apply to it, where it processes Customer Data or can access systems that contain it; a contractor that does neither is bound, as to each individual it assigns, under Section 10.2(c). Support is provided by Ori Learning Personnel under the access controls the Security Exhibit describes. Ori Learning limits its Personnel’s access to Student Data to what their work requires, scopes it by environment, authenticates it individually and, from the dates the Security Exhibit states, logs it, as the Security Exhibit describes.

10. Security

10.1 The Information Security Program. Ori Learning maintains a written Information Security Program with administrative, technical and physical safeguards appropriate to the nature of Student Data, including the special-education indicators, emotional-well-being responses and Audio Data it holds, that meet the reasonable-security standard Applicable Law requires of Ori Learning and are designed to protect Student Data against unauthorized access, destruction, use, modification and disclosure, organized by reference to the NIST Cybersecurity Framework 2.0, which is a reference and not a mapping, certification or conformance claim, as the Security Exhibit states. The Security Exhibit describes the program, its incident handling and the responsible roles, is materially accurate as of its version date as Master §10.5 warrants, and states the milestone by which any item it describes as Adopted takes effect.

10.2 Commitments. Under the Information Security Program, Ori Learning: (a) encrypts Student Data in transit and, in the data stores the Security Exhibit identifies, at rest; (b) limits access to Student Data to Personnel and Subprocessors who need it to perform the Services, authenticates its Personnel individually, and limits Authorized Users’ access by role and configuration under Section 3.4, with the authentication controls the Security Exhibit describes; (c) requires each of its employees and contractors with access to Student Data to be bound by written confidentiality obligations, a Subprocessor’s personnel being covered by the terms in Section 9.2; and, in each case from the dates the Security Exhibit states, screens each of its employees and contractor individuals before access by identity verification, reference check and a criminal-background check to the extent the law where the person is employed permits, and trains its Personnel on privacy and security before access and at least annually; (d) logs and monitors access to production systems, from the dates the Security Exhibit states, and manages vulnerabilities and patches as the Security Exhibit describes; (e) maintains the Incident Response Plan and tests it as the Security Exhibit states; (f) assesses the risks to Student Data at least annually, from the date the Security Exhibit states, and before any material change to the Platform; (g) stores Student Data held in the Platform at rest in Microsoft Azure data centers in the United States, describes on the Subprocessor Schedule where each Subprocessor processes the data it receives, and permits access to Student Data from outside the United States only by Personnel and Subprocessors under (b); (h) does not materially reduce the overall security of the Services during a Subscription Term; and (i) identifies in the Security Exhibit the certifications, audit reports and test results it holds, and claims none it does not hold.

10.3 The Customer’s part. The Customer manages its Authorized Users and their credentials, keeps its rosters accurate, secures the devices and networks through which its Authorized Users reach the Platform, and tells Ori Learning promptly if it suspects an Account has been compromised. Ori Learning is not responsible for a failure in the security of the Customer’s systems, or of a Third-Party Component the Customer elects, to the extent the failure lies within the Customer’s or the third party’s control; Ori Learning remains responsible for the Platform, for its own implementation of an integration, for the credentials and interfaces it issues and for the data transmissions it performs.

11. Security Incidents and Unauthorized Releases

11.1 Scope. This Section applies to any Unauthorized Release of the Customer’s Student Data held by Ori Learning or a Subprocessor. An unsuccessful attempt that results in no Unauthorized Release, and an outage involving no unauthorized access, are not reportable under this Section. Ori Learning notifies the Customer of an unauthorized acquisition of its other Customer Data when and as Applicable Law requires.

11.2 Notice. Ori Learning notifies the Customer without unreasonable delay, and no later than 72 hours after it confirms an Unauthorized Release of the Customer’s Student Data, unless a law-enforcement agency directs a delay, in which case it notifies the Customer as soon as the agency permits.

11.3 Contents of the notice. The notice under Section 11.2 states, to the extent known: (a) a plain-language description of the incident; (b) the date or period of the incident and the date of discovery; (c) the categories of Student Data affected and, once known, the Students affected and their number; (d) the steps taken and planned to contain, investigate and remediate it; (e) whether law enforcement has been notified; (f) the facts bearing on notification, Ori Learning’s determination of its own notification duties, and the information the Customer needs to make its own determination, without stating whether a notice is required of the Customer; and (g) the contact details of the person handling the incident, whom the Customer may identify to Parents.

11.4 Delivery. Ori Learning delivers notices under this Section by secure means to the Customer’s privacy and security contact identified under Section 17.3 and to one authorized fallback contact the Customer designates, and by telephone where the urgency warrants it. Administrators receive only a non-sensitive routing notice where one is needed to reach the designated contacts.

11.5 Updates and summary. Ori Learning updates the Customer as material facts become known and, on the Customer’s request after the incident is resolved, gives it a written summary of the incident’s cause and the remediation performed. The summary states no conclusion about liability; Section 11.10 states when an incident is a breach of this DPA.

11.6 Cooperation and preservation. Ori Learning cooperates with the Customer’s investigation and provides the logs, forensic findings and records reasonably available to it, subject to legal privilege and work product, to a direction of law enforcement, to obligations of confidence owed to third parties, to the protection of other customers’ data and to the protection of security-sensitive material; where raw production would create risk, Ori Learning provides redacted material, a factual summary or secure inspection instead. Ori Learning preserves the evidence and records relating to the incident, cooperates with law enforcement, and relies on each Subprocessor’s terms for notice of incidents affecting Student Data.

11.7 Notices to individuals and authorities. The Customer decides whether, when and how to notify Parents, Students, Eligible Students and governmental authorities about an incident affecting its Student Data; Ori Learning provides draft content following the list in Section 11.3, the list of affected Students and the assistance the Customer reasonably requests. Where Applicable Law requires Ori Learning itself to give a notice, it gives the notice and coordinates content and timing with the Customer; otherwise it does not notify the Customer’s Parents, Students or authorities on its own initiative. At the Customer’s written direction and reasonable cost, Ori Learning gives the notices the Customer specifies on the Customer’s behalf. Where a binding law, a court order, a valid direction of a law-enforcement agency or a statutory law-enforcement exception requires that the content of a notice be delayed, Ori Learning delays only that content, only for as long as the direction or exception requires, records the direction, and continues to give every element that lawfully can be given; no delay under this Section extends a period that Applicable Law does not permit to be extended, including the seven-day notice owed to a New York educational agency under 8 N.Y.C.R.R. §121.10(a).

11.8 Costs. Each party bears its own costs of investigating and remediating an incident, except that Ori Learning reimburses the Customer’s reasonable, documented costs of the notices Applicable Law requires the Customer to give, to the extent the Unauthorized Release was caused by Ori Learning or its Subprocessors. Amounts under this Section are direct damages under Master §12.1 and are subject to Master §12.3.

11.9 Statutory periods. Nothing in this Section delays or narrows a notice that Applicable Law requires Ori Learning to give within a shorter period or on a broader trigger. A period that binds Ori Learning directly applies without the Customer identifying its law; Section 16.3 governs a period that depends on the Customer’s own law.

11.10 An incident is not by itself a breach. An Unauthorized Release is not by itself a breach of this DPA. A breach occurs where Ori Learning fails to perform an obligation in this DPA, including in Sections 9, 10 and 11.

12. Retention, return and Deletion

12.1 Retention principle. Ori Learning retains Student Data only for as long as reasonably necessary for the purposes in Section 5 and the Customer’s instructions, and never indefinitely, and Deletes it within the period the Retention Schedule states after that purpose ends. The Retention Schedule states, for each category of data, its purpose, the business need for retaining it, its retention period, the event that triggers Deletion, and the Backup rotation.

12.2 Deletion during the Term. The Customer may Delete a Student’s Account and Student Data through its Administrator tools where the Platform provides them, or direct Ori Learning in writing to Delete any Student Data, whether for a Student, a class, a Site or an identified category. Ori Learning Deletes Student Data promptly, and in any case within 30 days after the Customer’s written request. Where the Customer notifies Ori Learning that a Student has left the Customer, Ori Learning Deletes that Student’s Student Data within 90 days after the notice, or sooner on request. The Customer may record a standing disposition instruction for the end of the Term (return, Deletion, or both, and any data to exclude) on the Order Form or in writing at any time; absent one, Section 12.4 applies.

12.3 Export. During the Export Window under Master §6.5, the 60 days after the date the Services actually end, the Customer may export Customer Data through any export function the Platform offers, and on request Ori Learning provides Customer Data to the Customer in a machine-readable format the Customer can use, with reasonable assistance at no charge, by email during Support Hours, to complete the export and confirm that it is complete. Transformation of exported data, migration into another system and assistance beyond that level are Professional Services (Master §6.5). During the Term the Customer may export on reasonable request in the same way.

12.4 Deletion at the end of the Term. Ori Learning Deletes the Customer’s Customer Data, including Student Data, within 30 days after the earlier of the Customer’s written confirmation that its export is complete and the end of the Export Window, and in any case no later than 90 days after the date the Services under the Order Form actually end (which a continuation under Master §6.2 postpones), unless the Customer has renewed, has directed earlier Deletion, has given a written transition instruction stating its purpose, a maximum duration and an expiry date, or a Legal Hold applies. After the Subscription Term ends, Ori Learning uses Customer Data for no purpose other than export, Deletion and compliance with a Legal Hold.

12.5 How Deletion is performed. Ori Learning Deletes the live records so that they are no longer accessible or recoverable through the Platform, and instructs each Subprocessor holding the data to do the same. Backups are retained for disaster recovery for a limited period on a rotating basis, are inaccessible for ordinary use, and are overwritten in the ordinary course. Ori Learning does not restore Deleted Student Data from a Backup except to recover the Platform as a whole, and if it does, it Deletes the restored data again promptly after the recovery. Ori Learning does not represent that Deleted data is immediately unrecoverable from every Backup; it represents that the data ages out of Backups as the Retention Schedule states.

12.6 Certification. Ori Learning gives the Customer a written certification within 10 Business Days after completing the Deletion under Section 12.4, without request, and within 10 Business Days after any other Deletion on the Customer’s reasonable request. The certification states what was Deleted, the date of Deletion, the method at a non-sensitive level, the Subprocessors instructed and whether each has confirmed, that Backups age out on their rotation, and any Legal Hold exception, with the further content the Retention & Deletion Schedule §8 states.

12.7 Exceptions. Sections 12.2 and 12.4 do not require Deletion of: (a) data subject to a Legal Hold, for so long as the hold lasts, and data held under a transition instruction (Section 12.4), which is not a Legal Hold, until its expiry; (b) material preserved under Section 14; (c) De-identified Data and Aggregate Data retained under Section 6.5; (d) Ori Learning’s business records of the Customer relationship, such as agreements, invoices and support correspondence with Authorized Users, to the extent they contain no Student Data; (e) operational logs and security records, which are used for no purpose outside Section 5.2 and are retained and Deleted on the periods the Retention Schedule states; and (f) Student Data held under a consent to continued retention that the Customer conveys in writing under Section 5.9, for the purpose, scope and period the consent covers.

12.8 Shorter periods. Where the Customer’s executed Data Privacy Agreement or Applicable Law requires a shorter period, that period applies.

13. Access, correction, export, audits and cooperation

13.1 District-directed access, correction and export. The Customer’s Administrators and Teachers view Student Data through the Platform. On the Customer’s written request, Ori Learning provides a copy of a Student’s Student Data, makes a correction under Section 7.6, or provides an export under Section 12.3, within the period in Section 7.4. On the Customer’s request, or a request from a Student or Parent routed under Section 7, Ori Learning provides a copy of a Student’s Student-Generated Content in a common machine-readable format to the Customer or, at the Customer’s direction, to the Student or Parent, so that the Student may keep it or move it to an account the Student designates.

13.2 Questionnaires and assessments. Once in each 12-month period after the Effective Date, and before the Effective Date as part of the Customer’s diligence, Ori Learning completes the Customer’s reasonable written privacy and security questionnaire and provides, under the confidentiality terms of the Agreement and with security-sensitive detail redacted and privileged and work-product material excluded, the standardized summaries of any assessments, audits and test results the Security Exhibit identifies; it also answers reasonable requests related to a Security Incident affecting the Customer’s Student Data at any time.

13.3 Audits. An on-site audit, or an audit by a third party the Customer engages, takes place only by written agreement, no more than once in any 12-month period, on at least 30 days’ notice, during business hours, at the Customer’s expense, under confidentiality obligations, scoped to the systems and records that process the Customer’s Student Data, and without access to other customers’ data or to a Subprocessor’s facilities beyond the reports the Subprocessor publishes. A recognized third-party audit report covering the requested scope, where Ori Learning holds one, may be provided in place of an audit. Security testing of the Platform by or for the Customer, such as vulnerability scanning or penetration testing, takes place only under a written agreement with Ori Learning that states its scope, timing, methods and rules of engagement, and never touches another customer’s data.

13.4 Regulators. Where a governmental authority with jurisdiction over the Customer is entitled by Applicable Law to inspect or audit Ori Learning’s processing of the Customer’s Student Data, Ori Learning cooperates.

13.5 Cooperation with the Customer’s duties. Ori Learning helps the Customer respond to inquiries from the U.S. Department of Education’s Student Privacy Policy Office, a state education agency or another authority, and to complaints from Parents, Students and Eligible Students, where they concern the Customer’s own Student Data and the request is reasonable and relevant, with information within Ori Learning’s control and on timing the parties agree. Ori Learning provides the information the Customer needs for its data inventories, contract postings, provider lists and annual notices, including a description of the Student Data collected and the purposes for which it is used, in a form the Customer can publish. Assistance under this Section is included in the subscription; Ori Learning may charge a reasonable fee the parties agree in advance for extraordinary work, unless the matter arises from Ori Learning’s breach of this DPA.

13.6 Posting. The Customer may post this DPA, its Exhibits, Annex A and the Order Form, and may disclose them under a Public Records Request, as its law requires. Ori Learning identifies the parts of the Security Exhibit that are security-sensitive so the Customer can redact them where its law allows. No confidentiality term in the Agreement prevents a disclosure the Customer’s law requires. On request, Ori Learning promptly supplies the responsive, Customer-specific records it holds that are reasonably available and legally disclosable, subject to legal privilege, to any statutory exemption, to the security-sensitive redaction this Section provides, to other customers’ information, and to reasonable effort and cost.

13.7 Records. Ori Learning keeps records of the disclosures in Section 3.5, of Deletions and certifications under Section 12, and of the requests it handles under Sections 4.7 and 7, for the period the Retention Schedule states for each category of record, minimizing or de-identifying the Student Data they contain where it can, and provides the Customer on request with the records that concern the Customer. These records survive as Section 15.1 states.

14. Lawful disclosures and mandatory reporting

14.1 Legal process. Ori Learning discloses Student Data in response to a judicial order or a lawfully issued subpoena, or to another demand for which both an exception under 34 C.F.R. §99.31(a)(9) and a basis under the law of the Customer’s state exist, only to the extent the demand requires, and does so on the Customer’s behalf only where the conditions of 34 C.F.R. §99.33(b) hold. Before complying, Ori Learning notifies the Customer and gives it the opportunity to seek protection from the demand, unless Applicable Law prohibits the notice, in which case Ori Learning notifies the Customer as soon as the prohibition ends. The advance notice to the Parent or Eligible Student that 34 C.F.R. §99.31(a)(9)(ii) requires is given by the Customer, or by Ori Learning at the Customer’s direction, and Ori Learning records which; no advance notice is given where the disclosure complies with a federal grand jury subpoena or another subpoena issued for a law-enforcement purpose whose issuing court or agency has ordered that its existence or contents not be disclosed, or with an ex parte court order under 20 U.S.C. §1232g(j). An emergency under Section 14.2 is not a demand under this Section.

14.2 Health or safety emergencies. Ori Learning discloses Student Data in connection with a health or safety emergency only at the Customer’s direction, under the standing authorization in this Section, or where Applicable Law requires the disclosure of Ori Learning itself, applying the standard in 34 C.F.R. §99.36 and notifying the Customer as soon as possible. By designating a safety contact under Section 14.5, the Customer authorizes Ori Learning, where that contact and the Customer’s other designated contacts cannot be reached in time and a person appears to be in imminent danger, to disclose on the Customer’s behalf to emergency services or law enforcement the Student Data necessary to address the emergency, and nothing more. Where Applicable Law does not permit Ori Learning itself to make that disclosure — as New York Education Law §2-d does not for a New York educational agency’s Student Data — the standing authorization does not apply: Ori Learning refers the matter at once to the Customer’s safety contact and its other designated contacts, and any disclosure under 34 C.F.R. §99.36 is the Customer’s own to make and record.

14.3 Mandatory reports. Nothing in the Agreement prevents Ori Learning or any of its Personnel from making a report that Applicable Law requires of them, including a report of suspected child abuse or neglect to the authority the law designates and a report of apparent child sexual exploitation material to the National Center for Missing & Exploited Children under 18 U.S.C. §2258A, or from preserving the material such a report requires. Ori Learning notifies the Customer of such a report where Applicable Law permits and the notice is consistent with the safety of the child concerned.

14.4 No duty to monitor. Ori Learning does not routinely or proactively review Student-Generated Content and undertakes no duty under the Agreement to do so; its Personnel may encounter content incidentally, for example in support, administration and the handling of reports. Its reporting duties arise only where its Personnel acquire actual knowledge or reasonable cause in the course of their work. The Customer’s Teachers supervise Collaboration Boards and Student work as the Acceptable Use Policy describes.

14.5 Safety escalation. The Customer designates a safety contact on the Order Form or through an Administrator in writing. Where Ori Learning’s Personnel, in the course of their work, actually encounter content that a reasonable person would regard as a credible threat to the safety of a Student or another person, Ori Learning refers it promptly to that contact during Support Hours (Acceptable Use Policy §7.2); where that contact and the Customer’s other designated contacts cannot be reached in time and a person appears to be in imminent danger, Section 14.2 applies. Ori Learning exercises no clinical judgment and does not assess a Student’s condition or risk; the Services are not a crisis service (Master §10.8). Nothing in this Section displaces a report that Applicable Law requires of Ori Learning or its Personnel, and Ori Learning is a mandatory reporter only where Applicable Law makes it one.

14.6 Notice and effect. Ori Learning notifies the Customer as soon as possible after any disclosure under this Section, unless Applicable Law prohibits the notice. A disclosure or preservation under this Section is an exception to Sections 3.5, 5 and 12; material preserved is retained only for as long as, and used only for the purpose that, Applicable Law requires.

15. Term, survival and effect of termination

15.1 Term and survival. This DPA takes effect on the Effective Date or, if earlier, when Ori Learning first receives the Customer’s Customer Data, and continues, whether or not the Master or any Order Form has ended, for as long as Ori Learning or any Subprocessor holds any Customer Data, including Student Data, of the Customer. For that period the following survive: confidentiality; the purpose and use limits in Sections 3, 5 and 6; security under Section 10; incident response under Section 11; lawful disclosure and preservation under Section 14; export, Deletion and certification under Section 12; the records in Section 13.7; and the Customer’s rights to enforce them. Performance duties that presuppose a live subscription, including questionnaires and audits under Sections 13.2 and 13.3 and change notices under Sections 9.6 and 15.4, end with the Term.

15.2 Successors. Ori Learning may assign this DPA only as Master §15.2 (assignment and change of control) permits, and only to a successor that has assumed this DPA in writing before it receives any Student Data. A successor uses Student Data only within the purposes and restrictions that applied before the transfer; a transfer to a successor bound in this way is not a Sale. If a successor does not assume this DPA, the Customer may terminate the Agreement and receive the refund Master §15.2 provides.

15.3 Versions. This DPA, Annex A, the Security Exhibit and the Retention Schedule are locked to the versions identified on the Order Form for the Subscription Term, subject to the Annex A rule in this Section and to the improvement rule in this sentence: a new version of the Security Exhibit or the Retention Schedule that does not materially diminish the overall protection it describes, and that neither lengthens a Deletion deadline nor reduces a protection for Student Data, applies to the Customer from its effective date with notice given by email to the Customer’s privacy and security contact identified under Section 17.3, the version the Order Form identifies remaining the minimum protection for the Subscription Term. A new version applies to the Customer at its next renewal Order Form, or earlier only by written agreement signed by both parties. The Subprocessor Schedule applies in its current published version and changes under Section 9.6. A new element is added to Annex A only with at least 30 days’ notice given by email to the Customer’s privacy and security contact identified under Section 17.3 and, where the addition is a material change to collection, use or disclosure, with the Customer’s renewed authorization under Section 15.4; an element is removed from Annex A only once the Platform has stopped collecting it.

15.4 Changes to practices and notices. A material change to the collection, use or disclosure of Student Data previously authorized under Section 4.2 takes effect for the Customer only after Ori Learning has given notice of it and the Customer has renewed its authorization under Section 4.2, given by its Designated Representative or, on the Customer’s behalf, by an Administrator, by acceptance in the Platform or by email, and Ori Learning has recorded the renewal as Section 4.3 provides. Any other change to the Student & Education Privacy Notice or the COPPA Direct Notice to Schools takes effect on at least 30 days’ notice given by email to the Customer’s privacy and security contact identified under Section 17.3, with its Administrators copied. No change during a Subscription Term materially reduces the protection of Student Data under this DPA or alters a signed commercial term, and a change that is materially inconsistent with this DPA or with Applicable Law takes effect for the Customer only with its written consent.

15.5 Cure period. A breach of this DPA that is capable of cure must be cured within 15 days after written notice describing it, which is the period Master §6.4(a) refers to. Section 11.10 states when an incident is a breach.

16. Applicable law and state-required terms

16.1 Severance. Where a law that applies to the Customer makes a term of this DPA void or unenforceable for that Customer, that term is severed for that Customer and to that extent, and the rest of this DPA remains in effect; a term the Customer’s law requires the parties’ agreement to contain is supplied by the Customer’s own Data Privacy Agreement or by a State Addendum executed for the Customer (Section 1.3(a) and (b)), not by this Section.

16.2 State forms. Where the law of the Customer’s state prescribes an official form of agreement, supplement, plan or certification for the parties’ arrangement, Ori Learning executes the current official form, or the applicable state supplement to a National Data Privacy Agreement, after review, and the executed instrument then controls as Section 1.3(a) or (b) states. A modified version is reviewed under Section 1.4.

16.3 Shorter statutory periods. A period that Applicable Law imposes on Ori Learning directly applies without the Customer identifying its law. Where a law that applies to the Customer requires a shorter period than this DPA states for a notice, a Deletion or a response to a request, Ori Learning meets the shorter period for that Customer, the states identified on the Order Form being the Customer’s standing identification of their student-privacy and breach-notification laws for that purpose and any other law being identified by later written notice, which Ori Learning validates before it changes an operational deadline; this Section reaches periods only.

16.4 State Addenda and the New York package. Where a State Addendum is executed for the Customer, including the New York package for a Customer that is a New York educational agency, the State Addendum supplements this DPA and, as to its subject matter, controls over it for that Customer, as Section 1.3(b) states. Ori Learning maintains the New York package and makes it available with this DPA to every New York Customer.

16.5 Governing law. Master §14 governs the law and forum that apply to this DPA.

17. Execution

17.1 Incorporation. This DPA becomes part of the Agreement when the Customer accepts an Order Form that incorporates it, directly or by naming the Master Subscription Agreement as Master §1.3 provides; no separate signature is required. The Customer’s acceptance of the Order Form, given by the school official who signs it or whom the Order Form names, is its designation under Section 3.1, its authorization under Section 4.2 and its identification of the Designated Representative under Section 4.3; a purchase order alone performs none of them until that official confirms them in writing, and Ori Learning records the confirmation before it rosters any Student. The Customer confirms that the individual who accepts the Order Form is authorized to give that designation and authorization on its behalf, or names an authorized individual under Section 4.3 before Student Data is provided.

17.2 Countersignature. Where the Customer requires a signed instrument, the parties sign below, and the signed DPA together with the Order Form is their executed agreement. Each signatory represents that they are authorized to bind the party for which they sign. Master §15.8 governs counterparts and electronic signatures.

17.3 Contacts. Ori Learning’s contact for privacy, security, incident notices and requests under this DPA (the “Privacy Contact”) is its Privacy Officer, the officer it designates as responsible for privacy, at SpecialNeedsWare, Inc. dba Ori Learning, Attention: Legal, 66 Summit Ave, Chatham, NJ 07928; [email protected], which Ori Learning reads on Business Days. Incident notices from Ori Learning are issued by its Security Officer, the Chief Technology Officer, as the Security Exhibit states; the telephone number for incident escalation, answered on Business Days, is stated there. The Customer’s contacts for this DPA are the privacy and security contact, the incident fallback contact and the safety contact identified on the Order Form or designated by an Administrator in writing, and its Administrators. Each party keeps its contacts current by written notice.

17.4 Signatures.

For the Customer	For Ori Learning
(Customer legal name)	SpecialNeedsWare, Inc. dba Ori Learning
Name: (Name)	Name: Jonathan Izak
Title: (Title)	Title: Chief Executive Officer
Date: (Date)	Date: (Date)
Signature: (Signature)	Signature: (Signature)

Annex A — Data Schedule

This Annex lists the categories and elements of Student Data and other Customer Data that Ori Learning collects through the Services (the Products identified on the Order Form, drawn from Ori Learning’s Transition and Emotional Well-Being curriculum product lines), by role and source. It is drafted so that it can be attached as the schedule of student data to a National Data Privacy Agreement. The Customer decides which elements it supplies through its roster, within the roster fields the Platform accepts as the Documentation describes. “Roster” means data the Customer supplies through an Administrator, a bulk import or a roster integration; “Use” means data generated when an Authorized User uses the Platform.

Category	Elements Ori Learning collects	Source
Student name	First name and last name	Roster
Student identifiers	Platform-assigned Student identifier; username; password; the identifier assigned by a roster or sign-in provider the Customer elects	Roster; Use
Student contact information	Email address, where the Customer supplies one. No other contact information	Roster
Enrollment	School (Site); grade level; assigned Teacher; guidance counselor; curriculum program	Roster
Schedule	Courses and Teacher names that form the Student’s schedule	Roster
Special indicator	An indicator that the Student has an individualized education program or a Section 504 plan. Not the plan, any accommodation record or any other special-education document	Roster
Assessment and in-Platform performance	Responses to assessments, pre- and post-surveys and check-ins; grades and performance scores on Curriculum Content, held as in-Platform performance and course records	Use
Student work	Responses and work Students submit, which may include text, files and audio	Use
Audio Data	Audio a Student records or speaks through the Platform to answer an item (Section 5.6); Deleted no later than the Student’s response it belongs to, as the Retention Schedule states for its category 4	Use
Communications	Posts to a Collaboration Board, which are visible to classmates in the same session; likes	Use
Application technology metadata	Internet Protocol address; cookies and similar identifiers the Platform sets; device, browser and general location information	Use
Application use statistics and telemetry	In-Platform interaction data (lessons, units, courses and sessions started and completed); client error and performance telemetry from every portal, including the Student Portal; this records use of the Platform and is not an attendance record	Use

Not requested. The Platform does not request a Student’s date of birth, race, gender, home language, standardized test scores, observation data, local or state student identification numbers, transportation data, program-membership data, health information, financial information or Social Security number, and requests no information about a Parent; the Platform has no Parent role. Where a Customer supplies an element the Platform does not request, the Customer controls it and this DPA applies to it as Student Data.

Staff data. For Teachers and Administrators: first name, last name, email address, school and, where supplied, a telephone number. For every staff Account: the role assigned in the Platform and, for a Publisher, the account information the Platform holds for that role. All staff Accounts generate the same technology metadata and telemetry as Students. Staff data is Customer Data.

Recipients. The Subprocessor Schedule states which Subprocessors receive each category. The Subprocessors that perform product-usage and customer-success analytics receive, for Students, usage events under a pseudonymous identifier, never a Student’s name, username or contact details. The Platform’s sync to Ori Learning’s customer-relationship system sends only aggregate counts of active Student and Teacher Accounts for the Customer and no individual Student record; Student information that reaches that system through a support note or another route is handled under Retention & Deletion Schedule category 11.

Currency. This Annex reflects Ori Learning’s data inventory as of its version date. Ori Learning provides its current element-level inventory to the Customer on request, and updates this Annex under Section 15.3 when the Platform changes what it collects.

Exhibit 1 (Security & Incident Exhibit), Exhibit 2 (Subprocessor Schedule) and Exhibit 3 (Retention & Deletion Schedule) are separate documents that form part of this DPA in the versions the Order Form identifies.