SpecialNeedsWare, Inc. dba Ori Learning · Version v2026.09 · Effective September 23, 2026
Download this document as a PDF (v2026.09)
Exhibit 3 to the Data Privacy Addendum
1. Scope and relationship to the Agreement
1.1 This Schedule is Exhibit 3 to the Data Privacy Addendum and forms part of it (DPA §1.2). For each category of Customer Data, including Student Data, it states why Ori Learning holds the data and the business need for holding it, for how long, the event that ends retention, how Deletion is performed and what happens in Backups (DPA §12.1). With DPA §12 it is Ori Learning’s written retention policy for Personal Information collected from Students (DPA §4.8). It is drawn from Ori Learning’s Data Retention & Deletion Policy, which is available to the Customer on request; this Schedule is the complete external commitment, and the Policy may hold more detail or stronger controls without being warranted.
1.2 DPA §1.3 states the order of precedence. A period that Applicable Law imposes on Ori Learning directly, as operator, applies automatically and needs no identification by the Customer. A shorter period in a Data Privacy Agreement executed by the parties, a State Addendum, an Order Form variation signed by both parties, or a law of the Customer’s own that DPA §16.3 reaches, the states on the Order Form being the Customer’s standing identification, applies for that Customer.
1.3 Every row in Section 4 carries a status, using three labels. I · In place and A · Adopted have the meanings given in the Ori Learning Definitions: In place is a practice that operates as at the version date; Adopted is a dated commitment that applies from the Adoption Date, September 23, 2026, or from the later date the row states. C · Contractual commitment is a label used only in this Schedule: a period or event Ori Learning undertakes from the Effective Date, whatever the Platform does by default, performed by hand where the Platform does not perform it automatically. Every period for Student Data in Section 3 is a Contractual commitment from the Effective Date and does not depend on a future engineering change. A row marked A applies from the Adoption Date or from the later date the row states.
2. Definitions
Capitalized terms have the meanings given in the Ori Learning Definitions (DPA §2.1), including “Export Window”, “Independent Account Data” and “Adoption Date”. The status labels are defined in Section 1.3. The Data Retention & Deletion Policy and the Website Privacy Notice are the documents so titled in the Ori Learning legal set.
3. Deletion events and periods
| Event | Period (DPA §12) |
|---|---|
| The Customer’s written request to Delete Student Data, for a Student, a class, a Site or the whole organization | Promptly, and in any case within 30 days after the request |
| The Customer’s notice that a Student has left the Customer | Within 90 days after the notice, or sooner on request |
| End of the Subscription Term | The Export Window runs for 60 days. Deletion within 30 days after the earlier of the Customer’s written confirmation that its export is complete and the end of the Export Window, and in any case no later than 90 days after the date the Services actually end, unless the Customer has renewed, has directed earlier Deletion, has given a written transition instruction under Section 5.3, or a Legal Hold applies |
| A verified request routed under DPA §4.7 or §7 | Acknowledged within 5 Business Days; completed, or the Customer given what it needs, within 30 days or the shorter period Section 1.2 applies |
Where the Customer’s executed Data Privacy Agreement or Applicable Law requires a shorter period, that period applies.
The Customer is the custodian of its own records: it exports and preserves the records it must retain before a deletion deadline, issues any scoped preservation direction before that deadline, and acknowledges that the Platform is not its archival system of record. Deletion on the schedule this Section states is not a breach by Ori Learning.
4. Schedule by category
Category numbers follow the Data Retention & Deletion Policy §4; the elements in each category are those Annex A lists; each row states the purpose and the business need for retention. Method: data Ori Learning holds is Deleted under Section 5; data a Subprocessor holds is Deleted by Ori Learning’s instruction to it, tracked to confirmation (DPA §12.5). Backups: every category Ori Learning holds ages out of Backups under Section 6; data a Subprocessor holds ages out on that Subprocessor’s own rotation, Ori Learning’s instruction and confirmation unchanged. “As category 1” repeats that row’s period and events. Status labels: Section 1.3.
| # | Category | Purpose and business need | Retention period and Deletion event | Status |
|---|---|---|---|---|
| 1 | Student Account and roster data | Provide the Services and rostering; needed for as long as the Customer’s subscription runs and its Export Window lasts | Subscription Term plus the Export Window; Deleted by the 90th day after the date the Services actually end. Events: end of the Subscription Term; Customer request; departure notice; verified direct request (Section 3) | I (retention during the Term) · C (the windows and events) |
| 2 | Student responses, progress, grades, assessment and survey responses, in-Platform transcript records | Instruction and progress reporting to the Customer; needed while the Student’s course record is in use | As category 1 | I · C |
| 3 | Student-Generated Content, including Collaboration Board posts | Instruction; needed while the class uses it | As category 1; a Teacher may remove a post or have it removed | I · C |
| 4 | Audio Data: audio a Student records or speaks to answer an item | The Student’s response; needed while the Student’s course record is in use | As category 2: Deleted no later than the Student’s response it belongs to | I · C |
| 5 | Usage Data and Persistent Identifiers Ori Learning holds | Operate, secure and support the Services and the Customer-authorized educational functions; needed for security investigation and support. Generalized product improvement uses only category 17 data | Linked to an Account: as category 1. Logs: category 14 | C · A (log periods) |
| 6 | Data at the analytics, customer-success and error-monitoring Subprocessors (the identifiers and events the Subprocessor Schedule states) | Service operation, support and in-product reporting (DPA §5.2(h)); needed while the Customer’s subscription runs | Deleted at each Subprocessor on Ori Learning’s instruction at the end of the Subscription Term and on Customer request, tracked to confirmation | C (deletion at Term end and on request) |
| 7 | The indicator that a Student has an individualized education program or a Section 504 plan | Deliver the Customer’s configured curriculum; needed only while the Customer uses it | As category 1; destroyed earlier on the Customer’s direction (Section 7) | I · C |
| 8 | Staff account data (Teacher, Administrator, Publisher), and Independent Account Data | Provide the Services and support; needed while the Account is active | Staff account data: as category 1, or on deactivation by the Customer or the user’s request. Independent Account Data: until the holder closes the account, or until Ori Learning closes it under the Authorized User Terms §8 (on 30 days’ notice, including after 24 months without sign-in) | I (retention while active) · C (the windows) · A (inactivity rule) |
| 9 | Customer organization, Site and configuration data | Provide the Services; needed while the subscription runs | As category 1; thereafter only the commercial record in category 12 | I (retention during the Term) · C |
| 10 | In-app acceptance records | Evidence of an Authorized User’s assent; needed for the life of the Account and any limitation period | Life of the Account plus 7 years | A |
| 11 | Support and communications records (tickets, chat transcripts, email) | Support and service quality; needed to resolve and evidence support | Tickets and chat: 3 years after closure. Corporate email: 7 years. Ori Learning does not use them as a store of Student Data and its Information Security Program requires that Student Data not be handled outside the Platform; Student Data that reaches such a record is removed, redacted or migrated into the Platform within 30 days after it is identified, and in any case on the Student Data period in Section 3, and the redacted carrier record then runs its own period | A |
| 12 | Commercial records (agreements, invoices, tax records, customer-relationship contacts) | Contracting, billing, tax and the defense of claims; needed for accounting, tax and limitation periods | Executed instruments, invoices and tax records: 7 years after the relationship ends, the adopted period for the accounting, tax and limitations need. Contact records of a former Customer: flagged on account close, retained for renewal contact subject to the contact’s opt-out, and deleted or anonymized 5 years after the relationship ends unless a record above needs them; a minimal suppression record, the address or its hash with the opt-out date, is kept outside that rule for as long as Ori Learning sends marketing email and is used only to suppress. The Platform’s sync to the customer-relationship system sends no individual Student record; Student information that reaches the system through a support note or another route is handled under category 11 | C · A |
| 14 | Operational logs (application, activity, diagnostic, server) | Operate, secure and debug the Services; needed for security investigation and fault diagnosis | Adopted targets, configured within 90 days after the Adoption Date: Platform activity logs 12 months; diagnostic telemetry 90 days; administrative and security event logs 12 months; front-end error telemetry the shortest retention setting the monitoring Subprocessor offers. Logs are protected as Customer Data where they contain user identifiers and are used for no purpose outside DPA §5.2. Identifiers in logs are minimized or pseudonymized where feasible. A Student-linked entry is Deleted or de-identified on request; an entry that cannot be scoped to the requester ages out on a fixed rotation of no more than 90 days, with the specific continuing security or legal need recorded; an identifiable entry survives a request only under a documented legal obligation or a Legal Hold | A |
| 15 | Security records (incident, access, risk-assessment, training, vendor-review and Deletion records; the request register) | Program evidence, the defense of claims and production to a regulator; needed for the limitation period | 5 years after the end of the year the record was made, or longer under a Legal Hold; incident evidence is preserved for the incident concerned, not under a blanket hold | A |
| 16 | Backups | Recovery of the Platform as a whole; needed for disaster recovery | Section 6; overwritten on rotation after a limited period | I |
| 17 | De-identified Data and Aggregate Data | Operate, maintain, support, develop and improve the Services; reporting to the Customer (DPA §6); needed for product improvement and efficacy evidence | Retained under DPA §6.5; never re-identified; not Student Data | C |
Category 13 of the Data Retention & Deletion Policy (Marketing Website Visitor and lead data) is not Customer Data and is outside this Schedule; the Website Privacy Notice describes it. That Policy schedules no Personnel or applicant records.
5. How Deletion is performed
5.1 Deletion in the Platform is an immediate hard delete: on Ori Learning’s action at the Customer’s direction, or an Administrator’s where the Platform’s tools provide it, a user, an organization unit or an organization is Deleted at once through the Platform’s deletion functions, cascading to assignments, activity, progress, sessions and authentication records; the Deletion of the live records is complete and they cannot be recovered through the product, and Section 6 states what happens in Backups. NIST Special Publication 800-88 is guidance for the method; physical media belongs to Microsoft and is sanitized under Azure’s published practices, which Ori Learning attributes to Azure. A record containing Personal Information that is no longer retained is destroyed so that it is unreadable, undecipherable and non-reconstructable; where the Platform’s deletion functions do not reach a copy, Ori Learning deletes it by engineering action. For every Deletion, Ori Learning instructs each Subprocessor holding the data to Delete it and records the confirmation (DPA §12.5).
5.2 Ori Learning’s Privacy Officer reviews the request register against every recorded due date at least every two weeks, escalates before the earliest applicable deadline, and performs each Deletion when it falls due, including the Deletion of each organization whose Export Window has ended, or whose export the Customer has confirmed complete, within the periods in Section 3 unless the Customer has renewed, a transition instruction under Section 5.3 is running, or a Legal Hold applies (Data Privacy Addendum §12.4, §12.7(a)), and the departure and request Deletions by their dates; the Privacy Officer keeps a deletion log of each, and the Vice President of Operations is the backup. Ori Learning may automate these Deletions; the outcome stated here binds whatever the mechanism.
5.3 Deletion of a Customer’s data does not Delete De-identified Data, Aggregate Data, security records or commercial records, which follow their own rows (DPA §12.7). A Legal Hold, preservation under DPA §14, a transition instruction and a consent to continued retention are the only exceptions to Section 4. A Legal Hold is placed and released in writing and reviewed quarterly, and the Customer’s written preservation direction given because of litigation, an investigation, an audit or a statutory preservation duty is honored as one. A transition instruction is the Customer’s written instruction to hold its data beyond the periods in Section 3 for a stated purpose, with a maximum duration and an expiry date; Ori Learning holds the data for that purpose only and Deletes it at the expiry, and it is not a Legal Hold. A consent to continued retention must be one the Customer is authorized to give, is recorded with the data, purpose, scope and expiry it covers, cannot extend retention beyond the consented purpose or beyond what is reasonably necessary under 16 C.F.R. §312.10, and cannot override a deletion rule Applicable Law does not permit to be waived. The Platform is a hosted web application; where it leaves Student Data on a school-issued device, Ori Learning supports the Customer’s wipe of a returned device.
6. Backups
Azure SQL automated Backups run on Azure’s schedule and are kept for a limited period on a rotating basis; Azure states that it encrypts them, and they are kept in the United States. A Deleted record persists in a Backup until the rotation overwrites it. Ori Learning does not describe Deletion as immediate or unrecoverable across Backups. Backups are inaccessible for ordinary use and are used only to recover the Platform as a whole, never to restore a Deleted Customer’s or Student’s data; Ori Learning undertakes that, if a whole-Platform restore reaches back past a Deletion, it re-applies the deletion log in Section 5.2 and Deletes the restored data again promptly after the recovery (DPA §12.5).
7. Requests
Requests reach [email protected]; from the Effective Date, [email protected] forwards a request it receives the same Business Day, and each request is entered in a request register recording the requester, the Customer, the date received, the due date and the disposition, acknowledged within 5 Business Days, and completed, or the Customer given what it needs to complete it, within 30 days or the shorter period Section 1.2 applies. A request about Student Data routes through the Customer’s Administrator, except: a verified Parent of a Student under 13 exercising the rights in DPA §4.7, which Ori Learning answers itself in coordination with the Customer, and on whose refusal of further collection or use Ori Learning stops collecting and using the Student’s Personal Information once the request is verified, completes any Deletion the refusal requires, notifies the Customer and, within 10 Business Days, disables the Student’s Account, the Customer choosing only among the technically available arrangements that collect and use no further Personal Information and any independently required preservation; a direct route the law of the Customer’s state grants (DPA §7.3(b)); or a request the Customer directs Ori Learning to answer. Nothing is released or Deleted for an unverified requester (DPA §7.5). A response states what was Deleted or provided, when, by what method, which Subprocessors were instructed, and that Backups age out under Section 6. On the Customer’s written direction, Ori Learning destroys a Student’s individualized-education-program or Section 504 indicator when the Customer determines it is no longer needed (DPA §8.2(e)).
8. Certification
Within 10 Business Days after completing the end-of-Term Deletion under DPA §12.4, without request, and within 10 Business Days after any other Deletion on the Customer’s reasonable request, Ori Learning’s Privacy Officer, its designated privacy official, sends the Customer a written certificate stating the Customer; the scope (organization, Site, class or Students); the date of each Deletion; the method, at a non-sensitive level; the Subprocessors instructed and whether each has confirmed; that Backups age out on their rotation; and any Legal Hold exception (DPA §12.6).
9. Changes and versions
This Schedule is identified by version on the Order Form for the Subscription Term, and that version is the minimum protection for the Term. A new version that does not materially diminish the overall protection this Schedule describes, and that neither lengthens a Deletion deadline nor reduces a protection for Student Data, such as a verified factual update of a period under Section 4 or 6, applies to the Customer from its effective date, with notice given as DPA §15.3 provides; any other new version applies at the next renewal Order Form, or earlier only by written agreement signed by both parties (DPA §15.3). Ori Learning re-issues this Schedule at each version of the Data Retention & Deletion Policy and whenever a period in Section 4 or 6 is measured or changed; no change during a Subscription Term materially reduces the overall protection of Student Data or lengthens a binding Deletion deadline, changes that are legally required, security-enhancing or functionally equivalent being permitted. Prior versions remain available at orilearning.com/legal/archive/.