Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between the school district or educational institution ("School") and Gregarious ("Processor"). The School is the Data Controller. Gregarious acts as a Data Processor and designated "school official" under FERPA, processing student education records solely on behalf of and under the direction of the School.

Gregarious has a legitimate educational interest in the student data it processes, limited to providing the adaptive learning, assessment, and creative portfolio services described in this agreement.

This DPA is incorporated by reference into the Gregarious School Service Agreement and the Gregarious Terms of Service. In the event of conflict between this DPA and those documents, this DPA governs with respect to student data.

Gregarious processes student data on behalf of the School for the purpose of providing the Gregarious adaptive learning platform, including adaptive mastery sprints, Studio creative tools, teacher dashboards, parent reporting, and school administration features.

This DPA takes effect on the date the School Service Agreement is executed and remains in force for the duration of that agreement. Upon termination, the data retention and deletion obligations in Section 5 apply.

Gregarious does not and will never collect the following categories of data:

• Social Security numbers or government-issued IDs
• Financial or payment information from students
• Health or medical records (including IEP/504 plan contents)
• Biometric data (fingerprints, facial recognition, voice prints)
• Geolocation or GPS data
• Browsing history outside of Gregarious
• Device fingerprints or advertising identifiers
• Social media account information

Gregarious operates under the "school official" exception to FERPA's consent requirements (34 CFR 99.31(a)(1)). Under this designation:

• --The School maintains ownership and control of all student education records
• --Gregarious uses student data only for the educational purposes authorized by the School
• --Student data is not disclosed to any third party without the School's written consent
• --Parents and eligible students retain all rights under FERPA, including access and correction rights
• --All access to student data is logged in an immutable audit trail accessible to the School

• Active accounts: Educational data is retained for the duration of the account plus 2 years from last activity to support longitudinal growth analysis.
• Account deletion: Upon request from the School, parent, or eligible student, all personally identifiable data is permanently deleted within 30 calendar days.
• School contract termination: Upon termination of this agreement, all School data will be exported (if requested) and permanently deleted within 60 calendar days.
• De-identified data: Aggregate, de-identified data that cannot be linked to any individual may be retained for platform improvement and research purposes.

Gregarious uses the following third-party services to process data. Each maintains industry-standard security certifications. The School will be notified at least 30 days before any new subprocessor is added.

In the event of a data breach affecting student records, Gregarious will:

• --Notify the School within 72 hours of discovery
• --Provide a description of the breach, including categories and approximate number of records affected
• --Describe the measures taken or proposed to address the breach
• --Provide a dedicated point of contact for the duration of the incident response
• --Cooperate fully with the School and relevant authorities in any investigation
• --Provide a final incident report within 15 business days of the breach notification

The School, parents, and eligible students may request a complete export of their data at any time. Exports are provided in standard formats (CSV, JSON) within 10 business days of the request. Export requests should be directed to cgb003@gmail.com.