Student Data Privacy Agreement (DPA)

HallGuard Pro · House of Dreams LLC · Version v1.0 · Effective Date: [Effective Date]

Preamble

This Student Data Privacy Agreement ("DPA") is entered into on [Effective Date] between [School or District name], located at [School address] (the "LEA"), and House of Dreams LLC, d/b/a HallGuard Pro, located at [House of Dreams LLC address] (the "Provider"). The Provider will provide the services described in Exhibit A under the Terms of Service (the "Service Agreement"). This DPA is accepted electronically when the LEA's authorized representative checks "I agree" at sign-up, or by signature below.

Article I: Purpose and Scope

1. Purpose. This DPA describes the parties' obligations to protect Student Data under applicable law, including the Family Educational Rights and Privacy Act (FERPA, 20 U.S.C. §1232g; 34 CFR Part 99), the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §6501; 16 CFR Part 312), the Protection of Pupil Rights Amendment (PPRA, 20 U.S.C. §1232h), and applicable state laws.
2. Student Data to be provided. Listed in Exhibit B.
3. Definitions. Listed in Exhibit C. If this DPA conflicts with the Service Agreement, this DPA controls.

Article II: Data Ownership and Authorized Access

1. Ownership and control. All Student Data is and remains the property of, and under the control of, the LEA. Provider gets no ownership or license except to provide the Services. Copies and modifications remain subject to this DPA.
2. School official designation. For FERPA, Provider is designated a "school official" with a "legitimate educational interest" under 34 CFR §99.31(a)(1)(i), performing an institutional service the LEA would otherwise use employees for, under the LEA's direct control regarding use and maintenance of Student Data, and subject to the use and redisclosure limits of 34 CFR §99.33(a). The LEA should include such vendors in its annual FERPA notice criteria.
3. Parent access and correction. The LEA will set procedures for parents, legal guardians, and eligible students to review and correct Student Data. Provider will help the LEA respond within [10] business days of an LEA request. If a parent or student contacts Provider directly, Provider will refer them to the LEA and notify the LEA.
4. Student-generated content. The Service does not host student-generated content. If it ever does, Provider will let students transfer it to a personal account.
5. Law enforcement requests. Provider will refer third-party requests, including from law enforcement, to the LEA and will notify the LEA before disclosure unless prohibited by law or court order.
6. Subprocessors. Provider will have written agreements with all Subprocessors that are at least as protective as this DPA. The current list is in Exhibit A. Provider will give the LEA [30] days' notice of new Subprocessors.

Article III: Duties of the LEA

1. Provide data only in compliance with FERPA, COPPA, PPRA, and state law, including annual FERPA notification of school-official criteria.
2. Use reasonable precautions to secure usernames, passwords, and access credentials and assign roles appropriately.
3. Notify Provider promptly of any known unauthorized access.
4. Provide parents with any required notice about the Service.

Article IV: Duties of the Provider

1. Privacy compliance. Comply with FERPA, COPPA, PPRA, and applicable state laws.
2. Authorized use only. Student Data is used only to provide the Services and as directed by the LEA, and not for any other purpose.
3. Provider employees. Employees and contractors with access sign confidentiality agreements, complete privacy and security training, and get access only on a need-to-know basis.
4. No disclosure. No disclosure except as authorized by the LEA, to Subprocessors under Article II, or as required by law. De-identified data may be used only to improve the Service and only if it cannot reasonably be re-identified; Provider will not attempt re-identification or transfer De-identified Data without LEA written consent, except to Subprocessors.
5. Prohibited uses. Provider will not: (a) sell, rent, or trade Student Data; (b) use Student Data for Targeted Advertising; (c) build a profile of a student except for school purposes authorized by the LEA; (d) use Student Data to market products to students or parents; (e) use identifiable Student Data to train artificial-intelligence models for any purpose other than providing the Service to the LEA.
6. PPRA. The Service does not survey students or collect PPRA-protected information (e.g., political affiliations, mental or psychological problems, sex behavior or attitudes, religious practices, income). Provider will not add such features without LEA consent and help the LEA comply with PPRA notice and consent rules.
7. COPPA notice and consent. For students under 13, the LEA acts as the parent's agent and consents to Provider's collection of Student Data solely for the educational purpose and benefit of the school, with no other commercial purpose, per the FTC COPPA Rule (as amended 2025). Provider will give the LEA the direct notice of its data practices required by COPPA (Exhibit B and the Privacy Policy) and notice of any material change. Parents may ask the LEA to review or delete their child's data.
8. Disposition of data. When Student Data is no longer needed, or within 60 days of termination of the Service Agreement, Provider will return Student Data to the LEA in a standard format (e.g., CSV) on request and then securely delete or de-identify it, including from Subprocessors. Backups age out within [35] days. Provider will certify deletion in writing on request. The LEA may give specific instructions with Exhibit D.
9. Data retention. During the term, Student Data is kept according to the LEA's settings (default: [current school year plus one prior school year]), after which pass-level records are deleted or de-identified.
10. Advertising. No Targeted Advertising. This does not prohibit using data for adaptive or personalized features in the Service or responding to an LEA request for information.

Article V: Data Security and Breach Notification

1. Data storage. Student Data is stored in the United States only. [Hosting provider and region TBD]
2. Security program. Provider will implement and maintain an information security program aligned with a framework in Exhibit F (e.g., NIST Cybersecurity Framework or CIS Controls), including:
   • Encryption in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent);
   • Role-based access controls (teacher, nurse, office, principal/administrator, owner) with least privilege, per-school data isolation, unique accounts, hashed passwords, and [multi-factor authentication for administrator accounts];
   • Audit logging of access to Student Data, regular backups, vulnerability patching, and periodic risk assessments;
   • Designation of a security contact: [Security contact name and email].
3. Audits. On [30] days' written notice, no more than once a year (or anytime after a Data Breach or regulatory request), the LEA or its designee may audit Provider's security and privacy measures relating to the LEA's Student Data. Provider may meet this by providing a recent independent assessment (e.g., SOC 2 report or penetration test summary), if available.
4. Data Breach. If Provider becomes aware of an unauthorized release, disclosure, or acquisition of Student Data, Provider will notify the LEA within 72 hours (or a shorter period if state law requires), including, to the extent known: what happened, date and time, types of data involved, whether notice was delayed by law enforcement, and steps taken and recommended. Provider will cooperate with the LEA and law enforcement, maintain a written incident response plan, and reimburse the LEA for legally required notification costs if the breach was caused by Provider. The LEA decides how and when to notify parents and students unless the law requires otherwise.

Article VI: General Offer of Privacy Terms

Provider may, by signing Exhibit E, offer the same privacy protections to other LEAs in [State] that sign Exhibit E ("Subscribing LEAs").

Article VII: Miscellaneous

1. Term. This DPA is effective for as long as Provider holds Student Data, or [three] years, whichever is longer.
2. Termination. Either party may terminate this DPA if the Service Agreement ends. The LEA may terminate immediately for a material breach of this DPA.
3. Priority. This DPA controls over any conflicting Service Agreement, terms of service, privacy policy, or click-through terms.
4. Governing law. The laws of the LEA's state govern this DPA ([State of governing law] if not otherwise required).
5. Changes in control. If Provider is sold, merged, or goes out of business, Provider will give the LEA [30] days' written notice and the successor must be bound by this DPA, or the LEA may terminate and require deletion.
6. Severability; waiver; entire agreement. Standard.

Exhibit A: Description of Services and Subprocessors

HallGuard Pro: live hall-pass, restroom, water-break, and nurse-visit board; "No Wrong Meetups" restricted-pairing alerts; 4-step staff handoff tracking; daily, monthly, and annual reports; safeguards (bell auto-close, stall capacity waitlists, 504/IEP bypass flag, hall freeze, fire-drill roll call).

Exhibit B: Schedule of Student Data

Exhibit C: Definitions

Student Data: any personally identifiable information about a student, including education records, provided by the LEA or its users or created by Provider in providing the Services. De-identified Data: data from which all direct and indirect identifiers have been removed so there is no reasonable basis to identify a student. Subprocessor: a third party Provider uses to provide the Services that has access to Student Data. Targeted Advertising: advertising selected based on a student's online behavior, usage, or data over time; it does not include contextual advertising in a single session. Data Breach: unauthorized release of, access to, or acquisition of Student Data. Commercial Terms: pricing and payment terms in the Service Agreement, not this DPA.

Exhibit D: Directive for Disposition of Data

The LEA may, after this DPA takes effect, use this form to direct Provider: ☐ Return all data in [format] ☐ Delete all data ☐ Delete specific categories: [list] — by [date]. Provider will certify completion in writing. LEA authorized signature: ____________ Date: ______.

Exhibit E: General Offer of Privacy Terms

Provider offers the same terms of this DPA to any other LEA in [State] that accepts this General Offer by signing below, without changes. Provider may withdraw this offer if the original DPA is materially changed, or after [three] years. Provider: ____________ Date: ______. Subscribing LEA: ____________ Date: ______.

Exhibit F: Cybersecurity Frameworks

Provider will align with one of: NIST Cybersecurity Framework (CSF 2.0); NIST SP 800-53; NIST SP 800-171; ISO/IEC 27001/27002; CIS Critical Security Controls; or AICPA SOC 2. Selected framework: [Framework selected].

Exhibit G: State-Specific Supplemental Terms

If the LEA is located in a state with additional student-privacy requirements, the applicable SDPC state supplement or addendum applies and controls over conflicting terms. Examples include:

• California: SOPIPA (Bus. & Prof. Code §22584), AB 1584 (Ed. Code §49073.1), and CCPA as applicable.
• New York: Education Law §2-d and 8 NYCRR Part 121. These require a Parents' Bill of Rights for Data Privacy and Security and supplemental information to be attached, NIST CSF alignment, encryption, and breach notification to the LEA within 7 calendar days.
• Illinois: SOPPA (105 ILCS 85), which requires a written agreement with posted terms, a breach notice to the school within 30 days (the 72-hour standard above is stricter), and a list of subprocessors.
• Other states (e.g., CT, CO, TX, UT, VA, WA, and others): [Attach state alliance supplement as needed].

Where state law requires a shorter breach notification or deletion period, the shorter period applies.

Exhibit H: Additional Terms or Modifications

[None unless agreed in writing.] Changes to the standard terms above are listed here and signed by both parties.

Signatures

House of Dreams LLC · [House of Dreams LLC address] · [Support email] · [Support phone]