Data Processing Addendum

1. Roles and instructions

For Customer Data processed on Customer’s behalf, Customer determines the purposes for which the data is collected and used, and Homeschool Platform processes it to provide the Services. Where applicable privacy law uses the terms “controller” and “processor,” Customer acts as controller and Homeschool Platform acts as processor for that processing.

Customer instructs Homeschool Platform to process Customer Data as necessary to provide, secure, maintain, and support the Services; to carry out Customer’s settings and authorized users’ actions; and as otherwise documented in the Terms of Use, this DPA, or Customer’s written instructions accepted by Homeschool Platform.

Homeschool Platform may process information about its own business contacts, customer accounts, billing, and website visitors for its own purposes as described in its Privacy Policy. This DPA does not change the parties’ roles with respect to that information.

2. Description of processing

Individuals whose data may be processed: Customer’s administrators, staff, instructors, volunteers, parents, guardians, students, applicants, members, and other individuals whose information Customer or its authorized users submit through the Services.

Categories of Customer Data: Names, contact information, account information, applications, enrollment and registration information, attendance, assignments, grades and other academic records, communications, uploaded documents, and other information Customer chooses to submit.

Nature and purposes of processing: Receiving, hosting, storing, organizing, displaying, transmitting, backing up, securing, and otherwise processing Customer Data to provide the website and platform features Customer purchases and uses, including support and maintenance.

Duration: Processing continues during Customer’s subscription and for the limited period necessary to complete the return, deletion, or legally required retention of data after the paid subscription period ends, as described below.

Location: Customer Data is stored and processed primarily in the United States, and may be processed in other locations where Homeschool Platform’s subprocessors operate, subject to this DPA.

3. Customer responsibilities

Customer is responsible for determining what information it collects and enters into the Services, who may access it, and how it is used within its organization. Customer is also responsible for providing notices and obtaining permissions or consents required for its use of the Services, including those concerning children and students.

Customer represents that it has the rights and authority necessary to provide Customer Data and instruct Homeschool Platform to process it. Customer remains responsible for its educational, recordkeeping, and organizational decisions. Homeschool Platform will reasonably assist Customer with requests concerning Customer Data to the extent required by applicable law and reasonably practicable given the nature of the Services and information available to Homeschool Platform.

Customer is responsible for communicating with its families, students, and members about matters affecting their data, including if Customer stops using the Services or closes. Homeschool Platform does not contact them directly. Messages sent to them through the Services, including from Homeschool Platform email addresses or web addresses, are sent on Customer’s behalf, apart from automated transactional messages needed to operate their accounts, such as password resets and sign-in or security notices.

Where Customer’s use of the Services involves children under 13, Customer authorizes Homeschool Platform to collect and process their information on Customer’s behalf solely to provide the Services for Customer’s educational purposes, and Customer is responsible for providing any required notice to parents and obtaining any required parental consent. Customer will not submit sensitive information that the Terms of Use prohibit unless a feature of the Services is designed for it.

4. Use of Customer Data

Homeschool Platform will process Customer Data to provide the Services and carry out Customer’s documented instructions, except where processing is required by applicable law. If a legal requirement prevents Homeschool Platform from following an instruction, Homeschool Platform will notify Customer when legally permitted.

Homeschool Platform does not sell Customer Data or use student data for advertising or AI model training. It will not share Customer Data with third parties for their advertising purposes. These commitments do not prevent disclosures to service providers needed to deliver the Services or disclosures required by law.

Homeschool Platform will not: sell or share Customer Data, as those terms are defined in applicable state privacy laws; retain, use, or disclose Customer Data for any purpose other than providing the Services or as permitted by applicable law, or outside the direct business relationship with Customer; combine Customer Data with personal information it receives from other sources, except as needed to provide the Services or as permitted by law; or build profiles of students other than for providing the Services. Homeschool Platform will notify Customer if it determines it can no longer meet these obligations.

To the extent the Family Educational Rights and Privacy Act applies to Customer, Homeschool Platform acts as a school official with a legitimate educational interest, under Customer’s direct control with respect to the use and maintenance of education records, and uses those records only for the purposes for which Customer disclosed them.

If Homeschool Platform receives a subpoena, court order, or other legal request for Customer Data, it will, where legally permitted, refer the requester to Customer and notify Customer so that Customer may seek a protective order or other remedy, and it will disclose only the Customer Data it is legally required to disclose.

5. Personnel access and confidentiality

Homeschool Platform will limit personnel access to Customer Data to individuals who need access to provide support, maintain or secure the Services, or perform other authorized work. Personnel with such access will be subject to confidentiality obligations appropriate to their role.

6. Security

Homeschool Platform will maintain reasonable administrative, technical, and organizational measures designed to protect Customer Data against unauthorized access, disclosure, alteration, and destruction. Measures may include access controls, encrypted transmission, security monitoring, backups, and personnel access restrictions, as appropriate to the Services and the nature of the data.

Customer is responsible for managing its authorized users, assigning appropriate permissions, protecting account credentials, and notifying Homeschool Platform promptly of suspected unauthorized access to its accounts. Neither party can guarantee that an internet-based service is free from all security risk.

Customer is also responsible for turning on two-factor authentication for its administrators and staff where the Services offer it, and for the security of Customer Data after it is downloaded, exported, printed, or sent outside the Services.

7. Subprocessors

Customer authorizes Homeschool Platform to use third-party providers to help deliver the Services, including providers of hosting, infrastructure, communications, payments, and technical support. Homeschool Platform will require subprocessors that process Customer Data on its behalf to be bound by written obligations appropriate to the services they perform, including confidentiality and data-protection obligations.

Homeschool Platform remains responsible for its subprocessors’ performance of the processing obligations it has delegated to them. Homeschool Platform will provide Customer with a current list of subprocessors upon request at legal@homeschoolplatform.com. Homeschool Platform will notify Customer’s designated account contact by email of material changes to the subprocessors used to process Customer Data.

A payment provider with which Customer establishes its own direct account may process information under its separate agreement with Customer. The parties’ responsibilities for that provider will depend on the payment configuration Customer uses.

8. Security incidents

If Homeschool Platform becomes aware of unauthorized access to or disclosure of Customer Data in its systems, it will notify affected Customers without undue delay after obtaining sufficient information to identify the affected Customer and the nature of the incident. Notice may be provided to Customer’s designated account contact.

Homeschool Platform will provide information reasonably available to it to help Customer understand the incident and meet its applicable notification obligations, with updates as material information becomes available. Notification does not, by itself, constitute an admission of fault or liability.

Customer is responsible for notifying affected individuals, including families and students, where notice is required.

9. Data requests and assessments

Customer is responsible for responding to requests from individuals concerning Customer Data. Taking into account the nature of the processing and the information available to it, Homeschool Platform will provide reasonable assistance where required by applicable law.

Upon Customer’s reasonable request, Homeschool Platform will provide information reasonably necessary to demonstrate its compliance with applicable processor obligations. Where required by applicable law, it will cooperate with a reasonable assessment of those obligations, subject to appropriate confidentiality, security, and operational safeguards. The parties may agree on a suitable independent assessment or report where permitted by law.

10. Export, return, and deletion

During an active subscription, Customer’s authorized account administrator may request an export of eligible organizational data by emailing legal@homeschoolplatform.com. The administrator may also submit an export request within 30 calendar days after the paid subscription period ends. The request must identify the organization and a current point of contact authorized to receive the data.

Homeschool Platform will provide available eligible Customer Data in the export formats it supports. An export does not include Homeschool Platform software, themes, templates, proprietary workflows, or other licensed platform functionality. Customer should request its export before the paid period ends whenever possible and maintain independent copies of records it needs to retain.

At Customer’s direction at the end of the Services, Homeschool Platform will return or delete Customer Data as applicable, subject to the export-request period above, technical limitations of backups, and retention required by law. After the 30-day request period, Customer Data may no longer be available for export. Deletion from backups may occur through established backup-retention cycles; any retained data remains subject to appropriate protections until deleted.

After the paid subscription period ends, Customer Data remaining in the Services is not maintained, updated, or reconciled with any other system and is not Customer’s official record. Customer is responsible for the records it keeps in any other system. Homeschool Platform will continue to protect Customer Data it holds under this DPA until that data is deleted. Homeschool Platform does not retain Customer Data to satisfy Customer’s record-retention obligations after the export-request period ends.

If Homeschool Platform discontinues the Services entirely, it will give Customer’s designated account contact at least 60 days’ notice, unless circumstances beyond its reasonable control prevent it, and Customer may request an export until the discontinuation date and for 30 calendar days afterward where reasonably practicable. Customer agrees that, if Homeschool Platform’s business or assets are transferred, Customer Data may be transferred to the successor, which must be bound by data-protection commitments at least as protective as this DPA, and Homeschool Platform will notify Customer.

11. Changes to this DPA

Homeschool Platform may update this DPA to reflect changes in law, the Services, or its processing practices. It will identify the effective date of an updated version and provide notice of material changes to Customer’s designated account contact. Changes will take effect in accordance with the Terms of Use and applicable law.

12. Contact

Questions or requests concerning this DPA may be sent to:

Homeschool Platform LLC

legal@homeschoolplatform.com