Schedule 2: Data Privacy Addendum for COPPA, FERPA and Other Regional Legislation

Summary

This schedule provides an addendum to the Terms of Service and Schedule 1: Data Processing Agreement. It is aimed at customers operating in the US or other regions where additional details of clarifications are needed due to regional legislation. This Schedule is designed to add to, rather than replace, any other clause or section in any agreement or document within this contract.

Children’s Online Privacy Protection Act (“COPPA”)

1. NetSupport, as the provider of classroom.cloud, may form contracts directly with schools. This will mean that, instead of obtaining consent from the parents for the collection of students’ personal information, we rely on the school to provide this, as it is for its use and benefit. It is not used for any other commercial purposes, other than to provide the contracted services.

2. As part of Schedule 1: Data Processing Agreement, NetSupport provides clearly written statements to explain what data it collects from the school and from users; how such data is used and stored; and, where instructed, to whom it may be disclosed or transferred.

3. As part of Schedule 2: Data Protection Addendum for COPPA, FERPA and Other Regional Legislation, NetSupport has confirmed that the Data Processing Agreement can be considered the Privacy Policy and is available for review prior to the sale or commencement of using the classroom.cloud service.

4. As set out in Schedule 1, a description of the types of personal information collected is provided. Throughout the period of subscription, the school can review the child’s personal information, have relevant information deleted, and ensure that further collection or processing of that personal information is prevented.

5. NetSupport adheres to the data minimization principle and will only collect limited data from or about that child, and only that required to provide the school and users with the required features, or, where required, to ensure the operations of the service, including internal support.

6. Participation within any feature of classroom.cloud will not be limited by requests for additional personal information to be disclosed by children, and any data collected will be as set out, to ensure it is appropriate for the features and/or activity.

7. As set out within Schedule 3: Technical and Operational Measures, NetSupport is committed to procedures to protect the personal information collected about children. Maintaining the confidentiality, availability and integrity of that personal data is a core element within our security approaches. This includes taking regular steps to ensure that any sub-processors (or sub-processors who act as service providers within classroom.cloud) or those considered third parties under this legislation, take equivalent measures to maintain the security of this personal information

8. As set out within the Terms of Service, we retain the personal information of users, including children, only as long as needed to provide the service, and delete it within the time frames set out within the Terms of Service.

9. All NetSupport staff will undertake annual training related to Data Privacy and Security. This is completed in line with training set out within our ISO27001 certification, including COPPA requirements.

10. As stated within our Terms of Service, NetSupport will not make material changes to our Terms of Service or relevant Schedules, including making significant changes impacting the collection, use, disclosure, or retention of data collected without notice to the customer.

11. iKeepsafe shall operate as the Safe Harbor (classroom.cloud – iKeepSafe), where applicable, and can be contacted via : [email protected] should users have any privacy questions of concerns we are not able to answer.

Family Educational Rights and Privacy Act (“FERPA”) (20 U.S.C. Section 1232g)

1. All personal information and education records remain the property of the educational institute and under their control, as they retain full ownership rights to the information provided to NetSupport.

2. Any content generated by students on classroom.cloud remains the property of the creator and as set out by relevant legislation.

3. As previously set out within the Terms of Service and Schedule 1: Data Processing Agreement, any personal information, including that within a student record, will only be processed as instructed by the school.

4. By contacting the school, Personally Identifiable Information (PII) held within classroom.cloud can be reviewed by parents, legal guardians, or eligible students, and erroneous information can be corrected. Staff with the relevant roles and responsibilities may update the relevant information through their accounts on classroom.cloud, or request changes or deletions by contacting NetSupport through [email protected].

5. The security and confidentiality of student records is part of NetSupport’s core approach to supporting our customers. As covered within Schedule 3: Technical and Organisational Measures, we take the following action:

6. Should there be an unauthorised disclosure of personal information within a student’s record, we will promptly notify the educational institute as set out within the Terms of Service.

7. As set out within the Terms of Service, we will delete all personal information when it is no longer needed, whether it is upon request or due to the expiration/termination of our agreement. Personal information will not be used for other purposes.

8. NetSupport will continue to work with educational institutions to ensure compliance with FERPA and other legislation, including helping to provide parents, legal guardians and eligible students with the ability to inspect and review student records and to correct any inaccuracies, therein, as described above.

9. NetSupport, and its sub-contractors/sub-processors, will not use any personally identifiable information to undertake targeted advertising.

10. As set out in the Terms of Service, NetSupport will not make material changes to our Terms of Service or any relevant Schedules, including making significant changes which impact the collection, processing, sharing, or retention of data collected without notifying the Educational Institute.

Other Legislation

As other Data Protection Legislation is enacted across the world, this document will be updated should Schedule 1: Data Processing Agreement not cover all requirements. At this point in time, classroom.cloud is not aimed at being a consumer product and so no additional requirements are entered into within this agreement or any of its schedules.