Student Data Privacy Agreement

This Student Data Privacy Agreement (“DPA”) is entered into on the date listed below (the “Effective Date”) and is entered into by and between Hope Squad, Inc. (“Hope Squad”) and the School identified in the Hope Squad Program Agreement (the “Local Education Agency” or “LEA”).  

WHEREAS, Hope Squad has agreed to provide its educational, school-based, peer-to-peer program and accompanying curriculum (the “Services”) to LEA pursuant to a written agreement made by and between the parties (the “Program Agreement”);

WHEREAS, in order to provide the Services, Hope Squad may receive or create and the LEA may provide documents or data that are covered by federal statutes such as the Federal Educational Rights and Privacy Act (“FERPA”) at 20 U.S.C. 1232g (34 CFR Part 99), and the Protection of Pupil Rights Amendment (“PPRA”) 20 U.S.C. 1232h; and WHEREAS, the documents and data transferred from LEAs and created by Hope Squad’s Services are also subject to state student privacy laws.  

NOW THEREFORE, for good and valuable consideration, the parties agree as follows:  

‍Definitions

‍“De-Identified Data and De-Identification”: Records and information are considered to be de-identified when all personally identifiable information has been removed or obscured, such that the remaining information does not reasonably identify a specific individual, including, but not limited to, any information that, alone or in combination is linkable to a specific student and provided that the educational agency, or other party, has made a reasonable determination that a student’s identity is not personally identifiable, taking into account reasonable available information.

‍“Educational Records”: Educational Records are records, files, documents, and other materials directly related to a student and maintained by the school or local education agency, or by a person acting for such school or local education agency, including but not limited to, records encompassing all the material kept in the student’s cumulative folder, such as general identifying data, results of surveys and health data.

‍“School Official”: For the purposes of this DPA and pursuant to 34 CFR § 99.31(b), a School Official is a contractor that: (1) Performs an institutional service or function for which the agency or institution would otherwise use employees; (2) Is under the direct control of the agency or institution with respect to the use and maintenance of Student Data including Education Records; and (3) Is subject to 34 CFR § 99.33(a) governing the use and re- disclosure of personally identifiable information from Education Records.

‍“Student Generated Content”: The term “student-generated content” means materials or content created by a student in the services including, but not limited to, essays, research reports, portfolios, creative writing, music or other audio files, photographs, videos, and information that enables ongoing ownership of student content.

‍“Student Data”: Student Data includes any data, whether gathered by Hope Squad or provided by LEA or its users, students, or students’ parents/guardians, that is descriptive of the student including, but not limited to, information in the student’s educational record or email, first and last name, birthdate, home or other physical address, telephone number, email address, or other information allowing physical or online contact, student identifiers, survey data, parents’ names, or any other information or identification number that would provide information about a specific student. Student Data further includes “personally identifiable information (PII),” as defined in 34 C.F.R. § 99.3 and as defined under any applicable state law. Student Data shall constitute Education Records for the purposes of this DPA, and for the purposes of federal, state, and local laws and regulations. Student Data as specified in Exhibit A is confirmed to be collected or processed by Hope Squad pursuant to the Services. Student Data shall not constitute that information that has been anonymized or de-identified, or anonymous usage data regarding a student’s use of Hope Squad’s services.

‍“Subprocessor”: For the purposes of this DPA, the term “Subprocessor” (sometimes referred to as the “Subcontractor”) means a party other than LEA or Hope Squad, who Hope Squad uses for data collection, analytics, storage, or other service to operate and/or improve its service, and who has access to Student Data.


‍Purpose and Scope

Purpose of DPA. The purpose of this DPA is to describe the duties and responsibilities to protect Student Data including compliance with all applicable federal, state, and local privacy laws, rules, and regulations, all as may be amended from time to time. In performing the Services, Hope Squad shall be considered a School Official with a legitimate educational interest.

Student Data to Be Provided. In order to perform the Services, LEA shall provide or allow Hope Squad to collect Student Data as identified in the Schedule of Data, attached hereto as Exhibit A.

‍Ownership and Access

Student Data: All Student Data transmitted to Hope Squad pursuant to the Program Agreement is and will continue to be the property of and under the control of the LEA. Hope Squad further acknowledges and agrees that all copies of such Student Data transmitted to Hope Squad, including any modifications or additions or any portion thereof from any source, are subject to the provisions of this DPA in the same manner as the original Student Data. The Parties agree that as between them, all rights, including all intellectual property rights in and to Student Data contemplated per the Affiliate Agreement, shall remain the exclusive property of the LEA.  

School Official: For the purposes of FERPA, Hope Squad shall be considered a School Official, under the control and direction of the LEA as it pertains to the use of Student Data, notwithstanding anything herein to the contrary. For the avoidance of doubt, Hope Squad: (i) provides a service or function for which the LEA would otherwise use employees; (ii) is under the direct control of the LEA with respect to the use and maintenance of Education Records; and (iii) is subject to the requirements of FERPA governing the use and redisclosure of Student Data and/or any other personally identifiable information from Education Records.  

Parent Access: LEA shall establish reasonable procedures by which a parent, legal guardian, or eligible student may review Education Records and/or Student Data correct erroneous information, and procedures for the transfer of student-generated content to a personal account, consistent with the functionality of services. Hope Squad shall respond in a reasonably timely manner (and no later than forty five (45) days from the date of the request or pursuant to the time frame required under state law for an LEA to respond to a parent or student, whichever is sooner) to the LEA’s request for Student Data in a student’s records held by Hope Squad to view or correct as necessary. In the event that a parent of a student or other individual contacts Hope Squad to review any of the Student Data accessed pursuant to the Services, Hope Squad shall refer the parent or individual to the LEA, who will follow the necessary and proper procedures regarding the requested information.

Data Portability: Hope Squad shall, at the request of the LEA, make available all Student Data, including Student Generated Content, in a readily accessible format.  

Law Enforcement Requests: Should law enforcement or other government entities (“Requesting Party(ies)”) contact Hope Squad with a request for Student Data held by Hope Squad pursuant to the Services, Hope Squad shall notify the LEA in advance of a compelled disclosure to the Requesting Party, unless lawfully directed by the Requesting Party not to inform the LEA of the request.

Subprocessors: Hope Squad shall enter into written agreements with all Subprocessors performing functions for Hope Squad in order for Hope Squad to provide the Services pursuant to the Affiliate Agreement, whereby the Subprocessors agree to protect Student Data in a manner no less stringent than the terms of this DPA.  

‍Duties of LEA.

Compliance with Applicable Law: LEA shall provide Student Data for the purposes of obtaining the Services in compliance with all applicable federal, state, and local privacy laws, rules, and regulations, all as may be amended from time to time.

Annual Notification of Rights: If the LEA has a policy of disclosing Education Records and/or Student Data under FERPA (34 CFR § 99.31(a)(1)), LEA shall include a specification of criteria for determining who constitutes a school official and what constitutes a legitimate educational interest in its annual notification of rights.

Reasonable Precautions: To the extent applicable, LEA shall take reasonable precautions to secure usernames, passwords, and any other means of gaining access to the Student Data.

Unauthorized Access Notification: LEA shall notify Hope Squad promptly of any known unauthorized access. LEA will assist Hope Squad in any efforts by Hope Squad to investigate and respond to any unauthorized access.

‍Duties of Hope Squad

Privacy Compliance: Hope Squad shall comply with all applicable federal, state, and local laws, rules, and regulations pertaining to Student Data privacy and security, all as may be amended from time to time. The Student Data shared pursuant to the Program Agreement, including persistent unique identifiers, shall be used for no purpose other than the Services outlined in the Program Agreement and/or otherwise authorized under applicable law.

Employee Obligations: Hope Squad shall require all of Hope Squad’s employees and agents who have access to Student Data to comply with all applicable provisions of this DPA with respect to the Student Data shared under the Program Agreement. Hope Squad agrees to require and maintain an appropriate confidentiality agreement from each employee or agent with access to Student Data pursuant to the Program Agreement.

No Disclosure: Hope Squad acknowledges and agrees that it shall not make any re-disclosure of any Student Data or any portion thereof, including without limitation, user content or other non-public information and/or personally identifiable information contained in the Student Data other than as directed or permitted by the LEA or this DPA. This prohibition against disclosure shall not apply to aggregate summaries of De-Identified information, Student Data disclosed pursuant to a lawfully issued subpoena or other legal process, or to subprocessors performing services on behalf of Hope Squad pursuant to this DPA. Hope Squad will not sell, share, or otherwise disclose for any commercial purpose, Student Data to any third party.  

De-Identified Data: De-identified Information may be used by Hope Squad only for the purposes of development, Services improvement, to demonstrate or market product effectiveness, or research as any other member of the public or party would be able to use de-identified data pursuant to 34 CFR 99.31(b). Hope Squad agrees not to attempt to re-identify De-identified Information and not to transfer De-identified Information to any party unless (a) that party agrees in writing not to attempt re- identification, and (b) prior written notice has been given to LEA who has provided prior written consent for such transfer. Hope Squad shall not copy, reproduce or transmit any De-identified Information or other Student Data obtained under the Program Agreement except as necessary to fulfill its obligations under the Program Agreement.

Disposition of Data: Upon written request from the LEA, Hope Squad shall dispose of or provide a mechanism for the LEA to transfer Student Data obtained under the Program Agreement, within sixty (60) days of the date of said request and according to a schedule and procedure as the parties may reasonably agree. Upon termination of this DPA, if no written request from the LEA is received, Hope Squad shall dispose of all Student Data after providing the LEA with reasonable prior notice. The duty to dispose of Student Data shall not extend to Student Data that had been De-Identified or otherwise transferred in accordance with Section 3(e) herein.  

Advertising Limitations: Hope Squad is prohibited from using or selling Student Data to (a) market or advertise to students or families/guardians; (b) inform, influence, or enable marketing, advertising, or other commercial efforts by Hope Squad or any third party; (c) develop a profile of a student, family member/guardian or group, for any commercial purpose other than providing the Service to LEA; or (d) use the Student Data for the development of commercial products or services, other than as necessary to provide the Service to LEA. This section does not prohibit Hope Squad from generating legitimate personalized learning recommendations.

‍Data Provisions.

Data Security: Hope Squad agrees to utilize administrative, physical, and technical safeguards designed to protect Student Data from unauthorized access, disclosure, acquisition, destruction, use, or modification. Hope Squad shall adhere to any applicable law relating to data security. Hope Squad shall provide contact information of an employee who LEA may contact if there are any data security concerns or questions.

Data Breach: In the event of an unauthorized release, disclosure or acquisition of Student Data that compromises the security, confidentiality or integrity of the Student Data maintained by Hope Squad, Hope Squad shall provide notification to LEA within seventy-two (72) hours of confirmation of the incident, unless notification within this time limit would disrupt investigation of the incident by law enforcement. In such an event, notification shall be made within a reasonable time after the incident. Hope Squad agrees to adhere to all federal and state requirements with respect to a data breach related to the Student Data, including, when appropriate or required, the required responsibilities and procedures for notification and mitigation of any such data breach.

Audits: No more than once a year, or upon receipt of a written request from the LEA with at least thirty (30) business days’ notice and upon the execution of an appropriate confidentiality agreement, Hope Squad will allow and reasonably cooperate with the LEA to audit the security and privacy measures that are in place to ensure protection of Student Data or any portion thereof as it pertains to the delivery of Services to the LEA.  

‍Miscellaneous  

Term: Hope Squad shall be bound by this DPA for the duration of the Program Agreement or so long as Hope Squad maintains any Student Data. Notwithstanding the foregoing, Hope Squad agrees to be bound by the terms and obligations of this DPA for no less than three (3) years.

Termination: In the event that either party seeks to terminate this DPA, they may do so by mutual written consent so long as the Program Agreement has lapsed or has been terminated.

Effect of Termination; Survival: If the Program Agreement is terminated, Hope Squad shall dispose of all of LEA’s Data pursuant to Section 5(e).

Priority of Agreements: This DPA shall govern the treatment of Student Data in order to comply with the privacy protections, including those found in FERPA and all applicable privacy statutes cited in this DPA. In the event there is conflict between the terms of the DPA and the Program Agreement, or with any terms of service, privacy policy, or other writing, the terms of this DPA shall apply and take precedence. Except as described in this paragraph, all other provisions of the Program Agreement shall remain in effect. For the avoidance of doubt, Hope Squad may amend this DPA from time to time at Hope Squad’s sole discretion with appropriate notice to the School in the event the rights granted to School are materially altered.  

Notice: All notices or other communication required or permitted to be given hereunder must be in writing and given by personal delivery, facsimile or e-mail transmission (if contact information is provided for the specific mode of delivery), or first-class mail, postage prepaid, sent to the designated representatives of either party.

Entire Agreement: This DPA constitutes the entire agreement of the parties relating to the subject matter and supersedes all prior communications, representations, or agreements, oral or written, by the parties. This DPA may be amended and the observance of any provision of this DPA may be waived (either generally or in any particular instance and either retroactively or prospectively) only with the signed written consent of both parties. Neither failure nor delay on the part of any party in exercising any right, power, or privilege hereunder shall operate as a waiver of such right, nor shall any single or partial exercise of any such right, power, or privilege preclude any further exercise thereof or the exercise of any other right, power, or privilege.

Severability: Any provision of this DPA that is prohibited or unenforceable in any jurisdiction shall, as to such jurisdiction, be ineffective to the extent of such prohibition or unenforceability without invalidating the remaining provisions of this DPA, and any such prohibition or unenforceability in any jurisdiction shall not invalidate or render unenforceable such provision in any other jurisdiction. Notwithstanding the foregoing, if such provision could be more narrowly drawn so as not to be prohibited or unenforceable in such jurisdiction while, at the same time, maintaining the intent of the parties, it shall, as to such jurisdiction, be so narrowly drawn without invalidating the remaining provisions of this DPA or affecting the validity or enforceability of such provision in any other jurisdiction.

Governing Law; Venue and Jurisdiction: THIS DPA WILL BE GOVERNED BY AND CONSTRUED IN ACCORDANCE WITH THE LAWS OF THE STATE OF UTAH, WITHOUT REGARD TO CONFLICTS OF LAW PRINCIPLES. EACH PARTY CONSENTS AND SUBMITS TO THE SOLE AND EXCLUSIVE JURISDICTION TO THE STATE AND FEDERAL COURTS FOR THE COUNTY IN WHICH THIS AGREEMENT IS FORMED FOR ANY DISPUTE ARISING OUT OF OR RELATING TO THIS SERVICE AGREEMENT OR THE TRANSACTIONS CONTEMPLATED HEREBY.

Authority: Operator represents that it is authorized to bind to the terms of this DPA, including confidentiality and destruction of Student Data and any portion thereof contained therein, all related or associated institutions, individuals, employees or contractors who may have access to the Student Data and/or any portion thereof, or may own, lease or control equipment or facilities of any kind where the Student Data and portion thereof is stored, maintained or used in any way.

Waiver: Waiver by any party to this DPA of any breach of any provision of this DPA or warranty of representation set forth herein shall not be construed as a waiver of any subsequent breach of the same or any other provision. The failure to exercise any right under this DPA shall not operate as a waiver of such right. All rights and remedies provided for in this DPA are cumulative. Nothing in this DPA shall be construed as a waiver or relinquishment of any governmental immunities or defenses on behalf of the LEA, its trustees, officers, employees, and agents as a result of the execution of this DPA or performance of the functions or obligations described herein.

Assignment: The parties may not assign their rights, duties, or obligations under this DPA, either in whole or in part, without the prior written consent of the other party except that either party may assign any of its rights and obligations under this DPA without consent in connection with any merger (including without limitation by operation of law), consolidation, reorganization, or sale of all or substantially all of its related assets or similar transaction. This DPA inures to the benefit of and shall be binding on the parties’ permitted assignees, transferees and successors.

Exhibit A

Hope Squad shall collect student responses to questionnaires described below (the “Student Survey Responses”):
‍
Member Pre-Survey: completed before any Hope Squad curriculum lessons are taught

Mental Health Referral Form: completed after meeting with any student reporting suicide-related or any other mental health concerns. Referrals can come from Hope Squad members and non-members (i.e., any staff, student, parent, etc.) as well as may be made about oneself, or someone else that an individual is concerned about

Member Post-Survey: completed at the end of the academic year, or after all Hope Squad curriculum lessons are taught    

Hope Squad will collect the following information from students through the Student Survey Responses:

Demographic information:

• Gender
• Age (birth month and year)
• Initials
• State of residency
• Ethnicity or race

Enrollment information

• Student grade level

Student Survey Responses

• Student responses to surveys or questionnaires