1. Scope and higher protections
This Addendum applies when Ekadem processes Student Data for a US educational agency, institution or school. “Student Data” includes personally identifiable information and education records collected, maintained or generated for the school purpose. A federal, state, tribal, territorial, local, district or signed NDPA term giving students greater protection controls. This document is not a substitute for a required state exhibit.
2. School official and direct control
Ekadem performs an institutional service the School would otherwise use employees or contractors to perform. The School retains direct control over use and maintenance of education records. Ekadem uses them only for the legitimate educational interests and purposes in the Agreement; follows School instructions and FERPA redisclosure limits; and does not use its access to create an independent education-record purpose.
3. Strict prohibited-use baseline
Ekadem will not sell, rent or monetize Student Data; use it for targeted/behavioral advertising; create a commercial profile except to support the school purpose; use it to develop an unrelated product; claim ownership; train a general-purpose AI model; disclose it beyond authorized users/subprocessors/law; or knowingly keep it past the approved period. Ekadem will not condition a student’s participation on consent to an unrelated commercial use.
4. Data transparency and minimization
The Privacy Notice, processing annex and subprocessor schedule identify data elements, purposes, recipients, countries and retention. Collection is limited to enabled features and the School’s instructions. Material expansion requires notice, an updated contract/inventory and legally sufficient authorization before applying to existing Student Data. Exact birth dates and government identifiers are not required for normal use.
5. Access, correction, export and deletion
The School may inspect, export, correct and delete Student Data and may support parent/eligible-student rights. Ekadem responds through the School, preserves the integrity of grades/records, and meets the shortest applicable state or contract support period. Deletion covers active databases, files, caches and indexes, with documented legal holds and backup expiry. On exit, Ekadem supplies a deletion certificate on request.
6. Security and incidents
Ekadem uses administrative, technical and physical safeguards appropriate to child education records, including encryption in transit/at rest, tenant and role controls, least privilege, logging, personnel confidentiality/training, vulnerability management, backup/restore, incident response and vendor controls. It notifies the School without undue delay and targets 24 hours after confirmation; any shorter state/district deadline controls. The parties coordinate notices, credit monitoring and regulator reporting according to law and fault/allocation in the signed agreement.
7. Subcontractors and legal demands
Subcontractors receive only necessary data, are contractually bound to the same use, security, incident and deletion restrictions, and appear in the Schedule. Ekadem remains responsible as required. For a compulsory demand, Ekadem verifies, narrows, redirects and challenges where lawful and notifies the School unless prohibited.
8. COPPA, PPRA and IDEA records
For children under 13, Ekadem relies on school authorization only for the school-requested educational purpose, provides direct notice and school/parent review/deletion controls, and remains responsible for operator duties. If a feature asks PPRA protected-topic survey questions, collects information for marketing, or exposes instructional materials, the School must enable it only after applying inspection, consent, notice and opt-out rules. Records governed by IDEA confidentiality or special-education law require an expressly approved workflow and heightened minimization.
9. AI and educational decisions
School Student Data is not used for foundation-model training. For new classes, AI scoring is enabled by default after the required compliance gate, but the School can switch it off. It is an automated, probabilistic support signal that may be inaccurate, incomplete, biased or unsuitable for a student’s work; it is not a final decision or grade and requires meaningful teacher review of the underlying work. No solely automated admission, placement, final grade, discipline, cheating sanction, special-education or educational-access decision is permitted. Students must have a meaningful review route.
10. State and district schedules
The strict baseline applies in every state and DC. Before a School signs, the Order Form must attach the current local exhibit when required. Enhanced review is especially necessary for:
| Jurisdiction | Required focus before launch |
|---|---|
| California | SOPIPA operator restrictions, no targeted ads/sale/profile, reasonable security and deletion; district terms |
| Colorado / Connecticut | Data inventory/transparency, contract terms, parent rights, security, deletion and incident duties |
| Illinois | SOPPA written agreement, public vendor/data support, parent access/correction/deletion, security and breach duties |
| New York | Education Law §2-d/Part 121, signed Parents’ Bill of Rights and supplement, contractor security/privacy plan, training, encryption and NIST alignment |
| Texas | Student records, parental rights, education-provider restrictions, SCOPE/child-online overlap and district procurement |
| Utah | Student Data Protection Act, metadata/data dictionary, governance, contracts, security and breach |
| WA / MN / PA / WI and public entities generally | Public records/data-practices, records retention, procurement, accessibility and local security addenda |
| US territories and tribal schools | Manual territorial/tribal/federal-program, language and procurement review |
All other states still require current primary-law review for student records, breach notice, biometrics/health edge cases, accessibility, public records and procurement. The School profile records the state/territory; an accepted contract in one state is not approval in another.
11. No waiver and no weakening
No change in ownership, bankruptcy, merger or product terms permits a weaker use of Student Data. A successor must accept this Addendum or Student Data is returned/deleted. Nothing waives sovereign immunity, state constitutional rights or mandatory duties unless an authorized public entity expressly agrees.