Data Processing Agreement (U.S.)
Gameplan Education Inc. · Version 14 · Effective October 15, 2026
1. Purpose and Scope
1.1
U.S. K-12 School Data Processing Agreement (this “Data Processing Agreement”) is incorporated into and forms part of the Service Agreement between Gameplan Education Inc. (“Gameplan”) and the customer identified in the Service Agreement (“Customer”). This Data Processing Agreement applies only where the Customer is a U.S. K-12 school, school district, charter school, local educational agency, state educational agency acting on behalf of a K-12 school system, or other U.S. educational institution providing elementary or secondary education.
1.2
This Data Processing Agreement governs Gameplan’s collection, access, use, storage, disclosure, and deletion of School Data processed by or on behalf of Customer in connection with the Services provided under the Service Agreement.
1.3
This Data Processing Agreement is intended to address Gameplan’s obligations as a school service provider under applicable U.S. federal and state student privacy laws, including FERPA and, where applicable, the Children’s Online Privacy Protection Act and its implementing rule (“COPPA”).
1.4
This Data Processing Agreement does not apply to direct-to-consumer use of the Services.
1.5
Capitalized terms not defined in this Data Processing Agreement have the meanings given to them in the Service Agreement or the incorporated Terms of Service.
2. Definitions
2.1
“School Data” means all data submitted to, collected by, generated through, or otherwise processed through the Services on behalf of Customer, including Student Data and School Personnel Data.
2.2
“Student Data” means any information relating to an identified or identifiable student that is provided to Gameplan by or on behalf of Customer, or collected by Gameplan through the provision of the Services to Customer, including information that may constitute education records or personally identifiable information from education records under FERPA.
2.3
“School Personnel Data” means personal data relating to teachers, administrators, coaches, staff, contractors, or other school-authorized users of the Services.
2.4
“Education Records” shall have the meaning set forth in the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, and its implementing regulations (“FERPA”).
2.5
“Parent” means a parent or legal guardian, and “Eligible Student” has the meaning set forth in FERPA.
2.6
“Process” or “Processing” means any operation or set of operations performed on School Data, whether or not by automated means, including collection, access, use, storage, organization, disclosure, retrieval, analysis, deletion, or destruction.
2.7
“Security Incident” means a confirmed unauthorized access to, acquisition of, disclosure of, alteration of, or destruction of School Data processed by Gameplan on behalf of Customer.
2.8
“Subprocessor” means any third party engaged by Gameplan to process School Data on behalf of Customer in connection with the Services.
2.9
“Applicable Privacy Law” means all U.S. federal and state laws, regulations, and binding governmental requirements applicable to the Processing of School Data under the Service Agreement, including FERPA, COPPA where applicable, and applicable state student privacy laws.
2.10
“Services” means the Service as defined in the Service Agreement.
2.11
“Certification Records” means School Data Processed in connection with certification services, including Candidate identity and affiliation information, Candidate and testing accounts, exam registrations, voucher use, exam attempts, scores and results, issued credentials, credential identifiers, issuance, expiration and revocation information, Proctor name, certification Testing Center location, accommodation requests and decisions, authorized verifier attestations, and examination-security or integrity records.
3. Roles and Processing Instructions
3.1
Customer determines the purposes for which the Services are used in its educational operations and provides instructions regarding the Processing of School Data under the Service Agreement.
3.2
Gameplan shall Process School Data only:
(a)
to provide, host, maintain, support, secure, monitor, troubleshoot, and administer the Services for Customer;
(b)
in accordance with the Service Agreement, this Data Processing Agreement, and Customer’s documented instructions;
(c)
to comply with applicable law; or
(d)
as otherwise expressly authorized in writing by Customer and permitted by Applicable Privacy Law.
3.3
Gameplan shall not Process School Data for any purpose that is inconsistent with the educational purposes authorized by Customer, the Service Agreement, this Data Processing Agreement, or Applicable Privacy Law.
3.4
To the extent required by Applicable Privacy Law, the parties acknowledge and agree that:
(a)
Customer acts as the educational institution, educational agency, controller, business, or other regulated party, as applicable; and
(b)
Gameplan acts as the school service provider, School Official, processor, service provider, or contractor, as applicable.
3.5
Gameplan shall promptly notify Customer if, in Gameplan’s reasonable opinion, a documented instruction violates Applicable Privacy Law. Unless prohibited by law, Gameplan may suspend the affected Processing until the issue is resolved.
4. FERPA and School Official Status
4.1
To the extent Gameplan receives or has access to Education Records or Student Data subject to FERPA, Gameplan acknowledges that it acts as a School Official or other school service provider performing an institutional service or function for which Customer would otherwise use its own employees.
4.2
Gameplan shall remain under the direct control of Customer with respect to the use and maintenance of Student Data and Education Records.
4.3
Gameplan shall access, use, and disclose Student Data only for the legitimate educational purposes authorized by the Service Agreement, this Data Processing Agreement, Customer’s documented instructions, and Applicable Privacy Law.
4.4
Gameplan shall not redisclose Student Data or Education Records except:
(a)
to authorized Subprocessors bound by written obligations consistent with this Data Processing Agreement;
(b)
as directed by Customer; or
(c)
as required by applicable law.
4.5
Gameplan shall not claim any ownership interest in Student Data. As between the parties, Customer retains all right, title, and interest in and to Student Data, subject only to the limited rights granted to Gameplan to Process such data for the purposes described in the Service Agreement and this Data Processing Agreement.
5. Children’s Data and COPPA
5.1
Where the Services are used by students under 13 with the authorization of Customer for a school-authorized educational purpose, Gameplan shall provide Customer with information reasonably necessary for Customer to provide any notice or obtain any consent required under COPPA or other Applicable Privacy Law. Gameplan remains responsible for its own COPPA obligations, including required notices, and may rely on Customer’s authorization instead of parental consent only to the extent permitted by COPPA.
5.2
Gameplan shall collect from children under 13 only the information reasonably necessary for the school-authorized educational purpose for which the Services are provided.
5.3
Gameplan shall not use personal information, Student Data, or any other School Data for behavioral advertising, targeted advertising, marketing, profiling, data brokerage, or any other unrelated commercial purpose.
5.4
Upon Customer’s reasonable request, Gameplan shall reasonably assist Customer in responding to a Parent’s request to review or delete a child’s personal information to the extent required by Applicable Privacy Law.
6. Prohibited Uses of School Data
6.1
Gameplan shall not, and shall not permit any Subprocessor to:
(a)
sell School Data;
(b)
rent School Data;
(c)
use School Data for targeted advertising, behavioral advertising, or marketing;
(d)
use School Data to create advertising profiles or commercial user profiles;
(e)
use School Data to develop, improve, or train any product, service, or model not provided to Customer, including any general-purpose artificial intelligence or machine learning model;
(f)
use School Data for data brokerage, commercial monetization, or any independent commercial purpose;
(g)
combine School Data with data obtained from other customers or third parties except as strictly necessary to provide, maintain, support, or secure the Services and as otherwise permitted by Applicable Privacy Law; or
(h)
attempt to re-identify de-identified data.
6.2
Gameplan may use de-identified and aggregated information derived from School Data solely to operate, support, maintain, secure, and improve the Services, provided that such information does not identify, and cannot reasonably be used to identify, any individual, school, district, or Customer. Gameplan shall not attempt to re-identify such information.
7. Confidentiality
7.1
Gameplan shall ensure that persons authorized to Process School Data are bound by appropriate confidentiality obligations.
7.2
Gameplan shall limit access to School Data to personnel and Subprocessors who have a legitimate need to access such data in order to provide, support, secure, or administer the Services.
7.3
Gameplan shall ensure that its personnel receive appropriate training regarding the privacy and security obligations applicable to School Data.
8. Security
8.1
Gameplan shall implement and maintain reasonable and appropriate administrative, technical, and physical safeguards designed to protect School Data against unauthorized access, acquisition, destruction, loss, alteration, disclosure, or misuse.
8.2
Such safeguards shall be appropriate to the nature of the School Data Processed and the risks presented by the Processing.
8.3
Upon Customer’s reasonable written request, and subject to confidentiality, security, and operational limitations, Gameplan shall provide information reasonably necessary to demonstrate compliance with this Section.
9. Security Incidents
9.1
Gameplan shall notify Customer without undue delay, and in no event later than forty-eight (48) hours after confirming a Security Incident involving School Data. Any earlier notification required by Applicable Privacy Law must be given within the applicable legal deadline.
9.2
Such notice shall include, to the extent known at the time:
(a)
the nature of the Security Incident;
(b)
the categories of affected School Data;
(c)
the likely consequences of the Security Incident; and
(d)
the measures taken or proposed to address the Security Incident.
9.3
Gameplan shall take reasonable steps to investigate, contain, mitigate, remediate, and document the Security Incident.
9.4
Gameplan shall reasonably cooperate with Customer in connection with Customer’s investigation, mitigation efforts, notifications, and other obligations arising from the Security Incident.
10. Subprocessors
10.1
Customer authorizes Gameplan to engage Subprocessors to Process School Data on Customer’s behalf, provided that Gameplan remains responsible for the acts and omissions of its Subprocessors to the same extent as if such acts or omissions were those of Gameplan.
10.2
Gameplan shall ensure that each Subprocessor that Processes School Data is bound by written obligations that are no less protective of School Data than the obligations imposed on Gameplan under this Data Processing Agreement.
10.3
Gameplan shall maintain a current list of authorized Subprocessors and shall make that list available to Customer upon request.
10.4
Gameplan shall provide Customer with reasonable prior notice of any material addition or replacement of a Subprocessor that will Process Student Data or other sensitive School Data.
10.5
If Customer reasonably objects to a proposed new Subprocessor on documented privacy or security grounds, the parties shall work in good faith to address the objection. If the parties cannot resolve the objection within a reasonable period, Customer may terminate the affected portion of the Services without penalty.
11. Requests and Assistance
11.1
Taking into account the nature of the Processing, Gameplan shall reasonably assist Customer in responding to requests from Parents, Eligible Students, regulators, school authorities, or other persons entitled to rights or information under Applicable Privacy Law, to the extent Customer cannot reasonably fulfill such requests without Gameplan’s assistance.
11.2
If Gameplan receives a request directly relating to School Data processed on behalf of Customer, Gameplan shall, unless prohibited by law, promptly notify Customer and direct the requester to Customer, and shall not respond except as instructed by Customer or required by law.
11.3
Gameplan shall reasonably assist Customer in responding to requests for access to, correction of, deletion of, or restriction regarding Student Data to the extent required by Applicable Privacy Law.
12. Data Retention Return and Deletion
12.1
Gameplan shall retain School Data only for as long as reasonably necessary to provide the Services, fulfill Customer’s documented instructions, comply with applicable law, or satisfy the limited retention purposes expressly permitted under this Section 12.
12.2
Upon expiration or termination of the Service Agreement, or earlier upon Customer’s written request where legally required, Gameplan shall return School Data in a reasonably usable format and securely delete School Data from its production systems within thirty (30) days, except for:
(a)
Certification Records retained in accordance with Section 12.5;
(b)
records required to be retained by applicable law; and
(c)
School Data temporarily retained in routine backup systems in accordance with Section 12.3.
12.3
School Data contained in routine backup systems shall be deleted in accordance with Gameplan’s standard backup-rotation schedule, which shall not exceed ninety (90) days, unless a longer period is required by applicable law. Until deleted, such data will remain protected under this Data Processing Agreement and will not be restored or otherwise Processed except for disaster recovery, security, or legal purposes.
12.4
Upon Customer’s written request, Gameplan shall provide written confirmation of the deletion of School Data, subject to the permitted retention described in this Section.
12.5
Where the Customer purchases or uses certification services, the Customer instructs and authorizes Gameplan to retain only those Certification Records reasonably necessary to:
(a)
issue, maintain, and verify credentials;
(b)
administer permitted retakes, reviews, and appeals;
(c)
investigate and document examination irregularities, fraud, security incidents, and credential revocations; and
(d)
comply with applicable legal and recordkeeping obligations.
12.6
Certification Records retained under this Section remain subject to this Data Processing Agreement for as long as they constitute School Data. Gameplan shall not use retained Certification Records for advertising, marketing, commercial profiling, data brokerage, or any purpose unrelated to certification administration, credential verification, examination integrity, security, or legal compliance.
12.7
If the Customer requests deletion of a Certification Record that is necessary to support or verify an active credential, Gameplan may permanently revoke or invalidate the affected credential before deleting the record, after informing the Customer of that consequence.
12.8
Gameplan shall securely delete each retained Certification Record when the applicable retention period expires or when the record is no longer reasonably necessary for the permitted purpose, whichever occurs first, unless continued retention is required by applicable law.
13. Audits and Compliance Information
13.1
No more than once annually, and subject to reasonable confidentiality, security, and operational safeguards, Customer may request information reasonably necessary to verify Gameplan’s compliance with this Data Processing Agreement.
13.2
Gameplan may satisfy this obligation by providing current security documentation, summaries of third-party audits or certifications, penetration test summaries, policy summaries, or similar materials, to the extent available.
13.3
If Customer reasonably determines that additional review is necessary due to a material compliance concern, the parties shall cooperate in good faith on a mutually acceptable review process that does not unreasonably interfere with Gameplan’s operations or compromise the security of other customers.
14. Government Requests and Required Disclosures
14.1
If Gameplan receives a subpoena, court order, governmental demand, or other compulsory legal request seeking School Data processed on behalf of Customer, Gameplan shall, unless prohibited by law, promptly notify Customer and provide reasonable cooperation so Customer may seek protective relief or otherwise respond.
14.2
Gameplan may disclose the requested information only to the extent legally required.
15. State Student Privacy Laws
15.1
If any applicable U.S. state student privacy law imposes requirements that are stricter than this Data Processing Agreement, Gameplan shall comply with such stricter requirements to the extent applicable to the Services provided to Customer.
15.2
Upon Customer’s reasonable request, the parties shall cooperate in good faith to execute a state-specific rider or amendment reflecting such additional requirements, provided it is consistent with the parties’ commercial agreement and Gameplan’s role as a school service provider.
16. Term and Order of Precedence
16.1
This Data Processing Agreement takes effect on the effective date of the Service Agreement and remains in effect for as long as Gameplan Processes School Data on behalf of Customer, including during any authorized return, retention, backup, certification-record, or deletion period.
16.2
In the event of a conflict between this Data Processing Agreement and the Privacy Policy, Terms of Service, Testing Center Terms, Proctor Terms, Candidate Terms, click-through terms, or other user-facing terms, this Data Processing Agreement will control with respect to the Processing of School Data and Student Data.
16.3
In the event of a conflict between this Data Processing Agreement and the main Service Agreement, the main Service Agreement will control except to the extent the conflict concerns the Processing of School Data or Student Data, in which case this Data Processing Agreement will control.
17. Governing Law and Venue
17.1
This Data Processing Agreement shall be governed by and construed in accordance with the laws governing the Service Agreement for U.S. Customers.
17.2
Any dispute arising out of or relating to this Data Processing Agreement shall be resolved in accordance with the dispute resolution provisions of the Service Agreement.
18. Description of Processing
18.1
The subject matter of the Processing is Gameplan’s provision of the Services to U.S. K-12 schools, including its educational platform, educational content, curriculum, assessments, certification examinations, exam vouchers, credentialing services, examination-administration functionality, training, implementation, and related support services.
18.2
The duration of the Processing is the term of the Service Agreement and any authorized transition, return, retention, certification-record, backup, or deletion period permitted by the Service Agreement, this Data Processing Agreement, or applicable law.
18.3
The nature and purposes of the Processing may include hosting, storing, organizing, retrieving, displaying, disclosing as instructed, supporting, securing, troubleshooting, communicating regarding, and otherwise Processing School Data as necessary to provide the Services.
18.4
Where certification services are purchased or enabled, the nature and purposes of the Processing may also include Candidate registration, voucher administration, identity verification, examination scheduling and delivery, scoring, results reporting, credential issuance and verification, retake administration, accommodation administration, examination-security monitoring, irregularity investigation, credential revocation, and related support.
18.5
The categories of individuals whose data may be Processed include students, teachers, administrators, coaches, staff, contractors, Candidates, Proctors, parents, guardians, authorized accommodation verifiers, and other school-authorized users of the Services.
18.6
The categories of School Data that may be Processed, to the extent submitted to or collected through the Services on behalf of Customer, include:
(a)
names, school email addresses, and other school-issued contact information;
(b)
account credentials, login identifiers, school or district affiliations, and user roles;
(c)
class, roster, course, cohort, and group information;
(d)
assignments, submissions, assessments, grades, feedback, progress information, and portfolios;
(e)
messages, communications, support records, and administrative records;
(f)
video, audio, images, documents, and other files uploaded by or on behalf of Customer;
(g)
exam registrations, voucher assignments and use, exam attempts, scores, results, retakes, and examination-administration records;
(h)
credential identifiers, credential status, issuance, expiration, verification, suspension, and revocation records;
(i)
accommodation requests, approved accommodations, and decisions; and
(j)
examination-security, integrity, incident, investigation, appeal, and enforcement records.
18.7
Gameplan does not ordinarily require or retain underlying medical or diagnostic documentation supporting an accommodation request. Unless expressly agreed otherwise, the Customer or another authorized verifier will retain such documentation and provide Gameplan only with the information and attestation reasonably necessary to administer the approved accommodation.
18.8
Depending on Customer’s use of the Services, School Data may include Student Data, Education Records, children’s personal information, and other information protected under Applicable Privacy Law.