# Student Data Privacy Consortium (SDPC) National Data Privacy Agreement **Pre-redlined template — Version 1.0 (April 18, 2026)** **Operator: WiseBoard (Chaz Landry, sole proprietor)** > This template is based on the **SDPC National Data Privacy Agreement v1r6** > ([sdpc.a4l.org](https://sdpc.a4l.org)) and is provided to school districts > ("LEA") evaluating WiseBoard ("Provider"). The Operator has pre-completed > Provider-side fields and Exhibits A–H so that an LEA can countersign within > one business day. Districts that require their state's preferred variant > (e.g. NY 2-d, TX SB 820, CA-NDPA) may submit it; we will execute the same > obligations under the state form. --- ## Cover sheet - **LEA:** _________________________ ("LEA") - **Provider:** WiseBoard (Chaz Landry, dba "WiseBoard"), USA - **Service:** WiseBoard classroom-management platform, available at https://mywiseboardclassroom.com - **Effective Date:** _____________ - **Term:** Three (3) years from Effective Date, auto-renewing for successive one-year terms unless terminated. ## ARTICLE I — PURPOSE AND SCOPE 1. **Purpose.** This DPA is entered to (i) ensure Provider's compliance with FERPA (20 U.S.C. § 1232g; 34 C.F.R. Part 99), COPPA (15 U.S.C. §§ 6501–6506), PPRA, and applicable state student-data-privacy laws including SOPPA (105 ILCS 85), SOPIPA (Cal. B&P Code § 22584), New York Ed. Law § 2-d, Texas SB 820 (Educ. Code § 32.151 et seq.), and CRS § 22-16-101 et seq.; and (ii) define the rights and obligations of the parties with respect to Student Data. 2. **Provider as School Official.** For purposes of FERPA, the LEA designates Provider as a "school official" with a "legitimate educational interest" under 34 C.F.R. § 99.31(a)(1)(i)(B). Provider is under the LEA's direct control with respect to the use and maintenance of Student Data. 3. **Scope.** This DPA covers Student Data that LEA authorizes its teachers, administrators, or roster integrations to transmit to or store within the Service. Provider does not require Student Data; the Service supports privacy modes (Anonymous Codes, Student-ID, First-Name) under which little or no Student Data is transmitted. ## ARTICLE II — DATA OWNERSHIP AND AUTHORIZED ACCESS 1. **Data ownership.** All Student Data transmitted to Provider remains the property of and under the control of the LEA. 2. **Parent access & correction.** On written request from the LEA, Provider will provide an LEA-accessible export of all Student Data associated with a named student within 30 days, and will correct or delete records on LEA written direction. 3. **Limited authorized access.** Provider personnel are granted access to Student Data only on a need-to-know basis, are bound by written confidentiality obligations, and are trained at hire and annually on FERPA, COPPA, and applicable state laws. ## ARTICLE III — DUTIES OF PROVIDER 1. **Privacy compliance.** Provider shall comply with all applicable federal and state student-privacy laws. 2. **No secondary use.** Provider shall not use Student Data for advertising, behavioral profiling, sale, lease, or any other commercial purpose unrelated to providing the Service. Provider shall not use Student Data to amend or build profiles for non-educational purposes. 3. **No re-disclosure.** Provider shall not disclose Student Data to any third party except (a) subprocessors bound by equivalent obligations and listed in Exhibit E, (b) as compelled by law (with prior notice to the LEA where lawful), or (c) with prior written LEA consent. 4. **Data security.** Provider shall maintain administrative, technical, and physical safeguards described in Exhibit F, including AES-256 encryption at rest, TLS 1.2+ in transit, role-based access control, and annual penetration testing of the production application. 5. **Employee training.** All Provider personnel with access to Student Data are trained annually on this DPA and applicable laws. 6. **Data minimization.** Provider shall collect only Student Data reasonably necessary to provide the Service. 7. **Audits.** On reasonable notice, the LEA may audit Provider's compliance with this DPA, either directly or via SOC 2 Type II report once available (see Exhibit H). ## ARTICLE IV — DATA PROVISIONS 1. **Data storage location.** All Student Data is stored on US-based infrastructure (see Exhibit E). 2. **Backups.** Daily encrypted backups; 30-day retention; cryptographic destruction thereafter. 3. **Audit log.** Administrative access to Student Data is logged and available to the LEA on request. ## ARTICLE V — DATA BREACH 1. Provider shall notify the LEA without unreasonable delay and in no event later than seventy-two (72) hours after discovery of a confirmed data breach involving Student Data. 2. Notification shall include the nature of the breach, categories and approximate number of records, likely consequences, mitigation steps taken, and a point of contact. 3. Provider shall cooperate fully with the LEA's breach-investigation, notification, and remediation efforts at Provider's cost where the breach was caused by Provider. ## ARTICLE VI — TERMINATION 1. Either party may terminate for material breach with thirty (30) days' written notice and opportunity to cure. 2. On termination, Provider shall delete all Student Data within 30 days, except where retention is required by law, and shall certify deletion in writing to the LEA on request. ## ARTICLE VII — GENERAL OFFER OF TERMS (SDPC PIGGYBACK) Provider extends the terms of this DPA to **any other LEA in the United States** that wishes to accept them ("General Offer"). An LEA may accept by signing Exhibit C and emailing it to `info@mywiseboardclassroom.com`. Provider will countersign within five business days. (See Exhibit C.) ## ARTICLE VIII — MISCELLANEOUS 1. **Governing law.** Commonwealth of Pennsylvania, USA, except where the LEA's state law mandates otherwise for student-data matters. 2. **Entire agreement.** This DPA supersedes any conflicting click-through terms with respect to Student Data. 3. **Severability, notices, assignment, etc.** — standard provisions per the SDPC National DPA v1r6. --- ## Signatures **LEA** By: _____________________________ Name: _____________________ Title: _____________ Date: _________ **Provider — WiseBoard** By: Chaz Landry Title: Operator Date: _________ --- ## EXHIBIT A — Description of Services WiseBoard classroom-management platform: lesson planning, the Performance Tracker (a formative-assessment tracker that lives alongside the district SIS / gradebook), behavior tracking, RTI/MTSS, parent communication, and the Pip's Arcade student game suite. Delivered as a hosted web and mobile application. ## EXHIBIT B — Schedule of Data Categories collected (subject to teacher's chosen privacy mode): - **Application data** — usernames, passwords (hashed), grade level, classroom subject. - **Personal contact info** — student first/last name (only if the LEA selects "Full Names" mode), district student-ID (if "Student ID" mode). - **Performance data** — assignment scores, attendance marks, behavior points, mastery flags. - **Communications** — teacher-authored messages to parents and parent replies, when the LEA enables the parent portal. - **Categories NOT collected:** SSN, biometric, geolocation, browsing history outside the Service, advertising IDs, criminal records, medical/health, sexual orientation. ## EXHIBIT C — Definitions Standard SDPC v1r6 definitions adopted by reference. ## EXHIBIT D — Notice of General Offer (signed by Provider, accepted by LEAs) WiseBoard, as Provider, hereby offers the General Offer of Privacy Terms set forth in Article VII to any LEA in the United States. Acceptance procedure described in Article VII. ## EXHIBIT E — Subprocessors See current list at `https://mywiseboardclassroom.com/trust/subprocessors.md`. Provider commits to thirty (30) days' advance notice of additions/changes via the LEA's Trust Center subscription. ## EXHIBIT F — Data Security Requirements See `https://mywiseboardclassroom.com/trust/security-overview.md` and the Incident Response Runbook at `https://mywiseboardclassroom.com/trust/incident-response.md`. Provider maintains AES-256 at rest, TLS 1.2+ in transit, bcrypt password hashing, role-based access, daily encrypted backups, annual penetration testing, and a documented vulnerability disclosure program. ## EXHIBIT G — Supplemental State Terms (incorporated where applicable) - **Illinois SOPPA** — annual subprocessor list publication and 30-day breach notification to affected parents. - **New York Ed. Law 2-d** — Parents' Bill of Rights for Data Privacy and Security incorporated. Provider acknowledges Provider data security and privacy plan obligations under § 2-d(5). - **Texas SB 820 / Education Code § 32.151** — cybersecurity framework adoption (NIST CSF mapping). - **California SOPIPA** — prohibition on sale/advertising/profiling reaffirmed. - **Colorado CRS § 22-16-101 et seq.** — annual list of contracted operators on Provider's Trust Center. ## EXHIBIT H — Additional Provider Documents - VPAT 2.4 (WCAG 2.2 AA conformance) — `https://mywiseboardclassroom.com/trust/vpat-2.4.md` - SOC 2 Readiness Assessment + Roadmap — `https://mywiseboardclassroom.com/trust/soc2-readiness.md` - Subprocessor change-notification policy — `https://mywiseboardclassroom.com/trust/subprocessor-change-policy.md` --- *This document is a contract template. Execution requires signature by an authorized representative of the LEA and the Provider. For execution, contact* `info@mywiseboardclassroom.com`.