Data Sharing Agreement

- Active Learning
- CEV
- ClassLink
- Clever
- Ellevation
- SpecialNeedsWare
- At Home Articulation
- CommonLit
- CashGuard
- SUNBucks
- Imagine Learning
- Magic School
- EDIA
- Gaggle
Active Learning
ADA-Accessible Web Version: active learning, Student PII Agreement
Document Information
Title: Addendum to Contract: Personally Identifiable Information (PII), NDAA, Cybersecurity Training, and ADA Requirements
Effective Date: January 23, 2026
Vendor: Active Learning
School District: Ascension Parish School Board
Agreement Duration: Up to 4 renewal terms or until June 30, 2027
ADDENDUM/ADDITION TO CONTRACT
Addressing Personally Identifiable Information (PII), NDAA, LA Act 155 (Cyber Security Training), and the Americans with Disabilities Act Requirements (ADA)
This Addendum to Contract (“Addendum”) is entered into by and between the Ascension Parish School Board (hereinafter “School Board”) and Active Learning (hereinafter “Vendor”). The Addendum is effective as of the Date and remains in effect for renewal terms until a new agreement is signed. This agreement may stand for up to a maximum of 4 renewals or until June
30, 2027.
- The School Board, as a public entity, is subject to Title II of the Americans with Disabilities Act(ADA). The Vendor agrees to assure the School Board that it will operate in a manner that will enable the School Board to meet its Title II obligations to its staff and students. If the School Board is made aware of a shortcoming by the vendor in meeting this standard, the vendor agrees to make all reasonable efforts to meet the needs of the individual requiring the accommodation. (This assumes that the individual has the appropriate software and/or hardware that is required to take advantage of the accommodations offered.)
- During the 2014 Louisiana Legislative Session, the State of Louisiana enacted new laws governing the collection, disclosure and use of students’ personally identifiable information. The new laws require that any contracts between a Louisiana school system and a third-party, who is entrusted with personally identifiable information of any student of such school system, contain the statutorily prescribed minimum requirements as to the use of student personally identifiable information. In order to comply with the requirements of the new laws, this Addendum and the terms contained herein are hereby incorporated into any agreement previously entered into or currently being entered into between Vendor and the School Board, Contract Number and Date (the “Contract”).
- During the 2014 Louisiana Legislative Session, the State of Louisiana enacted new laws governing the collection, disclosure and use of students’ personally identifiable information. The new laws require that any contracts between a Louisiana school system and a third-party, who is entrusted with personally identifiable information of any student of such school system, contain the statutorily prescribed minimum requirements as to the use of student personally identifiable information. In order to comply with the requirements of the new laws, this Addendum and the terms contained herein are hereby incorporated into any agreement previously entered into or currently being entered into between Vendor and the School Board, Contract Number and Date (the “Contract”).
- Act 155, enacting La. Rev. Stat. Ann. §42:1267, requires cybersecurity training for officials (vendor employees) who have access to the agency’s information technology assets. Online training was developed by the Department of State Civil Service. Online vendors must offer
training to their employees for CyberSecurity prevention and awareness or have the individuals complete the state’s training in cooperation with the School Board. - In accordance with La. R.S. 17:3913(F), Vendor agrees to protect any personally identifiable
information of students of School Board provided to Vendor under the Contract (“Student PII”) in
a manner that allows only those individuals and entities, who are authorized by Vendor to access
the information, the ability to do so. Student PII should be protected by appropriate security
measures, including, but not limited to, the use of user names, secure passwords, encryption,
security questions, etc. Vendor’s network must maintain a high level of electronic protection to
maintain the integrity of, and to prevent unauthorized access to, Student PII. The Vendor agrees
to perform regular reviews of its protection methods and perform system auditing to maintain
protection of its systems. For systems intended to process or store Student PII, Vendor will
maintain secure systems that are patched, up to date, and have all appropriate security updates
installed. - To ensure that the only individuals and entities who can access Student PII are those that have been specifically authorized by Vendor to access Student PII, Vendor shall implement appropriate forms of authentication to identify the specific individual or entity who is accessing the information and maintain encryption in all storage, backup and transmission. Vendor must individually determine the appropriate level of security that will provide the necessary level of protection for the Student PII it maintains. Vendor shall not allow any individual or entity unauthenticated access to confidential Student PII at any time
- Vendor shall implement appropriate measures to ensure the confidentiality and security of Student PII, protect against any unauthorized access or disclosure of information, and prevent any other unauthorized action within Vendor’s control regarding the access, disclosure or use of Student PII that could result in substantial harm to the School Board or any individual identified by the data.
- Vendor agrees that any and all Student PII will be stored, processed, and maintained in a secure location and solely on servers and systems owned by Vendor or operated by Vendor through use of third-party services (collectively, “Vendor Systems”). No Student PII, at any time, will be
processed on or transferred to any portable computing device or any portable storage medium, unless that storage medium is in use as part of Vendor’s designated backup and recovery processes. All servers, storage, backups, and network paths utilized in the delivery of the product(s) and/or service(s) called for under the Contract shall be contained within the United States unless specifically agreed to in writing by the School Board. - Vendor agrees that any and all Student PII shall be used expressly and solely for the purposes enumerated in the original Contract, as supplemented hereby. Student PII shall not be distributed, used, or shared for any other purpose. As required by Federal and State law, Vendor further agrees that no Student PII of any kind shall be revealed, transmitted, exchanged or otherwise passed outside the Vendor Systems to other vendors or interested parties unless specifically requested or authorized in writing by the School Board. Vendor shall not sell, transfer, share or process any student data for any purposes other than those listed in the Contract, including commercial advertising, marketing, or any other commercial purpose. The foregoing does not, however, preclude Vendor from using de-identified data derived from the operations of Vendor Systems to improve Vendor’s own products and services.
- Vendor shall establish and implement a clear data breach response plan outlining organizational policies and procedures for addressing a potential breach. Vendor’s response plan shall require prompt response for minimizing the risk of any further data loss and any negative consequences
of the breach, including potential harm to affected individuals. A data breach is any instance in which there is an unauthorized release or access of personally identifiable information or other legally or contractually protected information not suitable for public release. This definition
applies regardless of whether Vendor stores and manages the data directly or through a contractor, such as a cloud service provider. - Vendor shall develop a policy for the protection and storage of audit logs. The policy shall require the storing of audit logs and records on a server separate from the system that generates the audit trail. Vendor must restrict access to audit logs to prevent tampering or altering of audit data.
Retention of audit trails shall be based on a schedule determined after consultation with operational, technical, risk management, and legal staff. - Vendor is permitted to disclose Student PII to its employees, authorized subcontractors, agents, consultants, service providers and auditors on a need to know basis only, provided that all such subcontractors, agents, consultants, service providers and auditors have written confidentiality obligations to Vendor consistent with, and at least as protective as, the terms of the Contract, as supplemented hereby. The confidentiality obligations shall survive termination of any agreement with Vendor for so long as the information remains confidential. Vendor shall be responsible to the School Board for any prohibited or unauthorized disclosure or use of Student PII by any of its employees, subcontractors, agents, consultants, service providers, and auditors.
- Vendor acknowledges and agrees that unauthorized disclosure or use of Student PII may damage
The School Board in such a way that adequate compensation could not be obtained solely in monetary damages. Accordingly, the School Board shall have the right to seek injunctive relief restraining the actual or threatened unauthorized disclosure or use of any Student PII, in addition to any other remedy otherwise available (including reasonable attorney fees). Vendor agrees to comply with the requirements of La. R.S. 51:3071 et seq. (Louisiana Database Breach Notification Law) as well as any other applicable laws that require the notification of individuals in the event of unauthorized release of personally identifiable information or other event requiring notification. In the event of a breach of any of the Vendor’s security obligations or other event requiring notification by Vendor under applicable law, Vendor agrees to notify the School Board promptly
and assume responsibility for informing all such individuals in accordance with applicable law. - In accordance with applicable state and federal law, Vendor agrees that security auditors from any state, federal, or other agency, as well as security auditors so designated by the School Board, shall have the option to audit those portions of Vendor Systems that enable the product(s) and/or service(s) called for under the Contract. Associated records shall be made available to such auditors when requested.
- Upon expiration or termination of the Contract, Vendor will furnish the School Board an export file with School Board’s data in the applicable product(s) or service(s) as of the expiration or termination of the Contract. Vendor will retain School Board’s data for the duration of the Contract and any renewals and, unless otherwise directed by School Board in writing, for up to an additional 12 months thereafter in order to allow School Board to restart its use of the ordered product(s) or service(s) following an earlier subscription lapse or termination. Upon expiration of the 12-month period, or earlier if requested in writing by the School Board, Vendor will erase, destroy, and render unreadable, all Student PII in its entirety in a manner that prevents its physical reconstruction through the use of commonly available file restoration utilities. Vendor shall certify in writing that these actions have been completed within 30 days of the expiration of the 12-month post-termination period or within seven (7) days from receipt of any request by the School Board, whichever comes first. Notwithstanding the foregoing, but subject to all confidentiality, security, and other applicable requirements of this Addendum, Vendor may retain School Board data in its backups and disaster recovery systems until such data are deleted in the ordinary course.
- If Vendor has published an Acceptable Use Policy (AUP) and a Platform and Service Privacy Policy, (“Platform Privacy Policy”), on its website, these policies apply with respect to the applicable product(s) or service(s) provided to School Board under the Contract, but Vendor acknowledges that if any provision of either of those policies is deemed to conflict with a provision of this Addendum, the applicable provision of this Addendum will control relative to School Board.
- The obligations of Vendor under this Addendum apply to the Vendor Systems and the actions of Vendor (and, if applicable, its subcontractors, agents, consultants, service providers, and auditors). School Board is and shall remain responsible for: (a) only authorizing those school officials andparents (each as defined in the Platform Privacy Policy) who have a legitimate need to access Student PII, (ii) limiting a school official’s access to only that information necessary for her to perform her duties (e.g., restricting a teacher’s access to information about only her current students) and (iii) limiting a parent’s access to only information about that parent’s minor student. In addition, the School Board retains responsibility and control over the operation, maintenance, and management of, and all access to and use of, the School Board’s information technology infrastructure, whether owned by the School Board or operated by the School Board through use of third-party systems and services.
- The terms of this Addendum shall supplement and supersede any conflicting terms or conditions of the original Contract between the Parties. Subject to the foregoing, the terms of the original Contract shall remain in full force and effect.
- Vendor must incorporate the provisions of this agreement in their contract, or sign the Affidavit below and submit to the Ascension Parish School Board.
CEV
ADA-Accessible Web Version: Cev multimedia, LLC Student PII Agreement
Document Information
Title: Addendum to Contract: Personally Identifiable Information (PII), NDAA, Cybersecurity Training, and ADA Requirements
Effective Date: January 23, 2026
Vendor: CEV Multimedia, LLC.
School District: Ascension Parish School Board
Agreement Duration: Up to 4 renewal terms or until June 30, 2027
ADDENDUM/ADDITION TO CONTRACT
Addressing Personally Identifiable Information (PII), NDAA, LA Act 155 (Cyber Security Training) and the Americans with Disabilities Act Requirements (ADA)
This Addendum to Contract (“Addendum”) is entered into by and between the Ascension Parish School Board (hereinafter “School Board”) and CEV Multimedia, LLC (hereinafter “Vendor”). The Addendum is effective as of the Date and remains in effect for renewal terms until a new agreement is signed. This agreement may stand for up to a maximum of 4 renewals or until June
30, 2027.
- The School Board, as a public entity, is subject to Title II of the Americans with Disabilities Act(ADA). The Vendor agrees to assure the School Board that it will operate in a manner that will enable the School Board to meet its Title II obligations to its staff and students. If the School Board is made aware of a shortcoming by the vendor in meeting this standard, the vendor agrees to makeall reasonable efforts to meet the needs of the individual requiring the accommodation. (This assumes that the individual has the appropriate software and/or hardware that is required to takeadvantage of the accommodations offered.)
- During the 2014 Louisiana Legislative Session, the State of Louisiana enacted new laws governingthe collection, disclosure and use of students’ personally identifiable information. The new laws require that any contracts between a Louisiana school system and a third-party, who is entrusted with personally identifiable information of any student of such school system, contain the statutorily prescribed minimum requirements as to the use of student personally identifiable information. In order to comply with the requirements of the new laws, this Addendum and the terms contained herein are hereby incorporated into any agreement previously entered into or currently being entered into between Vendor and the School Board, Contract Number and Date (the “Contract”).
- Act 155, enacting La. Rev. Stat. Ann. §42:1267, requires cybersecurity training for officials (vendor employees) who have access to the agency’s information technology assets. Online training was developed by the Department of State Civil Service. Online vendors must offer
training to their employees for CyberSecurity prevention and awareness or have the individuals complete the state’s training in cooperation with the School Board. - In accordance with La. R.S. 17:3913(F), Vendor agrees to protect any personally identifiable
information of students of School Board provided to Vendor under the Contract (“Student PII”) in
a manner that allows only those individuals and entities, who are authorized by Vendor to access
the information, the ability to do so. Student PII should be protected by appropriate security
measures, including, but not limited to, the use of user names, secure passwords, encryption,
security questions, etc. Vendor’s network must maintain a high level of electronic protection to
maintain the integrity of, and to prevent unauthorized access to, Student PII. The Vendor agrees
to perform regular reviews of its protection methods and perform system auditing to maintain
protection of its systems. For systems intended to process or store Student PII, Vendor will
maintain secure systems that are patched, up to date, and have all appropriate security updates
installed. - To ensure that the only individuals and entities who can access Student PII are those that have been specifically authorized by Vendor to access Student PII, Vendor shall implement appropriate forms of authentication to identify the specific individual or entity who is accessing the information and maintain encryption in all storage, backup and transmission. Vendor must individually determine the appropriate level of security that will provide the necessary level of protection for the Student PII it maintains. Vendor shall not allow any individual or entity unauthenticated access to confidential Student PII at any time
- Vendor shall implement appropriate measures to ensure the confidentiality and security of Student PII, protect against any unauthorized access or disclosure of information, and prevent any other unauthorized action within Vendor’s control regarding the access, disclosure or use of Student PII that could result in substantial harm to the School Board or any individual identified by the data.
- Vendor agrees that any and all Student PII will be stored, processed, and maintained in a secure location and solely on servers and systems owned by Vendor or operated by Vendor through use of third-party services (collectively, “Vendor Systems”). No Student PII, at any time, will be
processed on or transferred to any portable computing device or any portable storage medium, unless that storage medium is in use as part of Vendor’s designated backup and recovery processes. All servers, storage, backups, and network paths utilized in the delivery of the product(s) and/or service(s) called for under the Contract shall be contained within the United States unless specifically agreed to in writing by the School Board. - Vendor agrees that any and all Student PII shall be used expressly and solely for the purposes enumerated in the original Contract, as supplemented hereby. Student PII shall not be distributed, used, or shared for any other purpose. As required by Federal and State law, Vendor further agrees that no Student PII of any kind shall be revealed, transmitted, exchanged or otherwise passed outside the Vendor Systems to other vendors or interested parties unless specifically requested or authorized in writing by the School Board. Vendor shall not sell, transfer, share or process any student data for any purposes other than those listed in the Contract, including commercial advertising, marketing, or any other commercial purpose. The foregoing does not, however, preclude Vendor from using de-identified data derived from the operations of Vendor Systems to improve Vendor’s own products and services.
- Vendor shall establish and implement a clear data breach response plan outlining organizational policies and procedures for addressing a potential breach. Vendor’s response plan shall require prompt response for minimizing the risk of any further data loss and any negative consequences
of the breach, including potential harm to affected individuals. A data breach is any instance in which there is an unauthorized release or access of personally identifiable information or other legally or contractually protected information not suitable for public release. This definition
applies regardless of whether Vendor stores and manages the data directly or through a contractor, such as a cloud service provider. - Vendor shall develop a policy for the protection and storage of audit logs. The policy shall require the storing of audit logs and records on a server separate from the system that generates the audit trail. Vendor must restrict access to audit logs to prevent tampering or altering of audit data.
Retention of audit trails shall be based on a schedule determined after consultation with operational, technical, risk management, and legal staff. - Vendor is permitted to disclose Student PII to its employees, authorized subcontractors, agents, consultants, service providers and auditors on a need to know basis only, provided that all such subcontractors, agents, consultants, service providers and auditors have written confidentiality obligations to Vendor consistent with, and at least as protective as, the terms of the Contract, as supplemented hereby. The confidentiality obligations shall survive termination of any agreement with Vendor for so long as the information remains confidential. Vendor shall be responsible to the School Board for any prohibited or unauthorized disclosure or use of Student PII by any of its employees, subcontractors, agents, consultants, service providers, and auditors.
- Vendor acknowledges and agrees that unauthorized disclosure or use of Student PII may damage
The School Board in such a way that adequate compensation could not be obtained solely in monetary damages. Accordingly, the School Board shall have the right to seek injunctive relief restraining the actual or threatened unauthorized disclosure or use of any Student PII, in addition to any other remedy otherwise available (including reasonable attorney fees). Vendor agrees to comply with the requirements of La. R.S. 51:3071 et seq. (Louisiana Database Breach Notification Law) as well as any other applicable laws that require the notification of individuals in the event of unauthorized release of personally identifiable information or other event requiring notification. In the event of a breach of any of the Vendor’s security obligations or other event requiring notification by Vendor under applicable law, Vendor agrees to notify the School Board promptly
and assume responsibility for informing all such individuals in accordance with applicable law. - In accordance with applicable state and federal law, Vendor agrees that security auditors from any state, federal, or other agency, as well as security auditors so designated by the School Board, shall have the option to audit those portions of Vendor Systems that enable the product(s) and/or service(s) called for under the Contract. Associated records shall be made available to such auditors when requested.
- Upon expiration or termination of the Contract, Vendor will furnish the School Board an export file with School Board’s data in the applicable product(s) or service(s) as of the expiration or termination of the Contract. Vendor will retain School Board’s data for the duration of the Contract and any renewals and, unless otherwise directed by School Board in writing, for up to an additional 12 months thereafter in order to allow School Board to restart its use of the ordered product(s) or service(s) following an earlier subscription lapse or termination. Upon expiration of the 12-month period, or earlier if requested in writing by the School Board, Vendor will erase, destroy, and render unreadable, all Student PII in its entirety in a manner that prevents its physical reconstruction through the use of commonly available file restoration utilities. Vendor shall certify in writing that these actions have been completed within 30 days of the expiration of the 12-month post-termination period or within seven (7) days from receipt of any request by the School Board, whichever comes first. Notwithstanding the foregoing, but subject to all confidentiality, security, and other applicable requirements of this Addendum, Vendor may retain School Board data in its backups and disaster recovery systems until such data are deleted in the ordinary course.
- If Vendor has published an Acceptable Use Policy (AUP) and a Platform and Service Privacy Policy, (“Platform Privacy Policy”), on its website, these policies apply with respect to the applicable product(s) or service(s) provided to School Board under the Contract, but Vendor acknowledges that if any provision of either of those policies is deemed to conflict with a provision of this Addendum, the applicable provision of this Addendum will control relative to School Board.
- The obligations of Vendor under this Addendum apply to the Vendor Systems and the actions of Vendor (and, if applicable, its subcontractors, agents, consultants, service providers, and auditors). School Board is and shall remain responsible for: (a) only authorizing those school officials andparents (each as defined in the Platform Privacy Policy) who have a legitimate need to access Student PII, (ii) limiting a school official’s access to only that information necessary for her to perform her duties (e.g., restricting a teacher’s access to information about only her current students) and (iii) limiting a parent’s access to only information about that parent’s minor student. In addition, the School Board retains responsibility and control over the operation, maintenance, and management of, and all access to and use of, the School Board’s information technology infrastructure, whether owned by the School Board or operated by the School Board through use of third-party systems and services.
- The terms of this Addendum shall supplement and supersede any conflicting terms or conditions of the original Contract between the Parties. Subject to the foregoing, the terms of the original Contract shall remain in full force and effect.
- Vendor must incorporate the provisions of this agreement in their contract, or sign the Affidavit below and submit to the Ascension Parish School Board.
ClassLink
ADA-Accessible Web Version: Classlink, Inc. Student PII Agreement
Document Information
Title: Addendum to Contract: Personally Identifiable Information (PII), NDAA, Cybersecurity Training, and ADA Requirements
Effective Date: January 23, 2026
Vendor: Classlink
School District: Ascension Parish School Board
Agreement Duration: Up to 4 renewal terms or until June 30, 2030
ADDENDUM/ADDITION TO CONTRACT
Addressing Personally Identifiable Information (PII), NDAA, LA Act 155 (Cyber Security Training) and the Americans with Disabilities Act Requirements (ADA)
This Addendum to Contract (“Addendum”) is entered into by and between the Ascension Parish School Board (hereinafter “School Board”) and Classlink (hereinafter “Vendor”). The Addendum is effective as of the Date and remains in effect for renewal terms until a new agreement is signed. This agreement may stand for up to a maximum of 4 renewals or until June
30, 2030.
- The School Board, as a public entity, is subject to Title II of the Americans with Disabilities Act(ADA). The Vendor agrees to assure the School Board that it will operate in a manner that will enable the School Board to meet its Title II obligations to its staff and students. If the School Board is made aware of a shortcoming by the vendor in meeting this standard, the vendor agrees to makeall reasonable efforts to meet the needs of the individual requiring the accommodation. (This assumes that the individual has the appropriate software and/or hardware that is required to takeadvantage of the accommodations offered.)
- During the 2014 Louisiana Legislative Session, the State of Louisiana enacted new laws governingthe collection, disclosure and use of students’ personally identifiable information. The new laws require that any contracts between a Louisiana school system and a third-party, who is entrusted with personally identifiable information of any student of such school system, contain the statutorily prescribed minimum requirements as to the use of student personally identifiable information. In order to comply with the requirements of the new laws, this Addendum and the terms contained herein are hereby incorporated into any agreement previously entered into or currently being entered into between Vendor and the School Board, Contract Number and Date (the “Contract”).
- Act 155, enacting La. Rev. Stat. Ann. §42:1267, requires cybersecurity training for officials (vendor employees) who have access to the agency’s information technology assets. Online training was developed by the Department of State Civil Service. Online vendors must offer
training to their employees for CyberSecurity prevention and awareness or have the individuals complete the state’s training in cooperation with the School Board. - In accordance with La. R.S. 17:3913(F), Vendor agrees to protect any personally identifiable
information of students of School Board provided to Vendor under the Contract (“Student PII”) in
a manner that allows only those individuals and entities, who are authorized by Vendor to access
the information, the ability to do so. Student PII should be protected by appropriate security
measures, including, but not limited to, the use of user names, secure passwords, encryption,
security questions, etc. Vendor’s network must maintain a high level of electronic protection to
maintain the integrity of, and to prevent unauthorized access to, Student PII. The Vendor agrees
to perform regular reviews of its protection methods and perform system auditing to maintain
protection of its systems. For systems intended to process or store Student PII, Vendor will
maintain secure systems that are patched, up to date, and have all appropriate security updates
installed. - To ensure that the only individuals and entities who can access Student PII are those that have been specifically authorized by Vendor to access Student PII, Vendor shall implement appropriate forms of authentication to identify the specific individual or entity who is accessing the information and maintain encryption in all storage, backup and transmission. Vendor must individually determine the appropriate level of security that will provide the necessary level of protection for the Student PII it maintains. Vendor shall not allow any individual or entity unauthenticated access to confidential Student PII at any time
- Vendor shall implement appropriate measures to ensure the confidentiality and security of Student PII, protect against any unauthorized access or disclosure of information, and prevent any other unauthorized action within Vendor’s control regarding the access, disclosure or use of Student PII that could result in substantial harm to the School Board or any individual identified by the data.
- Vendor agrees that any and all Student PII will be stored, processed, and maintained in a secure location and solely on servers and systems owned by Vendor or operated by Vendor through use of third-party services (collectively, “Vendor Systems”). No Student PII, at any time, will be
processed on or transferred to any portable computing device or any portable storage medium, unless that storage medium is in use as part of Vendor’s designated backup and recovery processes. All servers, storage, backups, and network paths utilized in the delivery of the product(s) and/or service(s) called for under the Contract shall be contained within the United States unless specifically agreed to in writing by the School Board. - Vendor agrees that any and all Student PII shall be used expressly and solely for the purposes enumerated in the original Contract, as supplemented hereby. Student PII shall not be distributed, used, or shared for any other purpose. As required by Federal and State law, Vendor further agrees that no Student PII of any kind shall be revealed, transmitted, exchanged or otherwise passed outside the Vendor Systems to other vendors or interested parties unless specifically requested or authorized in writing by the School Board. Vendor shall not sell, transfer, share or process any student data for any purposes other than those listed in the Contract, including commercial advertising, marketing, or any other commercial purpose. The foregoing does not, however, preclude Vendor from using de-identified data derived from the operations of Vendor Systems to improve Vendor’s own products and services.
- Vendor shall establish and implement a clear data breach response plan outlining organizational policies and procedures for addressing a potential breach. Vendor’s response plan shall require prompt response for minimizing the risk of any further data loss and any negative consequences
of the breach, including potential harm to affected individuals. A data breach is any instance in which there is an unauthorized release or access of personally identifiable information or other legally or contractually protected information not suitable for public release. This definition
applies regardless of whether Vendor stores and manages the data directly or through a contractor, such as a cloud service provider. - Vendor shall develop a policy for the protection and storage of audit logs. The policy shall require the storing of audit logs and records on a server separate from the system that generates the audit trail. Vendor must restrict access to audit logs to prevent tampering or altering of audit data.
Retention of audit trails shall be based on a schedule determined after consultation with operational, technical, risk management, and legal staff. - Vendor is permitted to disclose Student PII to its employees, authorized subcontractors, agents, consultants, service providers and auditors on a need to know basis only, provided that all such subcontractors, agents, consultants, service providers and auditors have written confidentiality obligations to Vendor consistent with, and at least as protective as, the terms of the Contract, as supplemented hereby. The confidentiality obligations shall survive termination of any agreement with Vendor for so long as the information remains confidential. Vendor shall be responsible to the School Board for any prohibited or unauthorized disclosure or use of Student PII by any of its employees, subcontractors, agents, consultants, service providers, and auditors.
- Vendor acknowledges and agrees that unauthorized disclosure or use of Student PII may damage
The School Board in such a way that adequate compensation could not be obtained solely in monetary damages. Accordingly, the School Board shall have the right to seek injunctive relief restraining the actual or threatened unauthorized disclosure or use of any Student PII, in addition to any other remedy otherwise available (including reasonable attorney fees). Vendor agrees to comply with the requirements of La. R.S. 51:3071 et seq. (Louisiana Database Breach Notification Law) as well as any other applicable laws that require the notification of individuals in the event of unauthorized release of personally identifiable information or other event requiring notification. In the event of a breach of any of the Vendor’s security obligations or other event requiring notification by Vendor under applicable law, Vendor agrees to notify the School Board promptly
and assume responsibility for informing all such individuals in accordance with applicable law. - In accordance with applicable state and federal law, Vendor agrees that security auditors from any state, federal, or other agency, as well as security auditors so designated by the School Board, shall have the option to audit those portions of Vendor Systems that enable the product(s) and/or service(s) called for under the Contract. Associated records shall be made available to such auditors when requested.
- Upon expiration or termination of the Contract, Vendor will furnish the School Board an export file with School Board’s data in the applicable product(s) or service(s) as of the expiration or termination of the Contract. Vendor will retain School Board’s data for the duration of the Contract and any renewals and, unless otherwise directed by School Board in writing, for up to an additional 12 months thereafter in order to allow School Board to restart its use of the ordered product(s) or service(s) following an earlier subscription lapse or termination. Upon expiration of the 12-month period, or earlier if requested in writing by the School Board, Vendor will erase, destroy, and render unreadable, all Student PII in its entirety in a manner that prevents its physical reconstruction through the use of commonly available file restoration utilities. Vendor shall certify in writing that these actions have been completed within 30 days of the expiration of the 12-month post-termination period or within seven (7) days from receipt of any request by the School Board, whichever comes first. Notwithstanding the foregoing, but subject to all confidentiality, security, and other applicable requirements of this Addendum, Vendor may retain School Board data in its backups and disaster recovery systems until such data are deleted in the ordinary course.
- If Vendor has published an Acceptable Use Policy (AUP) and a Platform and Service Privacy Policy, (“Platform Privacy Policy”), on its website, these policies apply with respect to the applicable product(s) or service(s) provided to School Board under the Contract, but Vendor acknowledges that if any provision of either of those policies is deemed to conflict with a provision of this Addendum, the applicable provision of this Addendum will control relative to School Board.
- The obligations of Vendor under this Addendum apply to the Vendor Systems and the actions of Vendor (and, if applicable, its subcontractors, agents, consultants, service providers, and auditors). School Board is and shall remain responsible for: (a) only authorizing those school officials andparents (each as defined in the Platform Privacy Policy) who have a legitimate need to access Student PII, (ii) limiting a school official’s access to only that information necessary for her to perform her duties (e.g., restricting a teacher’s access to information about only her current students) and (iii) limiting a parent’s access to only information about that parent’s minor student. In addition, the School Board retains responsibility and control over the operation, maintenance, and management of, and all access to and use of, the School Board’s information technology infrastructure, whether owned by the School Board or operated by the School Board through use of third-party systems and services.
- The terms of this Addendum shall supplement and supersede any conflicting terms or conditions of the original Contract between the Parties. Subject to the foregoing, the terms of the original Contract shall remain in full force and effect.
- Vendor must incorporate the provisions of this agreement in their contract, or sign the Affidavit below and submit to the Ascension Parish School Board.
Clever
ADA-Accessible Web Version: Clever, Inc. Student PII Agreement
Document Information
Title: Addendum to Contract: Personally Identifiable Information (PII), NDAA, Cybersecurity Training, and ADA Requirements
Effective Date: July 7th, 2024
Vendor: Clever, Inc.
School District: Ascension Parish School Board
Agreement Duration: Up to 4 renewal terms or until June 30, 2030
ADDENDUM/ADDITION TO CONTRACT
Addressing Personally Identifiable Information (PII), NDAA, LA Act 155 (Cyber Security Training) and the Americans with Disabilities Act Requirements (ADA)
This Addendum to Contract (“Addendum”) is entered into by and between the Ascension Parish School Board (hereinafter “School Board”) and Clever Inc. (hereinafter “Vendor”). The Addendum is effective as of the Date and remains in effect for renewal terms until a new agreement is signed. This agreement may stand for up to a maximum of 4 renewals or until June
30, 2027.
- The School Board, as a public entity, is subject to Title II of the Americans with Disabilities Act(ADA). The Vendor agrees to assure the School Board that it will operate in a manner that will enable the School Board to meet its Title II obligations to its staff and students. If the School Board is made aware of a shortcoming by the vendor in meeting this standard, the vendor agrees to makeall reasonable efforts to meet the needs of the individual requiring the accommodation. (This assumes that the individual has the appropriate software and/or hardware that is required to takeadvantage of the accommodations offered.)
- During the 2014 Louisiana Legislative Session, the State of Louisiana enacted new laws governingthe collection, disclosure and use of students’ personally identifiable information. The new laws require that any contracts between a Louisiana school system and a third-party, who is entrusted with personally identifiable information of any student of such school system, contain the statutorily prescribed minimum requirements as to the use of student personally identifiable information. In order to comply with the requirements of the new laws, this Addendum and the terms contained herein are hereby incorporated into any agreement previously entered into or currently being entered into between Vendor and the School Board, Contract Number and Date (the “Contract”).
- Act 155, enacting La. Rev. Stat. Ann. §42:1267, requires cybersecurity training for officials (vendor employees) who have access to the agency’s information technology assets. Online training was developed by the Department of State Civil Service. Online vendors must offer
training to their employees for CyberSecurity prevention and awareness or have the individuals complete the state’s training in cooperation with the School Board. - In accordance with La. R.S. 17:3913(F), Vendor agrees to protect any personally identifiable
information of students of School Board provided to Vendor under the Contract (“Student PII”) in
a manner that allows only those individuals and entities, who are authorized by Vendor to access
the information, the ability to do so. Student PII should be protected by appropriate security
measures, including, but not limited to, the use of user names, secure passwords, encryption,
security questions, etc. Vendor’s network must maintain a high level of electronic protection to
maintain the integrity of, and to prevent unauthorized access to, Student PII. The Vendor agrees
to perform regular reviews of its protection methods and perform system auditing to maintain
protection of its systems. For systems intended to process or store Student PII, Vendor will
maintain secure systems that are patched, up to date, and have all appropriate security updates
installed. - To ensure that the only individuals and entities who can access Student PII are those that have been specifically authorized by Vendor to access Student PII, Vendor shall implement appropriate forms of authentication to identify the specific individual or entity who is accessing the information and maintain encryption in all storage, backup and transmission. Vendor must individually determine the appropriate level of security that will provide the necessary level of protection for the Student PII it maintains. Vendor shall not allow any individual or entity unauthenticated access to confidential Student PII at any time
- Vendor shall implement appropriate measures to ensure the confidentiality and security of Student PII, protect against any unauthorized access or disclosure of information, and prevent any other unauthorized action within Vendor’s control regarding the access, disclosure or use of Student PII that could result in substantial harm to the School Board or any individual identified by the data.
- Vendor agrees that any and all Student PII will be stored, processed, and maintained in a secure location and solely on servers and systems owned by Vendor or operated by Vendor through use of third-party services (collectively, “Vendor Systems”). No Student PII, at any time, will be
processed on or transferred to any portable computing device or any portable storage medium, unless that storage medium is in use as part of Vendor’s designated backup and recovery processes. All servers, storage, backups, and network paths utilized in the delivery of the product(s) and/or service(s) called for under the Contract shall be contained within the United States unless specifically agreed to in writing by the School Board. - Vendor agrees that any and all Student PII shall be used expressly and solely for the purposes enumerated in the original Contract, as supplemented hereby. Student PII shall not be distributed, used, or shared for any other purpose. As required by Federal and State law, Vendor further agrees that no Student PII of any kind shall be revealed, transmitted, exchanged or otherwise passed outside the Vendor Systems to other vendors or interested parties unless specifically requested or authorized in writing by the School Board. Vendor shall not sell, transfer, share or process any student data for any purposes other than those listed in the Contract, including commercial advertising, marketing, or any other commercial purpose. The foregoing does not, however, preclude Vendor from using de-identified data derived from the operations of Vendor Systems to improve Vendor’s own products and services.
- Vendor shall establish and implement a clear data breach response plan outlining organizational policies and procedures for addressing a potential breach. Vendor’s response plan shall require prompt response for minimizing the risk of any further data loss and any negative consequences
of the breach, including potential harm to affected individuals. A data breach is any instance in which there is an unauthorized release or access of personally identifiable information or other legally or contractually protected information not suitable for public release. This definition
applies regardless of whether Vendor stores and manages the data directly or through a contractor, such as a cloud service provider. - Vendor shall develop a policy for the protection and storage of audit logs. The policy shall require the storing of audit logs and records on a server separate from the system that generates the audit trail. Vendor must restrict access to audit logs to prevent tampering or altering of audit data.
Retention of audit trails shall be based on a schedule determined after consultation with operational, technical, risk management, and legal staff. - Vendor is permitted to disclose Student PII to its employees, authorized subcontractors, agents, consultants, service providers and auditors on a need to know basis only, provided that all such subcontractors, agents, consultants, service providers and auditors have written confidentiality obligations to Vendor consistent with, and at least as protective as, the terms of the Contract, as supplemented hereby. The confidentiality obligations shall survive termination of any agreement with Vendor for so long as the information remains confidential. Vendor shall be responsible to the School Board for any prohibited or unauthorized disclosure or use of Student PII by any of its employees, subcontractors, agents, consultants, service providers, and auditors.
- Vendor acknowledges and agrees that unauthorized disclosure or use of Student PII may damage
The School Board in such a way that adequate compensation could not be obtained solely in monetary damages. Accordingly, the School Board shall have the right to seek injunctive relief restraining the actual or threatened unauthorized disclosure or use of any Student PII, in addition to any other remedy otherwise available (including reasonable attorney fees). Vendor agrees to comply with the requirements of La. R.S. 51:3071 et seq. (Louisiana Database Breach Notification Law) as well as any other applicable laws that require the notification of individuals in the event of unauthorized release of personally identifiable information or other event requiring notification. In the event of a breach of any of the Vendor’s security obligations or other event requiring notification by Vendor under applicable law, Vendor agrees to notify the School Board promptly
and assume responsibility for informing all such individuals in accordance with applicable law. - In accordance with applicable state and federal law, Vendor agrees that security auditors from any state, federal, or other agency, as well as security auditors so designated by the School Board, shall have the option to audit those portions of Vendor Systems that enable the product(s) and/or service(s) called for under the Contract. Associated records shall be made available to such auditors when requested.
- Upon expiration or termination of the Contract, Vendor will furnish the School Board an export file with School Board’s data in the applicable product(s) or service(s) as of the expiration or termination of the Contract. Vendor will retain School Board’s data for the duration of the Contract and any renewals and, unless otherwise directed by School Board in writing, for up to an additional 12 months thereafter in order to allow School Board to restart its use of the ordered product(s) or service(s) following an earlier subscription lapse or termination. Upon expiration of the 12-month period, or earlier if requested in writing by the School Board, Vendor will erase, destroy, and render unreadable, all Student PII in its entirety in a manner that prevents its physical reconstruction through the use of commonly available file restoration utilities. Vendor shall certify in writing that these actions have been completed within 30 days of the expiration of the 12-month post-termination period or within seven (7) days from receipt of any request by the School Board, whichever comes first. Notwithstanding the foregoing, but subject to all confidentiality, security, and other applicable requirements of this Addendum, Vendor may retain School Board data in its backups and disaster recovery systems until such data are deleted in the ordinary course.
- If Vendor has published an Acceptable Use Policy (AUP) and a Platform and Service Privacy Policy, (“Platform Privacy Policy”), on its website, these policies apply with respect to the applicable product(s) or service(s) provided to School Board under the Contract, but Vendor acknowledges that if any provision of either of those policies is deemed to conflict with a provision of this Addendum, the applicable provision of this Addendum will control relative to School Board.
- The obligations of Vendor under this Addendum apply to the Vendor Systems and the actions of Vendor (and, if applicable, its subcontractors, agents, consultants, service providers, and auditors). School Board is and shall remain responsible for: (a) only authorizing those school officials andparents (each as defined in the Platform Privacy Policy) who have a legitimate need to access Student PII, (ii) limiting a school official’s access to only that information necessary for her to perform her duties (e.g., restricting a teacher’s access to information about only her current students) and (iii) limiting a parent’s access to only information about that parent’s minor student. In addition, the School Board retains responsibility and control over the operation, maintenance, and management of, and all access to and use of, the School Board’s information technology infrastructure, whether owned by the School Board or operated by the School Board through use of third-party systems and services.
- The terms of this Addendum shall supplement and supersede any conflicting terms or conditions of the original Contract between the Parties. Subject to the foregoing, the terms of the original Contract shall remain in full force and effect.
- Vendor must incorporate the provisions of this agreement in their contract, or sign the Affidavit below and submit to the Ascension Parish School Board.
Ellevation
ADA-Accessible Web Version: ellevation Student PII Agreement
Document Information
Title: Addendum to Contract: Personally Identifiable Information (PII), NDAA, Cybersecurity Training, and ADA Requirements
Effective Date: September 1st, 2023
Vendor: Curriculum Associates
School District: Ascension Parish School Board
Agreement Duration: Up to 4 renewal terms or until July 31st, 2027
ADDENDUM/ADDITION TO CONTRACT
Addressing Personally Identifiable Information (PII), NDAA, LA Act 155 (Cyber Security Training) and the Americans with Disabilities Act Requirements (ADA)
This Addendum to Contract (“Addendum”) is entered into by and between the Ascension Parish School Board (hereinafter “School Board”) and Curriculum Associates (hereinafter “Vendor”). The Addendum is effective as of the Date and remains in effect for renewal terms until a new agreement is signed. This agreement may stand for up to a maximum of 4 renewals or until July
31, 2027.
- The School Board, as a public entity, is subject to Title II of the Americans with Disabilities Act(ADA). The Vendor agrees to assure the School Board that it will operate in a manner that will enable the School Board to meet its Title II obligations to its staff and students. If the School Board is made aware of a shortcoming by the vendor in meeting this standard, the vendor agrees to makeall reasonable efforts to meet the needs of the individual requiring the accommodation. (This assumes that the individual has the appropriate software and/or hardware that is required to takeadvantage of the accommodations offered.)
- During the 2014 Louisiana Legislative Session, the State of Louisiana enacted new laws governingthe collection, disclosure and use of students’ personally identifiable information. The new laws require that any contracts between a Louisiana school system and a third-party, who is entrusted with personally identifiable information of any student of such school system, contain the statutorily prescribed minimum requirements as to the use of student personally identifiable information. In order to comply with the requirements of the new laws, this Addendum and the terms contained herein are hereby incorporated into any agreement previously entered into or currently being entered into between Vendor and the School Board, Contract Number and Date (the “Contract”).
- Act 155, enacting La. Rev. Stat. Ann. §42:1267, requires cybersecurity training for officials (vendor employees) who have access to the agency’s information technology assets. Online training was developed by the Department of State Civil Service. Online vendors must offer
training to their employees for CyberSecurity prevention and awareness or have the individuals complete the state’s training in cooperation with the School Board. - In accordance with La. R.S. 17:3913(F), Vendor agrees to protect any personally identifiable
information of students of School Board provided to Vendor under the Contract (“Student PII”) in
a manner that allows only those individuals and entities, who are authorized by Vendor to access
the information, the ability to do so. Student PII should be protected by appropriate security
measures, including, but not limited to, the use of user names, secure passwords, encryption,
security questions, etc. Vendor’s network must maintain a high level of electronic protection to
maintain the integrity of, and to prevent unauthorized access to, Student PII. The Vendor agrees
to perform regular reviews of its protection methods and perform system auditing to maintain
protection of its systems. For systems intended to process or store Student PII, Vendor will
maintain secure systems that are patched, up to date, and have all appropriate security updates
installed. - To ensure that the only individuals and entities who can access Student PII are those that have been specifically authorized by Vendor to access Student PII, Vendor shall implement appropriate forms of authentication to identify the specific individual or entity who is accessing the information and maintain encryption in all storage, backup and transmission. Vendor must individually determine the appropriate level of security that will provide the necessary level of protection for the Student PII it maintains. Vendor shall not allow any individual or entity unauthenticated access to confidential Student PII at any time
- Vendor shall implement appropriate measures to ensure the confidentiality and security of Student PII, protect against any unauthorized access or disclosure of information, and prevent any other unauthorized action within Vendor’s control regarding the access, disclosure or use of Student PII that could result in substantial harm to the School Board or any individual identified by the data.
- Vendor agrees that any and all Student PII will be stored, processed, and maintained in a secure location and solely on servers and systems owned by Vendor or operated by Vendor through use of third-party services (collectively, “Vendor Systems”). No Student PII, at any time, will be
processed on or transferred to any portable computing device or any portable storage medium, unless that storage medium is in use as part of Vendor’s designated backup and recovery processes. All servers, storage, backups, and network paths utilized in the delivery of the product(s) and/or service(s) called for under the Contract shall be contained within the United States unless specifically agreed to in writing by the School Board. - Vendor agrees that any and all Student PII shall be used expressly and solely for the purposes enumerated in the original Contract, as supplemented hereby. Student PII shall not be distributed, used, or shared for any other purpose. As required by Federal and State law, Vendor further agrees that no Student PII of any kind shall be revealed, transmitted, exchanged or otherwise passed outside the Vendor Systems to other vendors or interested parties unless specifically requested or authorized in writing by the School Board. Vendor shall not sell, transfer, share or process any student data for any purposes other than those listed in the Contract, including commercial advertising, marketing, or any other commercial purpose. The foregoing does not, however, preclude Vendor from using de-identified data derived from the operations of Vendor Systems to improve Vendor’s own products and services.
- Vendor shall establish and implement a clear data breach response plan outlining organizational policies and procedures for addressing a potential breach. Vendor’s response plan shall require prompt response for minimizing the risk of any further data loss and any negative consequences
of the breach, including potential harm to affected individuals. A data breach is any instance in which there is an unauthorized release or access of personally identifiable information or other legally or contractually protected information not suitable for public release. This definition
applies regardless of whether Vendor stores and manages the data directly or through a contractor, such as a cloud service provider. - Vendor shall develop a policy for the protection and storage of audit logs. The policy shall require the storing of audit logs and records on a server separate from the system that generates the audit trail. Vendor must restrict access to audit logs to prevent tampering or altering of audit data.
Retention of audit trails shall be based on a schedule determined after consultation with operational, technical, risk management, and legal staff. - Vendor is permitted to disclose Student PII to its employees, authorized subcontractors, agents, consultants, service providers and auditors on a need to know basis only, provided that all such subcontractors, agents, consultants, service providers and auditors have written confidentiality obligations to Vendor consistent with, and at least as protective as, the terms of the Contract, as supplemented hereby. The confidentiality obligations shall survive termination of any agreement with Vendor for so long as the information remains confidential. Vendor shall be responsible to the School Board for any prohibited or unauthorized disclosure or use of Student PII by any of its employees, subcontractors, agents, consultants, service providers, and auditors.
- Vendor acknowledges and agrees that unauthorized disclosure or use of Student PII may damage
The School Board in such a way that adequate compensation could not be obtained solely in monetary damages. Accordingly, the School Board shall have the right to seek injunctive relief restraining the actual or threatened unauthorized disclosure or use of any Student PII, in addition to any other remedy otherwise available (including reasonable attorney fees). Vendor agrees to comply with the requirements of La. R.S. 51:3071 et seq. (Louisiana Database Breach Notification Law) as well as any other applicable laws that require the notification of individuals in the event of unauthorized release of personally identifiable information or other event requiring notification. In the event of a breach of any of the Vendor’s security obligations or other event requiring notification by Vendor under applicable law, Vendor agrees to notify the School Board promptly
and assume responsibility for informing all such individuals in accordance with applicable law. - In accordance with applicable state and federal law, Vendor agrees that security auditors from any state, federal, or other agency, as well as security auditors so designated by the School Board, shall have the option to audit those portions of Vendor Systems that enable the product(s) and/or service(s) called for under the Contract. Associated records shall be made available to such auditors when requested.
- Upon expiration or termination of the Contract, Vendor will furnish the School Board an export file with School Board’s data in the applicable product(s) or service(s) as of the expiration or termination of the Contract. Vendor will retain School Board’s data for the duration of the Contract and any renewals and, unless otherwise directed by School Board in writing, for up to an additional 12 months thereafter in order to allow School Board to restart its use of the ordered product(s) or service(s) following an earlier subscription lapse or termination. Upon expiration of the 12-month period, or earlier if requested in writing by the School Board, Vendor will erase, destroy, and render unreadable, all Student PII in its entirety in a manner that prevents its physical reconstruction through the use of commonly available file restoration utilities. Vendor shall certify in writing that these actions have been completed within 30 days of the expiration of the 12-month post-termination period or within seven (7) days from receipt of any request by the School Board, whichever comes first. Notwithstanding the foregoing, but subject to all confidentiality, security, and other applicable requirements of this Addendum, Vendor may retain School Board data in its backups and disaster recovery systems until such data are deleted in the ordinary course.
- If Vendor has published an Acceptable Use Policy (AUP) and a Platform and Service Privacy Policy, (“Platform Privacy Policy”), on its website, these policies apply with respect to the applicable product(s) or service(s) provided to School Board under the Contract, but Vendor acknowledges that if any provision of either of those policies is deemed to conflict with a provision of this Addendum, the applicable provision of this Addendum will control relative to School Board.
- The obligations of Vendor under this Addendum apply to the Vendor Systems and the actions of Vendor (and, if applicable, its subcontractors, agents, consultants, service providers, and auditors). School Board is and shall remain responsible for: (a) only authorizing those school officials andparents (each as defined in the Platform Privacy Policy) who have a legitimate need to access Student PII, (ii) limiting a school official’s access to only that information necessary for her to perform her duties (e.g., restricting a teacher’s access to information about only her current students) and (iii) limiting a parent’s access to only information about that parent’s minor student. In addition, the School Board retains responsibility and control over the operation, maintenance, and management of, and all access to and use of, the School Board’s information technology infrastructure, whether owned by the School Board or operated by the School Board through use of third-party systems and services.
- The terms of this Addendum shall supplement and supersede any conflicting terms or conditions of the original Contract between the Parties. Subject to the foregoing, the terms of the original Contract shall remain in full force and effect.
- Vendor must incorporate the provisions of this agreement in their contract, or sign the Affidavit below and submit to the Ascension Parish School Board
SpecialNeedsWare
aDA-Accessible Web Version: SPECIAL NEEDS ware, Inc. Student PII Agreement
Document Information
Title: Addendum to Contract: Personally Identifiable Information (PII), NDAA, Cybersecurity Training, and ADA Requirements
Effective Date: October 30th, 2023
Vendor: SpecialNeeds Ware, Inc.
School District: Ascension Parish School Board
Agreement Duration: Up to 4 renewal terms or until June 30, 2027
ADDENDUM/ADDITION TO CONTRACT
Addressing Personally Identifiable Information (PII), NDAA, LA Act 155 (Cyber Security Training) and the Americans with Disabilities Act Requirements (ADA)
This Addendum to Contract (“Addendum”) is entered into by and between the Ascension Parish School Board (hereinafter “School Board”) and SpecialNeeds Ware, Inc. (hereinafter “Vendor”). The Addendum is effective as of the Date and remains in effect for renewal terms until a new agreement is signed. This agreement may stand for up to a maximum of 4 renewals or until June 30, 2027.
During the 2014 Louisiana Legislative Session, the State of Louisiana enacted new laws governing the collection, disclosure and use of students’ personally identifiable information. The new laws require that any contracts between a Louisiana school system and a third-party, who is entrusted with personally identifiable information of any student of such school system, contain the statutorily prescribed minimum requirements as to the use of student personally identifiable information. In order to comply with the requirements of the new laws, this Addendum and the terms contained herein are hereby incorporated into any agreement previously entered into or currently being entered into between Vendor and the School Board, Contract Number and Date (the “Contract”).
At Home Articulation
CommonLit
CommonLit Incs Student PII Agreement(Signed Version On File)
ADA-Accessible Web Version: CommonLit, Inc. Student PII Agreement
Document Information
Title: Addendum to Contract: Personally Identifiable Information (PII), NDAA, Cybersecurity Training, and ADA Requirements
Effective Date: January 23, 2026
Vendor: CommonLit, Inc.
School District: Ascension Parish School Board
Agreement Duration: Up to 4 renewal terms or until June 30, 2030
ADDENDUM/ADDITION TO CONTRACT
Addressing Personally Identifiable Information (PII), NDAA, LA Act 155 (Cyber Security Training) and the Americans with Disabilities Act Requirements (ADA)
This Addendum to Contract (“Addendum”) is entered into by and between the Ascension Parish School Board (hereinafter “School Board”) and CommonLit Inc. (hereinafter “Vendor”). The Addendum is effective as of the Date and remains in effect for renewal terms until a new agreement is signed. This agreement may stand for up to a maximum of 4 renewals or until June
30, 2030.
- The School Board, as a public entity, is subject to Title II of the Americans with Disabilities Act(ADA). The Vendor agrees to assure the School Board that it will operate in a manner that will enable the School Board to meet its Title II obligations to its staff and students. If the School Board is made aware of a shortcoming by the vendor in meeting this standard, the vendor agrees to makeall reasonable efforts to meet the needs of the individual requiring the accommodation. (This assumes that the individual has the appropriate software and/or hardware that is required to takeadvantage of the accommodations offered.)
- During the 2014 Louisiana Legislative Session, the State of Louisiana enacted new laws governingthe collection, disclosure and use of students’ personally identifiable information. The new laws require that any contracts between a Louisiana school system and a third-party, who is entrusted with personally identifiable information of any student of such school system, contain the statutorily prescribed minimum requirements as to the use of student personally identifiable information. In order to comply with the requirements of the new laws, this Addendum and the terms contained herein are hereby incorporated into any agreement previously entered into or currently being entered into between Vendor and the School Board, Contract Number and Date (the “Contract”).
- Act 155, enacting La. Rev. Stat. Ann. §42:1267, requires cybersecurity training for officials (vendor employees) who have access to the agency’s information technology assets. Online training was developed by the Department of State Civil Service. Online vendors must offer
training to their employees for CyberSecurity prevention and awareness or have the individuals complete the state’s training in cooperation with the School Board. - In accordance with La. R.S. 17:3913(F), Vendor agrees to protect any personally identifiable
information of students of School Board provided to Vendor under the Contract (“Student PII”) in
a manner that allows only those individuals and entities, who are authorized by Vendor to access
the information, the ability to do so. Student PII should be protected by appropriate security
measures, including, but not limited to, the use of user names, secure passwords, encryption,
security questions, etc. Vendor’s network must maintain a high level of electronic protection to
maintain the integrity of, and to prevent unauthorized access to, Student PII. The Vendor agrees
to perform regular reviews of its protection methods and perform system auditing to maintain
protection of its systems. For systems intended to process or store Student PII, Vendor will
maintain secure systems that are patched, up to date, and have all appropriate security updates
installed. - To ensure that the only individuals and entities who can access Student PII are those that have been specifically authorized by Vendor to access Student PII, Vendor shall implement appropriate forms of authentication to identify the specific individual or entity who is accessing the information and maintain encryption in all storage, backup and transmission. Vendor must individually determine the appropriate level of security that will provide the necessary level of protection for the Student PII it maintains. Vendor shall not allow any individual or entity unauthenticated access to confidential Student PII at any time
- Vendor shall implement appropriate measures to ensure the confidentiality and security of Student PII, protect against any unauthorized access or disclosure of information, and prevent any other unauthorized action within Vendor’s control regarding the access, disclosure or use of Student PII that could result in substantial harm to the School Board or any individual identified by the data.
- Vendor agrees that any and all Student PII will be stored, processed, and maintained in a secure location and solely on servers and systems owned by Vendor or operated by Vendor through use of third-party services (collectively, “Vendor Systems”). No Student PII, at any time, will be
processed on or transferred to any portable computing device or any portable storage medium, unless that storage medium is in use as part of Vendor’s designated backup and recovery processes. All servers, storage, backups, and network paths utilized in the delivery of the product(s) and/or service(s) called for under the Contract shall be contained within the United States unless specifically agreed to in writing by the School Board. - Vendor agrees that any and all Student PII shall be used expressly and solely for the purposes enumerated in the original Contract, as supplemented hereby. Student PII shall not be distributed, used, or shared for any other purpose. As required by Federal and State law, Vendor further agrees that no Student PII of any kind shall be revealed, transmitted, exchanged or otherwise passed outside the Vendor Systems to other vendors or interested parties unless specifically requested or authorized in writing by the School Board. Vendor shall not sell, transfer, share or process any student data for any purposes other than those listed in the Contract, including commercial advertising, marketing, or any other commercial purpose. The foregoing does not, however, preclude Vendor from using de-identified data derived from the operations of Vendor Systems to improve Vendor’s own products and services.
- Vendor shall establish and implement a clear data breach response plan outlining organizational policies and procedures for addressing a potential breach. Vendor’s response plan shall require prompt response for minimizing the risk of any further data loss and any negative consequences
of the breach, including potential harm to affected individuals. A data breach is any instance in which there is an unauthorized release or access of personally identifiable information or other legally or contractually protected information not suitable for public release. This definition
applies regardless of whether Vendor stores and manages the data directly or through a contractor, such as a cloud service provider. - Vendor shall develop a policy for the protection and storage of audit logs. The policy shall require the storing of audit logs and records on a server separate from the system that generates the audit trail. Vendor must restrict access to audit logs to prevent tampering or altering of audit data.
Retention of audit trails shall be based on a schedule determined after consultation with operational, technical, risk management, and legal staff. - Vendor is permitted to disclose Student PII to its employees, authorized subcontractors, agents, consultants, service providers and auditors on a need to know basis only, provided that all such subcontractors, agents, consultants, service providers and auditors have written confidentiality obligations to Vendor consistent with, and at least as protective as, the terms of the Contract, as supplemented hereby. The confidentiality obligations shall survive termination of any agreement with Vendor for so long as the information remains confidential. Vendor shall be responsible to the School Board for any prohibited or unauthorized disclosure or use of Student PII by any of its employees, subcontractors, agents, consultants, service providers, and auditors.
- Vendor acknowledges and agrees that unauthorized disclosure or use of Student PII may damage
The School Board in such a way that adequate compensation could not be obtained solely in monetary damages. Accordingly, the School Board shall have the right to seek injunctive relief restraining the actual or threatened unauthorized disclosure or use of any Student PII, in addition to any other remedy otherwise available (including reasonable attorney fees). Vendor agrees to comply with the requirements of La. R.S. 51:3071 et seq. (Louisiana Database Breach Notification Law) as well as any other applicable laws that require the notification of individuals in the event of unauthorized release of personally identifiable information or other event requiring notification. In the event of a breach of any of the Vendor’s security obligations or other event requiring notification by Vendor under applicable law, Vendor agrees to notify the School Board promptly
and assume responsibility for informing all such individuals in accordance with applicable law. - In accordance with applicable state and federal law, Vendor agrees that security auditors from any state, federal, or other agency, as well as security auditors so designated by the School Board, shall have the option to audit those portions of Vendor Systems that enable the product(s) and/or service(s) called for under the Contract. Associated records shall be made available to such auditors when requested.
- Upon expiration or termination of the Contract, Vendor will furnish the School Board an export file with School Board’s data in the applicable product(s) or service(s) as of the expiration or termination of the Contract. Vendor will retain School Board’s data for the duration of the Contract and any renewals and, unless otherwise directed by School Board in writing, for up to an additional 12 months thereafter in order to allow School Board to restart its use of the ordered product(s) or service(s) following an earlier subscription lapse or termination. Upon expiration of the 12-month period, or earlier if requested in writing by the School Board, Vendor will erase, destroy, and render unreadable, all Student PII in its entirety in a manner that prevents its physical reconstruction through the use of commonly available file restoration utilities. Vendor shall certify in writing that these actions have been completed within 30 days of the expiration of the 12-month post-termination period or within seven (7) days from receipt of any request by the School Board, whichever comes first. Notwithstanding the foregoing, but subject to all confidentiality, security, and other applicable requirements of this Addendum, Vendor may retain School Board data in its backups and disaster recovery systems until such data are deleted in the ordinary course.
- If Vendor has published an Acceptable Use Policy (AUP) and a Platform and Service Privacy Policy, (“Platform Privacy Policy”), on its website, these policies apply with respect to the applicable product(s) or service(s) provided to School Board under the Contract, but Vendor acknowledges that if any provision of either of those policies is deemed to conflict with a provision of this Addendum, the applicable provision of this Addendum will control relative to School Board.
- The obligations of Vendor under this Addendum apply to the Vendor Systems and the actions of Vendor (and, if applicable, its subcontractors, agents, consultants, service providers, and auditors). School Board is and shall remain responsible for: (a) only authorizing those school officials andparents (each as defined in the Platform Privacy Policy) who have a legitimate need to access Student PII, (ii) limiting a school official’s access to only that information necessary for her to perform her duties (e.g., restricting a teacher’s access to information about only her current students) and (iii) limiting a parent’s access to only information about that parent’s minor student. In addition, the School Board retains responsibility and control over the operation, maintenance, and management of, and all access to and use of, the School Board’s information technology infrastructure, whether owned by the School Board or operated by the School Board through use of third-party systems and services.
- The terms of this Addendum shall supplement and supersede any conflicting terms or conditions of the original Contract between the Parties. Subject to the foregoing, the terms of the original Contract shall remain in full force and effect.
- Vendor must incorporate the provisions of this agreement in their contract, or sign the Affidavit below and submit to the Ascension Parish School Board.
CashGuard
ADA-Accessible Web Version: Cashguard, Inc. Student PII Agreement
Document Information
Title: Addendum to Contract: Personally Identifiable Information (PII), NDAA, Cybersecurity Training, and ADA Requirements
Effective Date: March 19, 2026
Vendor: CashGuard
School District: Ascension Parish School Board
Agreement Duration: Up to 4 renewal terms or until June 30, 2028
ADDENDUM/ADDITION TO CONTRACT
Addressing Personally Identifiable Information (PII), NDAA, LA Act 155 (Cyber Security Training) and the Americans with Disabilities Act Requirements (ADA)
This Addendum to Contract (“Addendum”) is entered into by and between the Ascension Parish School Board (hereinafter “School Board”) and CashGuard (hereinafter “Vendor”). The Addendum is effective as of the Date and remains in effect for renewal terms until a new agreement is signed. This agreement may stand for up to a maximum of 4 renewals or until June
30, 2028.
- The School Board, as a public entity, is subject to Title II of the Americans with Disabilities Act(ADA). The Vendor agrees to assure the School Board that it will operate in a manner that will enable the School Board to meet its Title II obligations to its staff and students. If the School Board is made aware of a shortcoming by the vendor in meeting this standard, the vendor agrees to makeall reasonable efforts to meet the needs of the individual requiring the accommodation. (This assumes that the individual has the appropriate software and/or hardware that is required to takeadvantage of the accommodations offered.)
- During the 2014 Louisiana Legislative Session, the State of Louisiana enacted new laws governingthe collection, disclosure and use of students’ personally identifiable information. The new laws require that any contracts between a Louisiana school system and a third-party, who is entrusted with personally identifiable information of any student of such school system, contain the statutorily prescribed minimum requirements as to the use of student personally identifiable information. In order to comply with the requirements of the new laws, this Addendum and the terms contained herein are hereby incorporated into any agreement previously entered into or currently being entered into between Vendor and the School Board, Contract Number and Date (the “Contract”).
- Act 155, enacting La. Rev. Stat. Ann. §42:1267, requires cybersecurity training for officials (vendor employees) who have access to the agency’s information technology assets. Online training was developed by the Department of State Civil Service. Online vendors must offer
training to their employees for CyberSecurity prevention and awareness or have the individuals complete the state’s training in cooperation with the School Board. - In accordance with La. R.S. 17:3913(F), Vendor agrees to protect any personally identifiable
information of students of School Board provided to Vendor under the Contract (“Student PII”) in
a manner that allows only those individuals and entities, who are authorized by Vendor to access
the information, the ability to do so. Student PII should be protected by appropriate security
measures, including, but not limited to, the use of user names, secure passwords, encryption,
security questions, etc. Vendor’s network must maintain a high level of electronic protection to
maintain the integrity of, and to prevent unauthorized access to, Student PII. The Vendor agrees
to perform regular reviews of its protection methods and perform system auditing to maintain
protection of its systems. For systems intended to process or store Student PII, Vendor will
maintain secure systems that are patched, up to date, and have all appropriate security updates
installed. - To ensure that the only individuals and entities who can access Student PII are those that have been specifically authorized by Vendor to access Student PII, Vendor shall implement appropriate forms of authentication to identify the specific individual or entity who is accessing the information and maintain encryption in all storage, backup and transmission. Vendor must individually determine the appropriate level of security that will provide the necessary level of protection for the Student PII it maintains. Vendor shall not allow any individual or entity unauthenticated access to confidential Student PII at any time
- Vendor shall implement appropriate measures to ensure the confidentiality and security of Student PII, protect against any unauthorized access or disclosure of information, and prevent any other unauthorized action within Vendor’s control regarding the access, disclosure or use of Student PII that could result in substantial harm to the School Board or any individual identified by the data.
- Vendor agrees that any and all Student PII will be stored, processed, and maintained in a secure location and solely on servers and systems owned by Vendor or operated by Vendor through use of third-party services (collectively, “Vendor Systems”). No Student PII, at any time, will be
processed on or transferred to any portable computing device or any portable storage medium, unless that storage medium is in use as part of Vendor’s designated backup and recovery processes. All servers, storage, backups, and network paths utilized in the delivery of the product(s) and/or service(s) called for under the Contract shall be contained within the United States unless specifically agreed to in writing by the School Board. - Vendor agrees that any and all Student PII shall be used expressly and solely for the purposes enumerated in the original Contract, as supplemented hereby. Student PII shall not be distributed, used, or shared for any other purpose. As required by Federal and State law, Vendor further agrees that no Student PII of any kind shall be revealed, transmitted, exchanged or otherwise passed outside the Vendor Systems to other vendors or interested parties unless specifically requested or authorized in writing by the School Board. Vendor shall not sell, transfer, share or process any student data for any purposes other than those listed in the Contract, including commercial advertising, marketing, or any other commercial purpose. The foregoing does not, however, preclude Vendor from using de-identified data derived from the operations of Vendor Systems to improve Vendor’s own products and services.
- Vendor shall establish and implement a clear data breach response plan outlining organizational policies and procedures for addressing a potential breach. Vendor’s response plan shall require prompt response for minimizing the risk of any further data loss and any negative consequences
of the breach, including potential harm to affected individuals. A data breach is any instance in which there is an unauthorized release or access of personally identifiable information or other legally or contractually protected information not suitable for public release. This definition
applies regardless of whether Vendor stores and manages the data directly or through a contractor, such as a cloud service provider. - Vendor shall develop a policy for the protection and storage of audit logs. The policy shall require the storing of audit logs and records on a server separate from the system that generates the audit trail. Vendor must restrict access to audit logs to prevent tampering or altering of audit data.
Retention of audit trails shall be based on a schedule determined after consultation with operational, technical, risk management, and legal staff. - Vendor is permitted to disclose Student PII to its employees, authorized subcontractors, agents, consultants, service providers and auditors on a need to know basis only, provided that all such subcontractors, agents, consultants, service providers and auditors have written confidentiality obligations to Vendor consistent with, and at least as protective as, the terms of the Contract, as supplemented hereby. The confidentiality obligations shall survive termination of any agreement with Vendor for so long as the information remains confidential. Vendor shall be responsible to the School Board for any prohibited or unauthorized disclosure or use of Student PII by any of its employees, subcontractors, agents, consultants, service providers, and auditors.
- Vendor acknowledges and agrees that unauthorized disclosure or use of Student PII may damage
The School Board in such a way that adequate compensation could not be obtained solely in monetary damages. Accordingly, the School Board shall have the right to seek injunctive relief restraining the actual or threatened unauthorized disclosure or use of any Student PII, in addition to any other remedy otherwise available (including reasonable attorney fees). Vendor agrees to comply with the requirements of La. R.S. 51:3071 et seq. (Louisiana Database Breach Notification Law) as well as any other applicable laws that require the notification of individuals in the event of unauthorized release of personally identifiable information or other event requiring notification. In the event of a breach of any of the Vendor’s security obligations or other event requiring notification by Vendor under applicable law, Vendor agrees to notify the School Board promptly
and assume responsibility for informing all such individuals in accordance with applicable law. - In accordance with applicable state and federal law, Vendor agrees that security auditors from any state, federal, or other agency, as well as security auditors so designated by the School Board, shall have the option to audit those portions of Vendor Systems that enable the product(s) and/or service(s) called for under the Contract. Associated records shall be made available to such auditors when requested.
- Upon expiration or termination of the Contract, Vendor will furnish the School Board an export file with School Board’s data in the applicable product(s) or service(s) as of the expiration or termination of the Contract. Vendor will retain School Board’s data for the duration of the Contract and any renewals and, unless otherwise directed by School Board in writing, for up to an additional 12 months thereafter in order to allow School Board to restart its use of the ordered product(s) or service(s) following an earlier subscription lapse or termination. Upon expiration of the 12-month period, or earlier if requested in writing by the School Board, Vendor will erase, destroy, and render unreadable, all Student PII in its entirety in a manner that prevents its physical reconstruction through the use of commonly available file restoration utilities. Vendor shall certify in writing that these actions have been completed within 30 days of the expiration of the 12-month post-termination period or within seven (7) days from receipt of any request by the School Board, whichever comes first. Notwithstanding the foregoing, but subject to all confidentiality, security, and other applicable requirements of this Addendum, Vendor may retain School Board data in its backups and disaster recovery systems until such data are deleted in the ordinary course.
- If Vendor has published an Acceptable Use Policy (AUP) and a Platform and Service Privacy Policy, (“Platform Privacy Policy”), on its website, these policies apply with respect to the applicable product(s) or service(s) provided to School Board under the Contract, but Vendor acknowledges that if any provision of either of those policies is deemed to conflict with a provision of this Addendum, the applicable provision of this Addendum will control relative to School Board.
- The obligations of Vendor under this Addendum apply to the Vendor Systems and the actions of Vendor (and, if applicable, its subcontractors, agents, consultants, service providers, and auditors). School Board is and shall remain responsible for: (a) only authorizing those school officials andparents (each as defined in the Platform Privacy Policy) who have a legitimate need to access Student PII, (ii) limiting a school official’s access to only that information necessary for her to perform her duties (e.g., restricting a teacher’s access to information about only her current students) and (iii) limiting a parent’s access to only information about that parent’s minor student. In addition, the School Board retains responsibility and control over the operation, maintenance, and management of, and all access to and use of, the School Board’s information technology infrastructure, whether owned by the School Board or operated by the School Board through use of third-party systems and services.
- The terms of this Addendum shall supplement and supersede any conflicting terms or conditions of the original Contract between the Parties. Subject to the foregoing, the terms of the original Contract shall remain in full force and effect.
- Vendor must incorporate the provisions of this agreement in their contract, or sign the Affidavit below and submit to the Ascension Parish School Board.
Search
SUNBucks
ADA-Accessible Web Version: Sunbucks, Student PII Agreement
Document Information
Title: Addendum to Contract: Personally Identifiable Information (PII), NDAA, Cybersecurity Training, and ADA Requirements
Effective Date: March 13, 2026
Vendor: SUNBucks
School District: Ascension Parish School Board
Agreement Duration: Up to 4 renewal terms or until June 30, 2028
ADDENDUM/ADDITION TO CONTRACT
Addressing Personally Identifiable Information (PII), NDAA, LA Act 155 (Cyber Security Training) and the Americans with Disabilities Act Requirements (ADA)
This Addendum to Contract (“Addendum”) is entered into by and between the Ascension Parish School Board (hereinafter “School Board”) and SUNBucks(hereinafter “Vendor”). The Addendum is effective as of the Date and remains in effect for renewal terms until a new agreement is signed. This agreement may stand for up to a maximum of 4 renewals or until June
30, 2028.
- The School Board, as a public entity, is subject to Title II of the Americans with Disabilities Act(ADA). The Vendor agrees to assure the School Board that it will operate in a manner that will enable the School Board to meet its Title II obligations to its staff and students. If the School Board is made aware of a shortcoming by the vendor in meeting this standard, the vendor agrees to makeall reasonable efforts to meet the needs of the individual requiring the accommodation. (This assumes that the individual has the appropriate software and/or hardware that is required to takeadvantage of the accommodations offered.)
- During the 2014 Louisiana Legislative Session, the State of Louisiana enacted new laws governingthe collection, disclosure and use of students’ personally identifiable information. The new laws require that any contracts between a Louisiana school system and a third-party, who is entrusted with personally identifiable information of any student of such school system, contain the statutorily prescribed minimum requirements as to the use of student personally identifiable information. In order to comply with the requirements of the new laws, this Addendum and the terms contained herein are hereby incorporated into any agreement previously entered into or currently being entered into between Vendor and the School Board, Contract Number and Date (the “Contract”).
- Act 155, enacting La. Rev. Stat. Ann. §42:1267, requires cybersecurity training for officials (vendor employees) who have access to the agency’s information technology assets. Online training was developed by the Department of State Civil Service. Online vendors must offer
training to their employees for CyberSecurity prevention and awareness or have the individuals complete the state’s training in cooperation with the School Board. - In accordance with La. R.S. 17:3913(F), Vendor agrees to protect any personally identifiable
information of students of School Board provided to Vendor under the Contract (“Student PII”) in
a manner that allows only those individuals and entities, who are authorized by Vendor to access
the information, the ability to do so. Student PII should be protected by appropriate security
measures, including, but not limited to, the use of user names, secure passwords, encryption,
security questions, etc. Vendor’s network must maintain a high level of electronic protection to
maintain the integrity of, and to prevent unauthorized access to, Student PII. The Vendor agrees
to perform regular reviews of its protection methods and perform system auditing to maintain
protection of its systems. For systems intended to process or store Student PII, Vendor will
maintain secure systems that are patched, up to date, and have all appropriate security updates
installed. - To ensure that the only individuals and entities who can access Student PII are those that have been specifically authorized by Vendor to access Student PII, Vendor shall implement appropriate forms of authentication to identify the specific individual or entity who is accessing the information and maintain encryption in all storage, backup and transmission. Vendor must individually determine the appropriate level of security that will provide the necessary level of protection for the Student PII it maintains. Vendor shall not allow any individual or entity unauthenticated access to confidential Student PII at any time
- Vendor shall implement appropriate measures to ensure the confidentiality and security of Student PII, protect against any unauthorized access or disclosure of information, and prevent any other unauthorized action within Vendor’s control regarding the access, disclosure or use of Student PII that could result in substantial harm to the School Board or any individual identified by the data.
- Vendor agrees that any and all Student PII will be stored, processed, and maintained in a secure location and solely on servers and systems owned by Vendor or operated by Vendor through use of third-party services (collectively, “Vendor Systems”). No Student PII, at any time, will be
processed on or transferred to any portable computing device or any portable storage medium, unless that storage medium is in use as part of Vendor’s designated backup and recovery processes. All servers, storage, backups, and network paths utilized in the delivery of the product(s) and/or service(s) called for under the Contract shall be contained within the United States unless specifically agreed to in writing by the School Board. - Vendor agrees that any and all Student PII shall be used expressly and solely for the purposes enumerated in the original Contract, as supplemented hereby. Student PII shall not be distributed, used, or shared for any other purpose. As required by Federal and State law, Vendor further agrees that no Student PII of any kind shall be revealed, transmitted, exchanged or otherwise passed outside the Vendor Systems to other vendors or interested parties unless specifically requested or authorized in writing by the School Board. Vendor shall not sell, transfer, share or process any student data for any purposes other than those listed in the Contract, including commercial advertising, marketing, or any other commercial purpose. The foregoing does not, however, preclude Vendor from using de-identified data derived from the operations of Vendor Systems to improve Vendor’s own products and services.
- Vendor shall establish and implement a clear data breach response plan outlining organizational policies and procedures for addressing a potential breach. Vendor’s response plan shall require prompt response for minimizing the risk of any further data loss and any negative consequences
of the breach, including potential harm to affected individuals. A data breach is any instance in which there is an unauthorized release or access of personally identifiable information or other legally or contractually protected information not suitable for public release. This definition
applies regardless of whether Vendor stores and manages the data directly or through a contractor, such as a cloud service provider. - Vendor shall develop a policy for the protection and storage of audit logs. The policy shall require the storing of audit logs and records on a server separate from the system that generates the audit trail. Vendor must restrict access to audit logs to prevent tampering or altering of audit data.
Retention of audit trails shall be based on a schedule determined after consultation with operational, technical, risk management, and legal staff. - Vendor is permitted to disclose Student PII to its employees, authorized subcontractors, agents, consultants, service providers and auditors on a need to know basis only, provided that all such subcontractors, agents, consultants, service providers and auditors have written confidentiality obligations to Vendor consistent with, and at least as protective as, the terms of the Contract, as supplemented hereby. The confidentiality obligations shall survive termination of any agreement with Vendor for so long as the information remains confidential. Vendor shall be responsible to the School Board for any prohibited or unauthorized disclosure or use of Student PII by any of its employees, subcontractors, agents, consultants, service providers, and auditors.
- Vendor acknowledges and agrees that unauthorized disclosure or use of Student PII may damage
The School Board in such a way that adequate compensation could not be obtained solely in monetary damages. Accordingly, the School Board shall have the right to seek injunctive relief restraining the actual or threatened unauthorized disclosure or use of any Student PII, in addition to any other remedy otherwise available (including reasonable attorney fees). Vendor agrees to comply with the requirements of La. R.S. 51:3071 et seq. (Louisiana Database Breach Notification Law) as well as any other applicable laws that require the notification of individuals in the event of unauthorized release of personally identifiable information or other event requiring notification. In the event of a breach of any of the Vendor’s security obligations or other event requiring notification by Vendor under applicable law, Vendor agrees to notify the School Board promptly
and assume responsibility for informing all such individuals in accordance with applicable law. - In accordance with applicable state and federal law, Vendor agrees that security auditors from any state, federal, or other agency, as well as security auditors so designated by the School Board, shall have the option to audit those portions of Vendor Systems that enable the product(s) and/or service(s) called for under the Contract. Associated records shall be made available to such auditors when requested.
- Upon expiration or termination of the Contract, Vendor will furnish the School Board an export file with School Board’s data in the applicable product(s) or service(s) as of the expiration or termination of the Contract. Vendor will retain School Board’s data for the duration of the Contract and any renewals and, unless otherwise directed by School Board in writing, for up to an additional 12 months thereafter in order to allow School Board to restart its use of the ordered product(s) or service(s) following an earlier subscription lapse or termination. Upon expiration of the 12-month period, or earlier if requested in writing by the School Board, Vendor will erase, destroy, and render unreadable, all Student PII in its entirety in a manner that prevents its physical reconstruction through the use of commonly available file restoration utilities. Vendor shall certify in writing that these actions have been completed within 30 days of the expiration of the 12-month post-termination period or within seven (7) days from receipt of any request by the School Board, whichever comes first. Notwithstanding the foregoing, but subject to all confidentiality, security, and other applicable requirements of this Addendum, Vendor may retain School Board data in its backups and disaster recovery systems until such data are deleted in the ordinary course.
- If Vendor has published an Acceptable Use Policy (AUP) and a Platform and Service Privacy Policy, (“Platform Privacy Policy”), on its website, these policies apply with respect to the applicable product(s) or service(s) provided to School Board under the Contract, but Vendor acknowledges that if any provision of either of those policies is deemed to conflict with a provision of this Addendum, the applicable provision of this Addendum will control relative to School Board.
- The obligations of Vendor under this Addendum apply to the Vendor Systems and the actions of Vendor (and, if applicable, its subcontractors, agents, consultants, service providers, and auditors). School Board is and shall remain responsible for: (a) only authorizing those school officials andparents (each as defined in the Platform Privacy Policy) who have a legitimate need to access Student PII, (ii) limiting a school official’s access to only that information necessary for her to perform her duties (e.g., restricting a teacher’s access to information about only her current students) and (iii) limiting a parent’s access to only information about that parent’s minor student. In addition, the School Board retains responsibility and control over the operation, maintenance, and management of, and all access to and use of, the School Board’s information technology infrastructure, whether owned by the School Board or operated by the School Board through use of third-party systems and services.
- The terms of this Addendum shall supplement and supersede any conflicting terms or conditions of the original Contract between the Parties. Subject to the foregoing, the terms of the original Contract shall remain in full force and effect.
- Vendor must incorporate the provisions of this agreement in their contract, or sign the Affidavit below and submit to the Ascension Parish School Board.
Imagine Learning
ADA-Accessible Web Version: imagine learning Student PII Agreement
Document Information
Title: Addendum to Contract: Personally Identifiable Information (PII), NDAA, Cybersecurity Training, and ADA Requirements
Effective Date: March 11, 2026
Vendor: Imagine Learning LLC
School District: Ascension Parish School Board
Agreement Duration: Up to 4 renewal terms or until August 1, 2030
ADDENDUM/ADDITION TO CONTRACT
Addressing Personally Identifiable Information (PII), NDAA, LA Act 155 (Cyber Security Training) and the Americans with Disabilities Act Requirements (ADA)
This Addendum to Contract (“Addendum”) is entered into by and between the Ascension Parish School Board (hereinafter “School Board”) and Imagine Learning LCC (hereinafter “Vendor”). The Addendum is effective as of the Date and remains in effect for renewal terms until a new agreement is signed. This agreement may stand for up to a maximum of 4 renewals or until August
1, 2030.
- The School Board, as a public entity, is subject to Title II of the Americans with Disabilities Act(ADA). The Vendor agrees to assure the School Board that it will operate in a manner that will enable the School Board to meet its Title II obligations to its staff and students. If the School Board is made aware of a shortcoming by the vendor in meeting this standard, the vendor agrees to makeall reasonable efforts to meet the needs of the individual requiring the accommodation. (This assumes that the individual has the appropriate software and/or hardware that is required to takeadvantage of the accommodations offered.)
- During the 2014 Louisiana Legislative Session, the State of Louisiana enacted new laws governingthe collection, disclosure and use of students’ personally identifiable information. The new laws require that any contracts between a Louisiana school system and a third-party, who is entrusted with personally identifiable information of any student of such school system, contain the statutorily prescribed minimum requirements as to the use of student personally identifiable information. In order to comply with the requirements of the new laws, this Addendum and the terms contained herein are hereby incorporated into any agreement previously entered into or currently being entered into between Vendor and the School Board, Contract Number and Date (the “Contract”).
- Act 155, enacting La. Rev. Stat. Ann. §42:1267, requires cybersecurity training for officials (vendor employees) who have access to the agency’s information technology assets. Online training was developed by the Department of State Civil Service. Online vendors must offer
training to their employees for CyberSecurity prevention and awareness or have the individuals complete the state’s training in cooperation with the School Board. - In accordance with La. R.S. 17:3913(F), Vendor agrees to protect any personally identifiable
information of students of School Board provided to Vendor under the Contract (“Student PII”) in
a manner that allows only those individuals and entities, who are authorized by Vendor to access
the information, the ability to do so. Student PII should be protected by appropriate security
measures, including, but not limited to, the use of user names, secure passwords, encryption,
security questions, etc. Vendor’s network must maintain a high level of electronic protection to
maintain the integrity of, and to prevent unauthorized access to, Student PII. The Vendor agrees
to perform regular reviews of its protection methods and perform system auditing to maintain
protection of its systems. For systems intended to process or store Student PII, Vendor will
maintain secure systems that are patched, up to date, and have all appropriate security updates
installed. - To ensure that the only individuals and entities who can access Student PII are those that have been specifically authorized by Vendor to access Student PII, Vendor shall implement appropriate forms of authentication to identify the specific individual or entity who is accessing the information and maintain encryption in all storage, backup and transmission. Vendor must individually determine the appropriate level of security that will provide the necessary level of protection for the Student PII it maintains. Vendor shall not allow any individual or entity unauthenticated access to confidential Student PII at any time
- Vendor shall implement appropriate measures to ensure the confidentiality and security of Student PII, protect against any unauthorized access or disclosure of information, and prevent any other unauthorized action within Vendor’s control regarding the access, disclosure or use of Student PII that could result in substantial harm to the School Board or any individual identified by the data.
- Vendor agrees that any and all Student PII will be stored, processed, and maintained in a secure location and solely on servers and systems owned by Vendor or operated by Vendor through use of third-party services (collectively, “Vendor Systems”). No Student PII, at any time, will be
processed on or transferred to any portable computing device or any portable storage medium, unless that storage medium is in use as part of Vendor’s designated backup and recovery processes. All servers, storage, backups, and network paths utilized in the delivery of the product(s) and/or service(s) called for under the Contract shall be contained within the United States unless specifically agreed to in writing by the School Board. - Vendor agrees that any and all Student PII shall be used expressly and solely for the purposes enumerated in the original Contract, as supplemented hereby. Student PII shall not be distributed, used, or shared for any other purpose. As required by Federal and State law, Vendor further agrees that no Student PII of any kind shall be revealed, transmitted, exchanged or otherwise passed outside the Vendor Systems to other vendors or interested parties unless specifically requested or authorized in writing by the School Board. Vendor shall not sell, transfer, share or process any student data for any purposes other than those listed in the Contract, including commercial advertising, marketing, or any other commercial purpose. The foregoing does not, however, preclude Vendor from using de-identified data derived from the operations of Vendor Systems to improve Vendor’s own products and services.
- Vendor shall establish and implement a clear data breach response plan outlining organizational policies and procedures for addressing a potential breach. Vendor’s response plan shall require prompt response for minimizing the risk of any further data loss and any negative consequences
of the breach, including potential harm to affected individuals. A data breach is any instance in which there is an unauthorized release or access of personally identifiable information or other legally or contractually protected information not suitable for public release. This definition
applies regardless of whether Vendor stores and manages the data directly or through a contractor, such as a cloud service provider. - Vendor shall develop a policy for the protection and storage of audit logs. The policy shall require the storing of audit logs and records on a server separate from the system that generates the audit trail. Vendor must restrict access to audit logs to prevent tampering or altering of audit data.
Retention of audit trails shall be based on a schedule determined after consultation with operational, technical, risk management, and legal staff. - Vendor is permitted to disclose Student PII to its employees, authorized subcontractors, agents, consultants, service providers and auditors on a need to know basis only, provided that all such subcontractors, agents, consultants, service providers and auditors have written confidentiality obligations to Vendor consistent with, and at least as protective as, the terms of the Contract, as supplemented hereby. The confidentiality obligations shall survive termination of any agreement with Vendor for so long as the information remains confidential. Vendor shall be responsible to the School Board for any prohibited or unauthorized disclosure or use of Student PII by any of its employees, subcontractors, agents, consultants, service providers, and auditors.
- Vendor acknowledges and agrees that unauthorized disclosure or use of Student PII may damage
The School Board in such a way that adequate compensation could not be obtained solely in monetary damages. Accordingly, the School Board shall have the right to seek injunctive relief restraining the actual or threatened unauthorized disclosure or use of any Student PII, in addition to any other remedy otherwise available (including reasonable attorney fees). Vendor agrees to comply with the requirements of La. R.S. 51:3071 et seq. (Louisiana Database Breach Notification Law) as well as any other applicable laws that require the notification of individuals in the event of unauthorized release of personally identifiable information or other event requiring notification. In the event of a breach of any of the Vendor’s security obligations or other event requiring notification by Vendor under applicable law, Vendor agrees to notify the School Board promptly
and assume responsibility for informing all such individuals in accordance with applicable law. - In accordance with applicable state and federal law, Vendor agrees that security auditors from any state, federal, or other agency, as well as security auditors so designated by the School Board, shall have the option to audit those portions of Vendor Systems that enable the product(s) and/or service(s) called for under the Contract. Associated records shall be made available to such auditors when requested.
- Upon expiration or termination of the Contract, Vendor will furnish the School Board an export file with School Board’s data in the applicable product(s) or service(s) as of the expiration or termination of the Contract. Vendor will retain School Board’s data for the duration of the Contract and any renewals and, unless otherwise directed by School Board in writing, for up to an additional 12 months thereafter in order to allow School Board to restart its use of the ordered product(s) or service(s) following an earlier subscription lapse or termination. Upon expiration of the 12-month period, or earlier if requested in writing by the School Board, Vendor will erase, destroy, and render unreadable, all Student PII in its entirety in a manner that prevents its physical reconstruction through the use of commonly available file restoration utilities. Vendor shall certify in writing that these actions have been completed within 30 days of the expiration of the 12-month post-termination period or within seven (7) days from receipt of any request by the School Board, whichever comes first. Notwithstanding the foregoing, but subject to all confidentiality, security, and other applicable requirements of this Addendum, Vendor may retain School Board data in its backups and disaster recovery systems until such data are deleted in the ordinary course.
- If Vendor has published an Acceptable Use Policy (AUP) and a Platform and Service Privacy Policy, (“Platform Privacy Policy”), on its website, these policies apply with respect to the applicable product(s) or service(s) provided to School Board under the Contract, but Vendor acknowledges that if any provision of either of those policies is deemed to conflict with a provision of this Addendum, the applicable provision of this Addendum will control relative to School Board.
- The obligations of Vendor under this Addendum apply to the Vendor Systems and the actions of Vendor (and, if applicable, its subcontractors, agents, consultants, service providers, and auditors). School Board is and shall remain responsible for: (a) only authorizing those school officials andparents (each as defined in the Platform Privacy Policy) who have a legitimate need to access Student PII, (ii) limiting a school official’s access to only that information necessary for her to perform her duties (e.g., restricting a teacher’s access to information about only her current students) and (iii) limiting a parent’s access to only information about that parent’s minor student. In addition, the School Board retains responsibility and control over the operation, maintenance, and management of, and all access to and use of, the School Board’s information technology infrastructure, whether owned by the School Board or operated by the School Board through use of third-party systems and services.
- The terms of this Addendum shall supplement and supersede any conflicting terms or conditions of the original Contract between the Parties. Subject to the foregoing, the terms of the original Contract shall remain in full force and effect.
- Vendor must incorporate the provisions of this agreement in their contract, or sign the Affidavit below and submit to the Ascension Parish School Board.
Magic School
aDA-Accessible Web Version: magic school Student PII Agreement
Document Information
Title: Addendum to Contract: Personally Identifiable Information (PII), NDAA, Cybersecurity Training, and ADA Requirements
Effective Date: October 30th, 2023
Vendor: Magic School
School District: Ascension Parish School Board
Agreement Duration: Up to 4 renewal terms or until June 30, 2027
ADDENDUM/ADDITION TO CONTRACT
Addressing Personally Identifiable Information (PII), NDAA, LA Act 155 (Cyber Security Training) and the Americans with Disabilities Act Requirements (ADA)
This Addendum to Contract (“Addendum”) is entered into by and between the Ascension Parish School Board (hereinafter “School Board”) and Magic School (hereinafter “Vendor”). The Addendum is effective as of the Date and remains in effect for renewal terms until a new agreement is signed. This agreement may stand for up to a maximum of 4 renewals or until June 30, 2027.
During the 2014 Louisiana Legislative Session, the State of Louisiana enacted new laws governing the collection, disclosure and use of students’ personally identifiable information. The new laws require that any contracts between a Louisiana school system and a third-party, who is entrusted with personally identifiable information of any student of such school system, contain the statutorily prescribed minimum requirements as to the use of student personally identifiable information. In order to comply with the requirements of the new laws, this Addendum and the terms contained herein are hereby incorporated into any agreement previously entered into or currently being entered into between Vendor and the School Board, Contract Number and Date (the “Contract”).
EDIA
ADA-Accessible Web Version: EDIA, Inc. Student PII Agreement
Document Information
Title: Addendum to Contract: Personally Identifiable Information (PII), NDAA, Cybersecurity Training, and ADA Requirements
Effective Date: March 10, 2026
Vendor: EDIA Learning, Inc.
School District: Ascension Parish School Board
Agreement Duration: Up to 4 renewal terms or until June 30, 2030
ADDENDUM/ADDITION TO CONTRACT
Addressing Personally Identifiable Information (PII), NDAA, LA Act 155 (Cyber Security Training) and the Americans with Disabilities Act Requirements (ADA)
This Addendum to Contract (“Addendum”) is entered into by and between the Ascension Parish School Board (hereinafter “School Board”) and Edia Learning, Inc. (hereinafter “Vendor”). The Addendum is effective as of the Date and remains in effect for renewal terms until a new agreement is signed. This agreement may stand for up to a maximum of 4 renewals or until June
30, 2030.
- The School Board, as a public entity, is subject to Title II of the Americans with Disabilities Act(ADA). The Vendor agrees to assure the School Board that it will operate in a manner that will enable the School Board to meet its Title II obligations to its staff and students. If the School Board is made aware of a shortcoming by the vendor in meeting this standard, the vendor agrees to makeall reasonable efforts to meet the needs of the individual requiring the accommodation. (This assumes that the individual has the appropriate software and/or hardware that is required to takeadvantage of the accommodations offered.)
- During the 2014 Louisiana Legislative Session, the State of Louisiana enacted new laws governingthe collection, disclosure and use of students’ personally identifiable information. The new laws require that any contracts between a Louisiana school system and a third-party, who is entrusted with personally identifiable information of any student of such school system, contain the statutorily prescribed minimum requirements as to the use of student personally identifiable information. In order to comply with the requirements of the new laws, this Addendum and the terms contained herein are hereby incorporated into any agreement previously entered into or currently being entered into between Vendor and the School Board, Contract Number and Date (the “Contract”).
- Act 155, enacting La. Rev. Stat. Ann. §42:1267, requires cybersecurity training for officials (vendor employees) who have access to the agency’s information technology assets. Online training was developed by the Department of State Civil Service. Online vendors must offer
training to their employees for CyberSecurity prevention and awareness or have the individuals complete the state’s training in cooperation with the School Board. - In accordance with La. R.S. 17:3913(F), Vendor agrees to protect any personally identifiable
information of students of School Board provided to Vendor under the Contract (“Student PII”) in
a manner that allows only those individuals and entities, who are authorized by Vendor to access
the information, the ability to do so. Student PII should be protected by appropriate security
measures, including, but not limited to, the use of user names, secure passwords, encryption,
security questions, etc. Vendor’s network must maintain a high level of electronic protection to
maintain the integrity of, and to prevent unauthorized access to, Student PII. The Vendor agrees
to perform regular reviews of its protection methods and perform system auditing to maintain
protection of its systems. For systems intended to process or store Student PII, Vendor will
maintain secure systems that are patched, up to date, and have all appropriate security updates
installed. - To ensure that the only individuals and entities who can access Student PII are those that have been specifically authorized by Vendor to access Student PII, Vendor shall implement appropriate forms of authentication to identify the specific individual or entity who is accessing the information and maintain encryption in all storage, backup and transmission. Vendor must individually determine the appropriate level of security that will provide the necessary level of protection for the Student PII it maintains. Vendor shall not allow any individual or entity unauthenticated access to confidential Student PII at any time
- Vendor shall implement appropriate measures to ensure the confidentiality and security of Student PII, protect against any unauthorized access or disclosure of information, and prevent any other unauthorized action within Vendor’s control regarding the access, disclosure or use of Student PII that could result in substantial harm to the School Board or any individual identified by the data.
- Vendor agrees that any and all Student PII will be stored, processed, and maintained in a secure location and solely on servers and systems owned by Vendor or operated by Vendor through use of third-party services (collectively, “Vendor Systems”). No Student PII, at any time, will be
processed on or transferred to any portable computing device or any portable storage medium, unless that storage medium is in use as part of Vendor’s designated backup and recovery processes. All servers, storage, backups, and network paths utilized in the delivery of the product(s) and/or service(s) called for under the Contract shall be contained within the United States unless specifically agreed to in writing by the School Board. - Vendor agrees that any and all Student PII shall be used expressly and solely for the purposes enumerated in the original Contract, as supplemented hereby. Student PII shall not be distributed, used, or shared for any other purpose. As required by Federal and State law, Vendor further agrees that no Student PII of any kind shall be revealed, transmitted, exchanged or otherwise passed outside the Vendor Systems to other vendors or interested parties unless specifically requested or authorized in writing by the School Board. Vendor shall not sell, transfer, share or process any student data for any purposes other than those listed in the Contract, including commercial advertising, marketing, or any other commercial purpose. The foregoing does not, however, preclude Vendor from using de-identified data derived from the operations of Vendor Systems to improve Vendor’s own products and services.
- Vendor shall establish and implement a clear data breach response plan outlining organizational policies and procedures for addressing a potential breach. Vendor’s response plan shall require prompt response for minimizing the risk of any further data loss and any negative consequences
of the breach, including potential harm to affected individuals. A data breach is any instance in which there is an unauthorized release or access of personally identifiable information or other legally or contractually protected information not suitable for public release. This definition
applies regardless of whether Vendor stores and manages the data directly or through a contractor, such as a cloud service provider. - Vendor shall develop a policy for the protection and storage of audit logs. The policy shall require the storing of audit logs and records on a server separate from the system that generates the audit trail. Vendor must restrict access to audit logs to prevent tampering or altering of audit data.
Retention of audit trails shall be based on a schedule determined after consultation with operational, technical, risk management, and legal staff. - Vendor is permitted to disclose Student PII to its employees, authorized subcontractors, agents, consultants, service providers and auditors on a need to know basis only, provided that all such subcontractors, agents, consultants, service providers and auditors have written confidentiality obligations to Vendor consistent with, and at least as protective as, the terms of the Contract, as supplemented hereby. The confidentiality obligations shall survive termination of any agreement with Vendor for so long as the information remains confidential. Vendor shall be responsible to the School Board for any prohibited or unauthorized disclosure or use of Student PII by any of its employees, subcontractors, agents, consultants, service providers, and auditors.
- Vendor acknowledges and agrees that unauthorized disclosure or use of Student PII may damage
The School Board in such a way that adequate compensation could not be obtained solely in monetary damages. Accordingly, the School Board shall have the right to seek injunctive relief restraining the actual or threatened unauthorized disclosure or use of any Student PII, in addition to any other remedy otherwise available (including reasonable attorney fees). Vendor agrees to comply with the requirements of La. R.S. 51:3071 et seq. (Louisiana Database Breach Notification Law) as well as any other applicable laws that require the notification of individuals in the event of unauthorized release of personally identifiable information or other event requiring notification. In the event of a breach of any of the Vendor’s security obligations or other event requiring notification by Vendor under applicable law, Vendor agrees to notify the School Board promptly
and assume responsibility for informing all such individuals in accordance with applicable law. - In accordance with applicable state and federal law, Vendor agrees that security auditors from any state, federal, or other agency, as well as security auditors so designated by the School Board, shall have the option to audit those portions of Vendor Systems that enable the product(s) and/or service(s) called for under the Contract. Associated records shall be made available to such auditors when requested.
- Upon expiration or termination of the Contract, Vendor will furnish the School Board an export file with School Board’s data in the applicable product(s) or service(s) as of the expiration or termination of the Contract. Vendor will retain School Board’s data for the duration of the Contract and any renewals and, unless otherwise directed by School Board in writing, for up to an additional 12 months thereafter in order to allow School Board to restart its use of the ordered product(s) or service(s) following an earlier subscription lapse or termination. Upon expiration of the 12-month period, or earlier if requested in writing by the School Board, Vendor will erase, destroy, and render unreadable, all Student PII in its entirety in a manner that prevents its physical reconstruction through the use of commonly available file restoration utilities. Vendor shall certify in writing that these actions have been completed within 30 days of the expiration of the 12-month post-termination period or within seven (7) days from receipt of any request by the School Board, whichever comes first. Notwithstanding the foregoing, but subject to all confidentiality, security, and other applicable requirements of this Addendum, Vendor may retain School Board data in its backups and disaster recovery systems until such data are deleted in the ordinary course.
- If Vendor has published an Acceptable Use Policy (AUP) and a Platform and Service Privacy Policy, (“Platform Privacy Policy”), on its website, these policies apply with respect to the applicable product(s) or service(s) provided to School Board under the Contract, but Vendor acknowledges that if any provision of either of those policies is deemed to conflict with a provision of this Addendum, the applicable provision of this Addendum will control relative to School Board.
- The obligations of Vendor under this Addendum apply to the Vendor Systems and the actions of Vendor (and, if applicable, its subcontractors, agents, consultants, service providers, and auditors). School Board is and shall remain responsible for: (a) only authorizing those school officials andparents (each as defined in the Platform Privacy Policy) who have a legitimate need to access Student PII, (ii) limiting a school official’s access to only that information necessary for her to perform her duties (e.g., restricting a teacher’s access to information about only her current students) and (iii) limiting a parent’s access to only information about that parent’s minor student. In addition, the School Board retains responsibility and control over the operation, maintenance, and management of, and all access to and use of, the School Board’s information technology infrastructure, whether owned by the School Board or operated by the School Board through use of third-party systems and services.
- The terms of this Addendum shall supplement and supersede any conflicting terms or conditions of the original Contract between the Parties. Subject to the foregoing, the terms of the original Contract shall remain in full force and effect.
- Vendor must incorporate the provisions of this agreement in their contract, or sign the Affidavit below and submit to the Ascension Parish School Board.
Gaggle
This Addendum to Contract (“Addendum”) is entered into by and between the Ascension Parish School Board (“School Board”) and Vendor (“Vendor”). This Addendum governs the protection, use, storage, and disclosure of Student Personally Identifiable Information (“Student PII”) accessed by Vendor.
This Addendum remains in effect for the duration of the Contract and any renewal terms.
1. Legal Compliance Vendor agrees to comply with FERPA, Louisiana Student Privacy Law (La. R.S. 17:3913– 3914), Louisiana Database Breach Notification Law (La. R.S. 51:3071), Louisiana Act 155 of 2020 [La RS 42:1267, et seq.] Cybersecurity Training Requirements, the Americans with Disabilities Act (ADA), and Section 889 of the National Defense Authorization Act (NDAA), and any other laws governing the substance of this Addendum, each as amended from time to time. Vendor shall be considered a School Official with legitimate educational interest under FERPA.
2. Definition of Student Data Student PII includes any information that can identify a student including name, LASID, date of birth, demographic information, enrollment data, academic records, attendance, discipline records, and parent contact information.
3. Purpose Limitation Vendor shall collect and use Student PII solely for fulfilling services described in the Contract. Vendor shall not sell or use student data for advertising or unauthorized purposes. De-identified data may only be used internally for Vendor’s operations directly related to the services and may not be re-identified or used for general-purpose model training or for the benefit of third parties. Vendor may use de-identified data solely to improve the contracted services.
4. Data Minimization Vendor shall collect only the minimum amount of student data necessary. All student data remains the property of the School Board.
5. Data Security Requirements Vendor shall implement safeguards consistent with recognized security standards such as NIST, SOC 2, ISO 27001, or CIS Critical Security Controls and shall include, at a minimum or equivalent industry-standard controls appropriate to the size and complexity of Vendor’s environment: encryption of Student PII at rest (AES-256 or equivalent) and in transit (TLS 1.2+ or higher), multi-factor authentication for all access, monitoring, vulnerability management (monthly scanning, annual independent penetration testing), role-based access control with least privilege and quarterly documented access reviews, Addendum endpoint protection/EDR, timely patching (critical vulnerabilities within 7 days), secure software development lifecycle (code review, dependency scanning), centralized logging with at least one (1) year retention and alerting for anomalous activity, and a documented, tested business continuity/disaster recovery plan with annual testing.
6. Vendor Security Assurance Requirements
Vendor shall maintain appropriate security assurances. Upon request Vendor shall provide:
• Independent security audit or certification such as SOC 2 Type II, ISO 27001, or equivalent.
• Documentation of periodic security risk assessments.
• Evidence of cyber liability/technology errors and omissions insurance with limits not less than Five Million Dollars ($5,000,000) per claim/occurrence and in the aggregate, unless otherwise approved by the School Board based on risk assessment, and covering privacy liability, regulatory proceedings, notification/forensics costs, credit monitoring, media liability, network security, business interruption, ransomware, and third-party claims. The School Board shall be named as an additional insured on a primary and non-contributory basis. Vendor shall deliver certificates upon execution, annually, and upon renewal
• Most recent SOC 2 Type II report (or ISO 27001 certificate and Statement of Applicability), with remediation plans for high-risk findings, provided annually under NDA if requested.\
• Security policy documentation demonstrating compliance with this Addendum.
7. Storage and Data Location
Student PII, including backups and production data, shall be stored within the United States whenever reasonably practicable. Vendor and its subprocessors may access or process Student PII outside of the United States only where necessary to perform services under the Contract and provided that:
● (a) such access is limited to authorized personnel for legitimate business purposes;
● (b) appropriate administrative, technical, and contractual safeguards are in place to protect Student PII consistent with this Addendum;
● (c) Vendor ensures that any such access complies with all applicable federal and state student privacy laws; and
● (d) Vendor maintains transparency regarding the general locations of storage and access upon request.
Vendor shall remain fully responsible for ensuring that all subprocessors comply with the requirements of this Section.
Vendor shall provide, upon request, a current list of subprocessors including the general geographic location (country level) of storage locations and access locations.
8. Subprocessors and Subcontractors
Vendor shall provide prior written notice of any subprocessors or subcontractors that will access Student PII. By signing this Addendum, the School Board approves Vendor’s current subprocessors as listed in a document or a URL provided at the time of contract execution. Vendor shall provide at least thirty (30) days’ advance notice of any new subprocessors, and the School Board shall have the right to reasonably object. Vendor shall ensure written agreements impose obligations no less protective than this Addendum, including compliance with Section 7 (Storage and Data Location), applicable data security requirements, and audit rights. Vendor remains fully liable for all acts and omissions of subprocessors or subcontractors.
9. Employee Access and Training Vendor shall restrict access to Student PII to authorized personnel and ensure completion of cybersecurity awareness training consistent with Louisiana Act 155 of 2020 [La RS 42:1267, et seq.]. Vendor shall perform background checks appropriate to the role for personnel with access to Student PII, require written confidentiality agreements, provide privacy training annually, and promptly revoke access upon role change or termination.
10. Data Breach Notification
Vendor shall notify the School Board in writing without unreasonable delay and in no event later than forty-eight (48) hours after discovery of any breach, unauthorized access, disclosure, acquisition, or compromise involving Student PII (a “Security Incident”) and provide updates every twenty-four (24) hours until containment. Within ten (10) business days after containment, Vendor shall deliver a written incident report detailing the nature of the incident, systems and data affected, number of impacted individuals, root cause, mitigation, corrective actions, and timeline. Vendor shall preserve and provide relevant logs, images, and evidence.
Vendor shall, for any Security Incident involving Student PII within Vendor’s possession or control, except to the extent caused solely by the School Board’s negligence or willful misconduct, at its sole expense:
• Conduct a thorough forensic investigation;
• Cooperate fully with the School Board, law enforcement, and regulators;
• Provide all legally required notifications to affected individuals, the Louisiana Attorney General, and any other authorities;
• Offer credit monitoring, identity-theft protection, and related remediation services to each affected individual for a minimum of twelve (12) months; and
• Reimburse the School Board for all reasonable, documented costs directly arising from the Security Incident, including investigation, notification, public relations, legal fees, regulatory penalties, and call center support.
Vendor shall maintain incident-response plans and resources sufficient to fulfill these obligations.
Vendor shall not publicly disclose any Security Incident involving Student PII without prior written coordination with the School Board, to the extent legally permitted and not prohibited by law.
11. Audit Rights The School Board may request relevant security documentation related to Student PII no more than once per year upon reasonable notice or more frequently upon a material incident. If the audit reveals material non-compliance, Vendor shall reimburse the School Board for all audit costs and promptly remediate the deficiencies at Vendor’s expense within agreed timelines. Vendor may satisfy this requirement by providing a current SOC 2 Type II report or equivalent independent audit report. The School Board reserves the right to conduct a reasonable audit in the event of a material Security Incident or reasonable basis for non-compliance.
12. Data Retention and Destruction
Upon termination Vendor shall, within thirty (30) days, provide a complete, usable export of Student PII in a mutually agreed format and shall irreversibly delete Student PII, including from backups within ninety (90) days, in accordance with NIST Special Publication 800-88 or equivalent, and provide a written certification of destruction signed by an authorized officer of Vendor confirming no copies or backups remain in any form. Confidentiality obligations survive deletion. Vendor shall cooperate post-termination for any additional data export needs at no additional cost beyond reasonable services.
13. Policy Conflicts
In the event of conflict between Vendor policies and this Addendum, this Addendum controls.
14. Injunctive Relief
Unauthorized disclosure may cause irreparable harm and the School Board may seek injunctive relief in addition to other remedies.
15. NDAA Compliance
Vendor certifies that neither Vendor nor any of its subprocessors/subcontractors uses, as a substantial or essential component of any system or as critical technology as part of any system, any covered telecommunications equipment or services (as defined in Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019, Pub. L. 115-232, and implemented in FAR 52.204-25). This includes equipment or services produced or provided by Huawei Technologies Company, ZTE Corporation, Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, Dahua Technology Company, or any subsidiary or affiliate of those entities. Vendor shall promptly notify the School Board within five (5) business days if it discovers any such use and shall, at its expense, replace or remediate any prohibited equipment/services. This certification applies throughout the term of the Contract and any renewals.
16. Indemnification
Vendor shall defend, indemnify, and hold harmless the School Board, its members, officers, employees, and agents from and against any and all claims, actions, damages, fines, penalties, assessments, losses, costs, and expenses (including reasonable attorneys’ fees, expert fees, forensics, notification, credit monitoring, call center, and remediation) arising out of or related to: (a) any material breach of this Addendum or the Contract; (b) any Security Incident or data breach involving Student PII occurring within Vendor’s or its subprocessors’ systems, environment, or control; or (c) any violation of applicable privacy, data security, or breach notification laws by Vendor or its subcontractors.
The foregoing shall not apply to the extent caused by the School Board’s sole negligence or willful misconduct.
Except as provided below, Vendor’s total liability under the Contract shall be subject to any limitation of liability set forth in the Contract.
Notwithstanding the foregoing, any limitation of liability shall not apply to: (i) Vendor’s gross negligence or willful misconduct; or (ii) Vendor’s breach of confidentiality obligations.
For Security Incidents involving Student PII, Vendor’s total liability shall not exceed Five Million Dollars ($5,000,000).
17. Data Subject Rights and Legal Cooperation
Vendor shall promptly (within five (5) business days, unless otherwise required by law) assist the School Board in responding to requests for access, correction, restriction, deletion of Student PII, subpoenas, public records requests, or other legal demands. Vendor shall not disclose Student PII except as directed in writing by the School Board or as required by law (with prior notice to the School Board where legally permissible). Vendor will reasonably cooperate with any inquiry, audit, or enforcement action by authorities relating to Student PII.
18. Governing Law and Venue
This Addendum shall be governed by and construed in accordance with the laws of the State of Louisiana, without regard to conflict-of-laws principles. Any dispute arising under or related to this Addendum shall be brought exclusively in the state or federal courts located in Ascension Parish, Louisiana. Each party irrevocably consents to the personal jurisdiction of such courts and waives any objection to venue or inconvenient forum.
19. Survival
The obligations in this Addendum shall survive the termination or expiration of the Contract and this Addendum for so long as any Student PII remains in Vendor’s possession or control or as otherwise required by law.
Agreement of Compliance
Vendor certifies compliance with this Addendum and applicable laws protecting student data and confirms that personnel accessing School Board systems have completed required cybersecurity training.
Vendor Name: ___________________________
Authorized Representative:Signature on File ______________________________ Title: ______________________________ Signature: ______________________________ Date: ______________________________ ***************************************************
Ascension Parish School Board Superintendent/Representative Signature: ______________________________ Title: __________________________________ Date: ______________________________