Data Processing Addendum

1. Roles of the Parties

For personal data contained in Customer Data, the school (or district) is the data controller / educational agency and Valence Systems is the data processor / service provider / school official. Valence processes personal data only on documented instructions from the school, including as configured through the Services.

2. Subject Matter, Nature & Purpose

Subject matter: provision of the Concordium^OS platform. Nature & purpose: hosting, storage, and processing of Customer Data to deliver institutional operations, communications, analytics, and related features the school enables. Duration: the term of the subscription, plus any period required for return or deletion of data.

3. Categories of Data Subjects & Personal Data

• Data subjects: students, parents/guardians, teachers, coaches, and school staff.
• Personal data: identifiers and contact details; enrollment, attendance, and schedule data; academic and athletics information; tuition and billing status; and message content and delivery metadata within communications features.

We do not intentionally collect special categories of data beyond what a school chooses to enter to operate its programs.

4. Processor Obligations

• Process personal data only on the school's documented instructions;
• Ensure personnel authorized to process data are bound by confidentiality;
• Implement appropriate technical and organizational security measures (Section 6);
• Assist the school, taking into account the nature of processing, in responding to data-subject and parental requests;
• Not sell personal data or use it for advertising or any purpose other than providing the Services.

5. Subprocessors

The school authorizes Valence to engage the subprocessors below, each bound by data-protection terms no less protective than this Addendum. We will give notice of intended changes and provide an opportunity to object.

6. Security Measures

• Encryption of personal data in transit (TLS) and at rest;
• Role-based access control, least-privilege access, and multi-tenant data isolation;
• Audit logging, monitoring, and alerting;
• Secure development practices, dependency management, and regular review;
• Access limited to authorized personnel under confidentiality obligations.

7. Assistance with Requests

Taking into account the nature of the processing, we will assist the school in fulfilling its obligations to respond to requests from parents, eligible students, and other data subjects to access, correct, or delete personal data.

8. Personal Data Breach Notification

We will notify the affected school without undue delay after becoming aware of a personal data breach affecting its Customer Data, and will provide information reasonably necessary for the school to meet its own notification obligations.

9. Return & Deletion of Data

On termination or at the school's request, we will make Customer Data available for export and then delete it from active systems within a commercially reasonable period, with backups expiring on our standard rotation, unless retention is required by law.

10. International Transfers

Concordium^OS is hosted in the United States, and personal data is processed there. We do not transfer personal data internationally except through the subprocessors listed above in the course of providing the Services.

11. Audits & Compliance

On reasonable request and subject to confidentiality, we will make available information necessary to demonstrate compliance with this Addendum, and will support a school's or state's student data privacy agreement (SDPA) where required.

12. Contact

To request a countersigned Data Processing Addendum, contact privacy [at] concordiumos.com.