United States Institution and FERPA Data Processing Addendum

UNITED STATES INSTITUTION AND FERPA DATA PROCESSING ADDENDUM

School-official controls, education records, child privacy and U.S. institution processing

Academic Quality. Verified.

1. Parties

Provider: [INSERT EXACT WYOMING LLC LEGAL NAME AFTER FORMATION] after legal formation and activation, or another Veri-AQ entity expressly identified in the order. School/Institution: [INSERT FULL LEGAL DETAILS].

2. FERPA role

Where the school relies on the FERPA school-official exception, Veri-AQ will perform an outsourced institutional service/function, remain under the school’s direct control with respect to the use and maintenance of education records, use education-record PII only for the purpose for which it was disclosed, and comply with applicable redisclosure restrictions.

3. Authorised use

• Use education records only for the services/instructions in the order and processing schedule.
• Limit access to personnel and subprocessors with legitimate need.
• Do not use education records for targeted advertising, unrelated commercial profiling, global corpus contribution or general model training.
• Do not redisclose PII except as authorised by the institution and law.

4. School responsibilities

• Determine that the disclosure/use is permitted under FERPA and applicable state/local student privacy laws.
• Maintain required annual-notice/school-official criteria and legitimate educational interest where relying on that exception.
• Provide any required parent/student notices or consents.
• Configure authorised users and data-access roles accurately.

5. Retention and destruction

Veri-AQ will retain institution-controlled education records only for the agreed service purpose and retention schedule, ordinarily no longer than the applicable 6-month raw-content ceiling unless a shorter institution rule applies. Data must be returned/exported or securely deleted when no longer needed or at termination, subject to specific legal holds.

6. Security and incidents

Veri-AQ will maintain reasonable administrative, technical and organisational safeguards and notify the institution of material security incidents in accordance with the contract and applicable law. The institution should specify any required notification period in the signed security schedule.

7. Subprocessors and locations

Approved subprocessors and hosting locations are documented in the vendor register/processing schedule. Material changes are handled under the agreed notice/approval process. State-specific residency or vendor requirements must be added where applicable.

Schedule A – Processing

Legal review and mandatory-law notice. This policy framework is designed for Veri-AQ operations and must be reviewed by appropriately qualified counsel before a new entity, jurisdiction, school contract, under-13 U.S. workflow or materially new processing purpose is launched. Nothing in this document excludes rights or duties that applicable law does not permit the parties to waive.

Primary legal references

• FERPA: Family Educational Rights and Privacy Act, 34 CFR Part 99 — https://studentprivacy.ed.gov/ferpa

Contact details

Website: www.veri-aq.com | Support: support@veri-aq.com | Privacy / PAIA: privacy@veri-aq.com

Principal address: Hofmeyer Rd, Centurion, South Africa, 0157