Data Processing Agreement

"Personal Data" means any information relating to an identified or identifiable natural person, including student education records as defined under FERPA.

"Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.

"Controller" means the school, school district, or parent organization that determines the purposes and means of data processing.

"Processor" means SafeClass Shield, Inc., which processes Personal Data on behalf of the Controller.

"Sub-Processor" means any third party engaged by SafeClass Shield to process Personal Data.

SafeClass Shield processes the following categories of data on behalf of the Controller:

• Student names and identifiers (for child profile management)
• Device identifiers and activity logs (for content filtering)
• Educational record data via LMS integrations (Google Classroom, Canvas, etc.)
• Browser activity summaries (domains visited, blocked/allowed status)
• Assignment and grade status information
• Parent/guardian contact information (email, account credentials)

Purpose: Processing is performed solely to provide SafeClass Shield's parental monitoring, content filtering, and educational tracking services as described in the Terms of Service.

The Controller agrees to:

• Obtain all necessary consents and authorizations before providing Personal Data to SafeClass Shield
• Comply with applicable data protection laws (FERPA, COPPA, GDPR, CCPA as applicable)
• Ensure the lawfulness of any data processing instructions given to SafeClass Shield
• Promptly notify SafeClass Shield of any changes to processing requirements
• Maintain a record of processing activities as required by applicable law
• Provide required notices to students, parents, and staff about data processing

SafeClass Shield agrees to:

• Process Personal Data only on Controller instructions and not for its own purposes
• Maintain appropriate technical and organizational security measures (see Section 6)
• Ensure personnel with access to Personal Data are bound by confidentiality obligations
• Assist the Controller in fulfilling data subject rights requests (access, correction, deletion)
• Notify the Controller of any Personal Data breach within 24 hours of discovery
• Delete or return all Personal Data upon termination of services
• Not transfer Personal Data outside the country of origin without Controller consent and adequate safeguards
• Make available all information necessary to demonstrate compliance with this DPA

SafeClass Shield currently engages the following Sub-Processors:

SafeClass Shield will notify the Controller at least 30 days before adding new Sub-Processors.

SafeClass Shield implements the following security measures:

Notification will include:

• Nature of the breach (categories and approximate number of affected records)
• Contact details of the Data Protection Officer
• Likely consequences of the breach
• Measures taken or proposed to address the breach and mitigate its effects
• Interim containment actions already in place

The Controller is responsible for notifying relevant supervisory authorities and data subjects as required by applicable law (FERPA: 24hrs to institution; GDPR: 72hrs to DPA).

SafeClass Shield will assist the Controller in responding to data subject rights requests within 5 business days, including:

• Right of Access — providing a copy of all Personal Data held
• Right to Rectification — correcting inaccurate data
• Right to Erasure — deleting all data upon valid request
• Right to Data Portability — exporting data in machine-readable format
• Right to Restriction — limiting processing on request
• Right to Object — ceasing non-essential processing

This DPA remains in effect for the duration of the service relationship. Upon termination:

• SafeClass Shield will, at the Controller's choice, return or securely delete all Personal Data within 30 days
• Deletion certificates will be provided upon request
• Backup copies will be purged within 90 days of service termination
• Audit logs may be retained for up to 2 years for legal compliance purposes

This DPA is governed by the laws of the United States. Disputes shall be resolved as specified in the Terms of Service.