Data Security & Privacy Plan

SchoolCal, LLC (“SchoolCal”) implements data security and privacy protections over the life of each service contract through written data processing agreements, technical safeguards, employee training, and documented incident response procedures.

Our security and privacy program is reviewed no less than annually by company leadership and updated as needed to reflect changes in applicable federal and state law, regulatory guidance, and industry best practices. Each school or district (“LEA”) we serve receives a Data Processing Agreement (“DPA”) that specifies our mutual obligations before any student or staff data is exchanged.

Administrative safeguards include role-based access policies, confidentiality agreements for all employees and contractors with access to PII, and annual security policy reviews approved by company leadership.

Operational safeguards include a least-privilege access model, controlled access to production data environments, vendor compliance requirements for all subprocessors, and documented procedures for onboarding and offboarding personnel with data access.

Technical safeguards include:

• HTTPS/TLS encryption for all data in transit
• Encryption at rest for sensitive data fields
• Multi-factor authentication (MFA) enforced on all critical systems and infrastructure
• Web Application Firewall (WAF) protecting publicly accessible services
• Network access controls including VPC segmentation and firewall rules
• Regular vulnerability scanning of code, infrastructure, and web services
• Centralized logging and alerting for anomalous or unauthorized activity
• Intrusion detection across production infrastructure

SchoolCal's infrastructure is hosted on Microsoft Azure, which maintains SOC 2 Type II, ISO 27001, and additional certifications for physical and environmental security.

All SchoolCal employees and contractors who will have access to Student Data or APPR Data receive training on applicable federal and state privacy laws — including FERPA, COPPA, and applicable state student data privacy statutes — prior to receiving access credentials.

Training is conducted at onboarding and reviewed on an annual basis. Training covers: data classification and handling, acceptable use, breach recognition and reporting obligations, and state-specific requirements for any states in which we have active LEA contracts. Completion of training is documented and maintained as part of employee records.

Employees and contractors are required to execute a confidentiality agreement as a condition of employment or engagement. Access to Student Data is restricted to the minimum necessary to perform job responsibilities.

SchoolCal enters into written data processing agreements with all subprocessors who may access, store, or process Student Data on our behalf. These agreements require subprocessors to maintain data protections no less stringent than those in SchoolCal's customer DPAs, prohibit subprocessors from using Student Data for any purpose other than providing contracted services, and prohibit re-disclosure to subsequent third parties without written authorization.

SchoolCal monitors subprocessor compliance and, in the event a subprocessor fails to materially comply with applicable requirements, will notify affected LEAs, remove the subprocessor's access to Student Data, and take all necessary steps to retrieve or securely destroy data held by that subprocessor.

A current, maintained list of authorized subprocessors is available at: schoolcal.com/legal/subprocessors

SchoolCal maintains a written incident response plan consistent with industry standards and applicable federal and state law. The plan covers detection, containment, investigation, notification, and post-incident review.

In the event of a confirmed data breach or unauthorized access to Student Data, SchoolCal will:

• Notify the affected LEA within 72 hours of confirmation, or sooner as required by applicable state law
• Provide notification details including: nature of the incident, data types involved, estimated scope, date of occurrence, steps taken to contain and remediate, and a designated point of contact
• Cooperate fully with the LEA, the NYSED Chief Privacy Officer (where applicable), and law enforcement throughout investigation and remediation
• Assist the LEA in fulfilling its obligations to notify affected students, parents, and guardians
• Bear the costs of notification and remediation where the breach is attributable to SchoolCal or its subprocessors, as required by applicable state law

SchoolCal will provide a summary of its written incident response plan to any LEA upon request.

Upon written request from an LEA, SchoolCal will return or provide a mechanism to transfer all Student Data within 60 days (or within the timeframe specified in the applicable DPA or state supplement, whichever is shorter). Data will be provided in a readable, exportable format such as CSV or other mutually agreed format.

SchoolCal will not retain Student Data beyond the term of the Service Agreement unless expressly authorized in writing, required by law, or necessary to facilitate transfer of data back to the LEA. Upon termination, if no written request is received from the LEA, SchoolCal will provide the LEA with advance notice before disposing of Student Data per the terms of the applicable DPA.

Student Data that is no longer needed to provide services is securely deleted from active production systems and backup environments using industry-standard destruction methods. SchoolCal follows NIST SP 800-88 guidance for media sanitization where applicable.

Upon request, SchoolCal will provide written certification of the destruction of Student Data, including the date of destruction and the method(s) used. This certification will be delivered to the LEA within 30 days of destruction.

SchoolCal will review each LEA's Data Security and Privacy Policy and Parents' Bill of Rights for Data Privacy and Security upon execution of a DPA and implement any additional contractually required safeguards specific to that LEA.

For New York LEAs, SchoolCal's Data Security and Privacy Plan is incorporated by reference into the applicable DPA as Exhibit K. Provider warrants that this Plan: (a) implements all applicable state and federal data privacy and security requirements; (b) has operational and technical safeguards in place to protect PII; (c) complies with the LEA's Parents' Bill of Rights; (d) requires training for all employees and subprocessors with access to Student Data or APPR Data; (e) ensures subprocessors are bound to protect PII; (f) specifies how incidents are managed with prompt LEA notification; and (g) addresses Student Data return, deletion, and destruction. For New York, encryption of Student Data and APPR Data at rest and in transit is implemented using industry-standard protocols compliant with applicable New York laws and regulations.

The following table documents SchoolCal's alignment with each category of the NIST Cybersecurity Framework v1.1, as required by New York Education Law § 2-d and the Regulations of the Commissioner at 8 NYCRR Part 121.