Data Processing Agreement

This Data Processing Agreement, referred to as the “DPA,” forms part of the agreement between READTYCH and the school, school district, charter network, university, education department, government agency, nonprofit, or other organization using READTYCH.

That organization is referred to as the “Institution.”

The READTYCH entity identified in the applicable Order Form, pilot agreement, or other signed document is referred to as “READTYCH.”

The DPA applies whenever READTYCH processes Covered Data on behalf of the Institution while providing the Services.

It begins when the Institution accepts an agreement that includes this DPA and continues for as long as READTYCH processes Covered Data on the Institution’s behalf.

If this DPA conflicts with the Institutional and District Terms, this DPA will control matters concerning the processing and protection of Covered Data.

An individually negotiated agreement or signed amendment will take priority where it expressly changes this DPA.

Legal documents often become difficult because familiar ideas are given unfamiliar names. The definitions below are intended to keep everyone’s responsibilities clear.

The Institution controls the educational purpose for which Covered Data is provided.

The Institution decides:

• Which students and users may access READTYCH.
• What information is supplied.
• Which available features and integrations are enabled.
• Which roles and permissions are assigned.
• How long the Institution requires the information.
• What notices or authorizations must be provided to its community.

READTYCH processes Covered Data to deliver and support the Services selected by the Institution.

READTYCH does not gain ownership of education records or student work simply because that information passes through its technology.

Each Party remains responsible for meeting the legal obligations that apply to its own role.

READTYCH will process Covered Data only:

• To provide the Services described in the agreement.
• According to the Institution’s documented instructions.
• As otherwise permitted by this DPA.
• When the processing is required by law.

The agreement, Order Form, administrator settings, support requests, integration choices, and written communications from authorized representatives may form part of the Institution’s documented instructions.

If a law requires READTYCH to process Covered Data outside those instructions, READTYCH will inform the Institution before doing so unless the law prohibits that notice.

If READTYCH reasonably believes an instruction violates Data Protection Law, it will inform the Institution and may pause the affected processing while the Parties work toward a lawful solution.

READTYCH will not quietly turn Institution-directed information into information used for an unrelated purpose.

The Institution is responsible for ensuring that its instructions and use of the Services comply with applicable law.

The Institution will:

• Have a lawful basis or other legal authority for providing Covered Data to READTYCH.
• Provide required notices to students, families, educators, and other Data Subjects.
• Obtain consent or authorization where it is required.
• Limit the information provided to what is reasonably needed.
• Keep administrator and account permissions current.
• Use the Services in accordance with its privacy, security, and records policies.
• Respond to Data Subject requests within its area of responsibility.
• Tell READTYCH when information must be corrected, returned, restricted, or deleted.
• Avoid sending information that the Services were not designed or approved to process.

The Institution should not provide an entire student record when a smaller amount of information can support the same educational purpose.

READTYCH may process Covered Data to:

• Create and maintain accounts.
• Connect users with the correct Institution, school, class, or course.
• Provide books, notes, assignments, assessments, and feedback.
• Save student work and authorized learning activity.
• Support educator and administrator functions.
• Operate Institution-approved applications and integrations.
• Provide implementation, training, and technical support.
• Secure accounts, devices, systems, and networks.
• Detect and respond to misuse or technical problems.
• Maintain service reliability.
• Follow the Institution’s documented instructions.
• Meet applicable legal obligations.

READTYCH will not process Covered Data for behaviorally targeted advertising or create unrelated commercial profiles about students.

READTYCH will not sell Covered Data in exchange for money.

Where the Family Educational Rights and Privacy Act, or FERPA, applies and READTYCH receives personally identifiable information from education records under the school official exception, READTYCH will:

• Perform the institutional service described in the agreement.
• Remain under the Institution’s direct control regarding the use and maintenance of the education records.
• Use the records only for the purpose for which the Institution disclosed them.
• Limit access to people who need the information to provide the Services.
• Avoid unauthorized disclosure or redisclosure.
• Help the Institution provide access to eligible parents or students where appropriate.
• Return, delete, or deidentify education records when instructed and legally permitted.

READTYCH will not use FERPA-protected information to create advertising profiles, market unrelated products, or pursue a purpose outside the authorized educational service.

The Institution remains responsible for determining whether it may lawfully disclose education records to READTYCH.

READTYCH remains responsible for the legal duties that apply to its role as an education technology provider.

Where the Children’s Online Privacy Protection Act, or COPPA, applies, READTYCH will meet the responsibilities assigned to it as the operator of the relevant online service.

A school may authorize the collection of a child’s personal information on behalf of a parent only when the information is used for the school’s benefit and for an educational purpose.

READTYCH will provide the Institution with information about what is collected from children, how it is used, whether it is disclosed, and how it may be reviewed or deleted.

READTYCH will not require children to provide more personal information than is reasonably needed to participate in the authorized educational activity.

School authorization will not be treated as permission to use children’s information for unrelated advertising or commercial purposes.

This DPA does not transfer READTYCH’s independent COPPA responsibilities to the Institution or its educators.

Where a US state privacy law applies and READTYCH acts as a service provider, contractor, or processor, READTYCH will:

• Process Covered Data only for the limited purposes described in the agreement.
• Avoid selling or sharing Covered Data as those terms are defined by applicable law.
• Avoid using Covered Data for targeted advertising.
• Avoid retaining, using, or disclosing Covered Data outside the direct relationship with the Institution except where permitted by law.
• Avoid combining Covered Data with personal information received from another source except where the law permits that combination.
• Provide the level of privacy protection required by the applicable law.
• Allow the Institution to take reasonable steps to confirm that Covered Data is being handled consistently with this DPA.
• Cooperate with reasonable efforts to stop and correct unauthorized processing.

READTYCH will notify the Institution if it determines that it can no longer meet a material obligation imposed by applicable Data Protection Law.

Anyone working for READTYCH who is permitted to access Covered Data must be subject to an appropriate duty of confidentiality.

Access will be limited to people who need the information to perform their work.

READTYCH will communicate relevant privacy and security expectations to personnel with access to Covered Data.

Confidentiality obligations will continue after a person’s employment or engagement with READTYCH ends.

READTYCH will maintain administrative, technical, and physical safeguards appropriate to the nature of the Covered Data, the Services being provided, and the risks involved.

The security program will be designed to protect the confidentiality, integrity, and availability of Covered Data.

Depending on the system, feature, and stage of deployment, safeguards may include:

• Identity and access management.
• Role-based permissions.
• Authentication controls.
• Encryption during transmission and at rest where appropriate.
• Secure software development practices.
• Vulnerability identification and remediation.
• System logging and monitoring.
• Malware protection.
• Backup and recovery procedures.
• Change-management controls.
• Incident response planning.
• Provider security requirements.
• Personnel privacy and security responsibilities.
• Periodic security reviews.

Security is not a single feature. It is a continuing process of limiting access, finding weaknesses, responding to risk, and improving the systems that protect information.

The security measures applying to Covered Data are described further in Schedule 2.

READTYCH can protect the systems it controls. The Institution must protect the parts of the environment it controls.

The Institution is responsible for:

• Protecting administrator and user credentials.
• Assigning suitable roles and permissions.
• Removing access when it is no longer needed.
• Maintaining its own networks and connected systems.
• Using supported software and configurations.
• Reviewing integration permissions.
• Reporting suspected account compromise promptly.
• Avoiding the transmission of unnecessary personal information through support channels.

A Security Incident caused by an Institution-controlled account or system still requires cooperation.

The Parties will work together rather than allowing uncertainty about responsibility to delay the response.

If READTYCH confirms a Security Incident involving Covered Data, it will notify the Institution without unreasonable delay and within any period required by applicable law or the signed agreement.

The notice will include available information about:

• What happened.
• When the incident was discovered.
• The type of Covered Data involved.
• The categories of affected Data Subjects.
• The likely consequences, where known.
• The steps taken or planned to contain and address the incident.
• A contact for follow-up questions.

READTYCH may provide the information in stages if the investigation is still underway.

An initial notice will not be treated as an admission of fault or liability.

READTYCH will take reasonable steps to contain the incident, preserve relevant evidence, correct identified weaknesses, and reduce the risk of the same issue occurring again.

The Institution will be responsible for regulatory or individual notices assigned to it by law. READTYCH will provide reasonable assistance using the information available to it.

Neither Party will issue a public statement that inaccurately describes the incident or the other Party’s role.

READTYCH may use Subprocessors when they are needed to provide, protect, or support the Services.

The Institution gives READTYCH general authorization to use Subprocessors subject to the protections in this section.

Before giving a Subprocessor access to Covered Data, READTYCH will:

• Carry out reasonable diligence appropriate to the service and risk.
• Limit access to what the Subprocessor reasonably needs.
• Enter into a written agreement addressing data protection and confidentiality.
• Require safeguards appropriate to the processing.
• Remain responsible for the Subprocessor’s performance of its data protection obligations to the extent required by law.

A current list of relevant Subprocessors will be made available upon institutional request or through the READTYCH Trust Center when that resource becomes available.

READTYCH will provide reasonable notice before adding a new Subprocessor that will materially process Covered Data.

The Institution may object within the period stated in that notice when it has a reasonable and documented data protection concern.

The Parties will try in good faith to resolve the concern. That may involve clarifying the Subprocessor’s role, adding safeguards, or considering a commercially reasonable alternative.

If the concern cannot be resolved, the Parties will determine an appropriate next step under the applicable Order Form or signed agreement.

The Institution will usually be responsible for responding to requests from Data Subjects whose information it controls.

Depending on applicable law, a person may ask to:

• Access their information.
• Correct inaccurate information.
• Delete information.
• Restrict or object to processing.
• Receive a portable copy where that right applies.
• Withdraw consent.
• Understand how information has been used.

READTYCH will provide reasonable assistance so the Institution can respond.

If READTYCH receives a request relating to Institution-controlled Covered Data, it will refer the requester to the Institution unless law requires READTYCH to respond directly.

READTYCH will not independently disclose, change, or delete Institution-controlled information without appropriate authorization.

The Institution is responsible for verifying the identity and authority of the requester. READTYCH may also apply reasonable verification measures before acting on an instruction.

If READTYCH receives a legally binding request for Covered Data from a government authority, court, or law enforcement agency, it will review the request and disclose only the information it is legally required to provide.

Where legally permitted, READTYCH will notify the Institution before making the disclosure so the Institution can seek protection or challenge the request.

If advance notice is prohibited, READTYCH will provide notice afterward when the restriction ends, unless the law continues to prohibit it.

READTYCH will not voluntarily provide Covered Data to a government authority for an unrelated purpose.

The Institution may need to complete a privacy impact assessment, security review, or similar evaluation before using READTYCH.

Taking into account the nature of the processing and the information available, READTYCH will provide reasonable assistance.

That assistance may include available information about:

• The categories of information processed.
• Processing purposes.
• Data flows.
• Retention and deletion.
• Security controls.
• Subprocessors.
• AI-assisted features.
• International transfers.
• Measures designed to reduce privacy risk.

READTYCH will also provide reasonable assistance if the Institution must consult a regulator about high-risk processing involving the Services.

Assistance requiring substantial custom work may be subject to reasonable fees agreed in advance, unless the work is required because READTYCH breached this DPA.

READTYCH is developing AI-assisted features that may support handwriting recognition, feedback preparation, grading suggestions, learning pattern identification, or educational resource recommendations.

Covered Data will not be used to make final academic decisions without meaningful human involvement.

READTYCH will not use Covered Data to train a general-purpose commercial AI model unless the Institution has expressly authorized that use and it is permitted by law.

Where an AI-assisted feature processes Covered Data, READTYCH will:

• Connect the processing to an authorized educational purpose.
• Limit the information used to what the feature reasonably needs.
• Apply appropriate access controls.
• Provide available information about the feature’s intended function.
• Support human review of meaningful academic output.
• Consider privacy, security, and fairness risks during development and evaluation.

An AI-generated suggestion is information for an authorized person to consider. It is not a substitute for educational judgment.

AI assists. Educators decide.

READTYCH may create information that has been aggregated or deidentified so it is no longer reasonably linked to an identifiable person.

Subject to applicable law and the agreement, READTYCH may use properly deidentified information to improve reliability, understand general product performance, strengthen accessibility, conduct approved evaluation, and guide product development.

READTYCH will not attempt to reidentify the information except where reasonably necessary to test whether the deidentification method is effective or where permitted by law.

Deidentified information will not be disclosed in a form that could reasonably identify a student or another Data Subject.

If applicable law continues to treat the information as personal information, READTYCH will continue to protect it as Covered Data.

READTYCH will provide reasonable assistance that allows the Institution to correct Covered Data under its control.

The Institution is responsible for the accuracy of the information it provides and for deciding when an education record should be corrected.

READTYCH will not alter a student’s grade, submission, attendance information, or academic record without an authorized instruction or an established product function controlled by the Institution.

Technical corrections made to restore corrupted or incorrectly processed information will be documented where appropriate.

Covered Data will be kept only for as long as it is reasonably needed to provide the Services, follow the Institution’s instructions, maintain security, meet the agreement, or comply with law.

The retention period may depend on:

• The type of information.
• The active subscription or pilot period.
• The Institution’s instructions.
• Backup and recovery requirements.
• Security and fraud-prevention needs.
• Legal obligations.

READTYCH will not keep identifiable student information indefinitely simply because it might be useful in the future.

The Institution should communicate any legally required retention period that differs from the standard service settings.

During the agreement, the Institution may request an available export of Covered Data under its control.

When the relevant Services end, the Institution may instruct READTYCH to return or delete Covered Data unless law requires continued retention.

READTYCH will delete Covered Data from active systems within the period stated in the applicable Order Form, retention schedule, or signed agreement.

If no specific period has been agreed, READTYCH will complete deletion within a reasonable period after receiving a valid instruction, taking account of the information involved, the Services, and applicable law.

Covered Data stored in backups may remain until the backup is securely overwritten or expires through the normal backup cycle. During that time, it will remain protected and will not be restored for ordinary business use.

If READTYCH must retain information by law, it will keep only what is required, protect it, and stop using it for other purposes.

Upon reasonable request, READTYCH will confirm completion of the deletion process.

The Institution is responsible for requesting and completing any available export before the agreed export period ends.

READTYCH will provide information reasonably needed to demonstrate its compliance with this DPA.

Where available, READTYCH may first provide:

• Relevant privacy and security documentation.
• Completed security questionnaires.
• Subprocessor information.
• Available assessment or testing summaries.
• Other documentation appropriate to the Institution’s review.

The Institution may request an audit when required by applicable law, a regulator, a signed agreement, a confirmed Security Incident, or reasonable evidence of material noncompliance.

An audit must:

• Be requested with reasonable advance notice unless urgency is legally required.
• Take place during normal business hours where practical.
• Avoid unnecessary disruption.
• Protect READTYCH and third-party confidential information.
• Remain limited to systems and processing relevant to the Institution.
• Be conducted by qualified personnel subject to confidentiality.

The Parties will agree on a reasonable audit plan before access is provided.

The Institution will normally cover its audit costs unless the audit identifies a material breach by READTYCH.

An audit cannot require READTYCH to expose another customer’s information, weaken security, or disclose information prohibited by law.

READTYCH is based in the United States. Covered Data may be processed in the United States and in other locations used by approved service providers.

READTYCH will not transfer Covered Data across national borders unless the transfer is permitted by applicable law and consistent with the Institution’s agreement.

If an Institution is subject to specific international transfer or data residency requirements, the Parties may enter into an appropriate transfer addendum before the affected Covered Data is processed.

The Institution should notify READTYCH of any data residency, localization, or international transfer requirements before providing the relevant Covered Data.

READTYCH will maintain records of processing where required by applicable Data Protection Law.

These records may include:

• Processing purposes.
• Categories of Institutions and Data Subjects.
• Categories of Covered Data.
• Relevant Subprocessors.
• Applicable international transfers.
• General security measures.

READTYCH will make relevant information available to a competent regulator where legally required.

READTYCH will consider privacy and data protection when designing or materially changing features that process Covered Data.

Depending on the feature and risk, this may include:

• Limiting the information collected.
• Reducing default access.
• Using role-based permissions.
• Considering whether identifiable information is necessary.
• Reviewing retention.
• Evaluating security risk.
• Providing Institution-level controls.
• Reviewing the impact of AI-assisted processing.
• Testing how information moves between systems.

Privacy should influence how a feature is built, not appear only after the feature is finished.

The liability provisions in the Institutional and District Terms apply to this DPA unless the Parties agree to different privacy or security terms in an Order Form or signed amendment.

Nothing in this DPA limits a responsibility or right that cannot lawfully be limited.

Each Party remains responsible for the actions, instructions, systems, and legal obligations within its control.

READTYCH may update this DPA when Data Protection Law, the Services, or security practices change.

A change will not materially reduce the protection of Covered Data during an active agreement without the Institution’s consent unless the change is required by law or needed to respond to a serious security risk.

READTYCH will provide reasonable notice of a material update.

If a change requires the Institution’s agreement, it will not take effect until that agreement is provided.

This DPA ends when READTYCH no longer processes Covered Data on behalf of the Institution.

The confidentiality, security, deletion, audit, and legal obligations that need to continue will remain effective until all Covered Data has been returned, deleted, or lawfully deidentified.

Questions about this DPA, institutional privacy reviews, security documentation, or data processing may be submitted through the READTYCH Contact page.

Please include “Data Processing Agreement” and the name of the Institution in the message.

Contact READTYCH About Data Processing →

READTYCH processes Covered Data to provide the Digital Book, education platform, institutional tools, approved applications, implementation, support, training, pilot services, and other Services identified in the agreement.

Processing continues for the term of the applicable Order Form or pilot agreement and for the limited period needed to return, delete, deidentify, secure, or lawfully retain Covered Data afterward.

Processing may include collecting, receiving, recording, organizing, structuring, hosting, storing, retrieving, consulting, using, transmitting, displaying, restricting, correcting, exporting, deidentifying, and deleting Covered Data.

Covered Data may be processed to:

• Operate and secure accounts.
• Provide learning materials.
• Save notes and student work.
• Deliver assignments and assessments.
• Return educator feedback.
• Support institutional administration.
• Provide approved analytics and learning insights.
• Operate authorized integrations.
• Provide support, training, and implementation.
• Maintain and improve service reliability.
• Complete an approved pilot or evaluation.
• Follow the Institution’s documented instructions.

Data Subjects may include:

• Students.
• Parents and guardians.
• Educators.
• School and district administrators.
• Institution employees and contractors.
• Technology and support personnel.
• University or research personnel.
• Government or education department users.
• Other authorized users.

Covered Data may include:

• Names and institutional identifiers.
• School-provided contact information.
• Account credentials and roles.
• School, class, grade, course, and subject information.
• Books and assigned learning materials.
• Handwritten and typed notes.
• Annotations and highlights.
• Assignments and assessment responses.
• Grades, corrections, and educator feedback.
• Completion, participation, and learning activity.
• Institution communications.
• Device, browser, and network information.
• Support and diagnostic information.
• Accessibility or accommodation information provided by the Institution.
• Other information submitted through an approved feature.

Depending on the Institution’s use of the Services, Covered Data may include:

• Education records.
• Information belonging to children.
• Student performance information.
• Accessibility or accommodation information.
• Account credentials.
• Information treated as sensitive under applicable law.

The Institution should not provide health information, financial information, government identification numbers, precise location, biometric information, or other highly sensitive information unless the applicable Service is specifically designed and approved to process it.

Processing may occur continuously or as needed while authorized users access the Services.

READTYCH will maintain safeguards appropriate to the Services, the Covered Data, and the risk.

The security program may include the measures below where relevant to the system, product, and stage of deployment.

• Access based on job responsibilities.
• Role-based permissions.
• Processes for granting, reviewing, and removing access.
• Authentication controls for privileged accounts.
• Logging of relevant administrative activity.

• Encryption during transmission.
• Encryption at rest where appropriate.
• Separation of institutional data where technically appropriate.
• Controls designed to prevent unauthorized disclosure.
• Secure deletion or destruction methods.

• Secure development practices.
• Code and configuration review.
• Testing before material releases.
• Vulnerability identification and remediation.
• Change-management procedures.
• Controls against malicious software and common attacks.

• System monitoring.
• Logging and alerting.
• Backup and recovery processes.
• Availability and resilience planning.
• Environment and configuration management.
• Restricted administrative access.

• Confidentiality obligations.
• Privacy and security expectations.
• Access limited to people who need it.
• Removal of access when a role ends or changes.
• Appropriate review of personnel with privileged access.

• A documented response process.
• Internal escalation.
• Investigation and containment.
• Preservation of relevant information.
• Recovery and corrective action.
• Institution notification where required.

• Review of relevant Subprocessors.
• Written data protection requirements.
• Access limited to the service being provided.
• Ongoing review appropriate to the provider’s role and risk.

• Backup practices.
• Recovery planning.
• Processes designed to restore service and data availability.
• Periodic review of continuity arrangements.

Security controls will develop as READTYCH products and institutional deployments mature.

READTYCH will not materially reduce the overall protection of Covered Data during an active agreement without a valid security, legal, or technical reason.

READTYCH is based in the United States. Covered Data may be processed in the United States and in other locations used by approved service providers.

READTYCH will not transfer Covered Data across national borders unless the transfer is permitted by applicable law and consistent with the Institution’s agreement.

If an Institution is subject to specific international transfer or data residency requirements, the Parties may enter into an appropriate transfer addendum before the affected Covered Data is processed.

The Institution should notify READTYCH of any data residency, localization, or international transfer requirements before providing the relevant Covered Data.