Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the Terms of Service between Lunova ("Lunova") and the subscribing school (the "School"). It applies to personal information in the School Data that Lunova processes for the School.

1. Roles and instructions

The School controls the School Data and decides why and how it is used. Lunova acts as the School's service provider and processes School Data only to provide Lunova, following the Terms, this DPA and the School's documented instructions given through the product or in writing. Lunova will not sell School Data, use it for advertising, or combine it with other data except as needed to provide the service.

Where the Family Educational Rights and Privacy Act (FERPA) applies to the School, Lunova acts as a "school official" with a legitimate educational interest, under the School's direct control for the use and maintenance of education records, and will not re-disclose them except as FERPA allows.

2. People with access

Only personnel who need access to provide or support Lunova can reach School Data, and they are bound by confidentiality obligations.

3. Security

Lunova maintains a written information security program consistent with the Massachusetts standards for the protection of personal information (201 CMR 17.00), including:

• Separation of each school's data, enforced in the application and tested automatically.
• Encryption of data in transit (TLS) and encrypted storage of credentials and secrets.
• Role-based access for school users, and least-privilege access for our own personnel.
• An audit trail of changes to records.
• Backups, security updates, and monitoring of the service.

4. Subprocessors

The School authorizes Lunova to use the subprocessors listed in the Privacy Policy. Lunova binds each one to data protection terms at least as protective as this DPA and remains responsible for them. Lunova will announce new subprocessors at least 30 days in advance; the School may object on reasonable data protection grounds and, if we cannot resolve the objection, cancel without penalty.

5. Security incidents

Lunova will notify the School without undue delay, and within 72 hours, after confirming a breach of security affecting School Data. The notice will describe what happened, the data involved and the steps taken, and Lunova will help the School meet its own notice duties, including under Massachusetts General Laws chapter 93H.

6. Requests from individuals

If a student, guardian or staff member asks Lunova to access, correct or delete their information, we will refer them to the School. Lunova will help the School answer such requests, mainly through the product's own tools.

7. Return and deletion

At the end of the subscription the School has 30 days to export its data. Lunova then deletes the School Data, and backup copies are erased within 90 days, unless the law requires Lunova to keep something, in which case it stays protected under this DPA.

8. Information and audits

On request, and no more than once a year unless there has been an incident, Lunova will answer the School's reasonable security questionnaire and provide the information needed to show compliance with this DPA.

9. Location

School Data is hosted in the United States.

10. Contact

Questions about this DPA, or a signed copy for your records: [email protected].