Data Processing Agreement

1. Definitions

2. Data Processing

2.1 Purpose and Scope

Eleve will process Student Data solely for the purpose of providing the Services to the Institution and in accordance with the Institution's documented instructions. Eleve will not:

• Sell, rent, or trade Student Data
• Use Student Data for advertising or marketing purposes
• Build marketing profiles of students or their families
• Process Student Data for any purpose other than providing the Services
• Retain Student Data beyond the term necessary to provide Services or as required by law

2.2 Institution's Instructions

The Institution instructs Eleve to process Student Data in the following manner:

• Store and maintain student profiles, progress records, and training data
• Enable authorized coaches and administrators to view and update student information
• Allow authorized parents/guardians to view their child's progress and information
• Generate reports and analytics for authorized users
• Facilitate communication between coaches, students, and families
• Provide technical support and maintain platform functionality

2.3 Duration of Processing

Eleve will process Student Data for the duration of the agreement between Eleve and the Institution, and as necessary to provide the Services, comply with legal obligations, or as directed by the Institution.

3. Data Security Measures

Eleve implements appropriate technical and organizational measures to protect Student Data against unauthorized or unlawful processing and accidental loss, destruction, or damage, including:

3.1 Technical Measures

• Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256)
• Secure authentication and access controls (role-based access)
• Regular security monitoring and logging
• Automated backup systems with encryption
• Secure API access with time-limited signed URLs for media content
• Network security and firewall protection

3.2 Organizational Measures

• Employee confidentiality agreements and privacy training
• Principle of least privilege access to Student Data
• Incident response and breach notification procedures
• Regular security assessments and updates
• Vendor management and due diligence for subprocessors

4. Subprocessors

Eleve may engage third-party subprocessors to assist in providing the Services. The Institution consents to Eleve's use of the following subprocessors:

All subprocessors are bound by written agreements requiring them to provide at least the same level of data protection as set forth in this DPA. Eleve will notify the Institution of any changes to subprocessors and provide the Institution with an opportunity to object.

For Institutions in the European Economic Area, the United Kingdom or Switzerland, this DPA is supplemented by a GDPR addendum, signed with the Institution, which incorporates the European Commission's Standard Contractual Clauses (Modules 2 and 3), the UK International Data Transfer Addendum and the Swiss amendments. Ask us at support@tryeleve.com.

5. Data Breach Notification

In the event of a security breach that results in unauthorized access to or disclosure of Student Data:

• Eleve will notify the Institution without undue delay and no later than 72 hours after becoming aware of the breach
• The notification will include available information about the nature of the breach, affected data, and measures taken to address the breach
• Eleve will cooperate with the Institution in investigating the breach and complying with applicable notification requirements
• Eleve will take reasonable steps to mitigate the effects of the breach and prevent future breaches

6. Institution Rights and Obligations

6.1 Institution's Rights

The Institution retains all rights to Student Data and may:

• Access, review, correct, and delete Student Data at any time
• Export Student Data in a portable format
• Determine what Student Data is collected and processed
• Set access permissions for users within their organization
• Request information about Eleve's data processing practices
• Audit Eleve's compliance with this DPA (with reasonable notice)

6.2 Institution's Obligations

The Institution is responsible for:

• Obtaining necessary consents and authorizations to collect and share Student Data with Eleve
• Complying with FERPA, COPPA, and other applicable privacy laws
• Ensuring the accuracy and legality of Student Data provided to Eleve
• Managing user access and permissions within their organization
• Responding to requests from students or parents regarding their data rights
• Notifying Eleve of any restrictions or special handling requirements for Student Data

7. Data Return and Deletion

7.1 Upon Termination

Upon termination of the agreement or upon the Institution's request:

• Eleve will make Student Data available for export by the Institution for 30 days
• After the export period, Eleve will permanently delete all Student Data, unless retention is required by law
• Eleve will provide written certification of deletion upon request
• Backup copies will be deleted in accordance with Eleve's standard backup retention schedule (maximum 90 days)

7.2 Individual Deletion Requests

The Institution may request deletion of specific Student Data at any time. Eleve will complete such deletions within 30 days of the request, except where retention is required by law.

8. FERPA and COPPA Compliance

8.1 FERPA School Official Status

For Institutions subject to FERPA, Eleve agrees to act as a "school official" with "legitimate educational interests" in Student Data. Eleve will:

• Use education records only for the purposes of providing the Services
• Not re-disclose personally identifiable information from education records without consent or as permitted by FERPA
• Maintain the confidentiality and security of education records
• Allow parents and eligible students to review and correct education records through the Institution

8.2 COPPA Compliance

For Student Data relating to children under 13, Eleve complies with COPPA by:

• Collecting personal information only at the direction of the Institution for educational purposes
• Not using or disclosing children's personal information for commercial purposes
• Maintaining reasonable security procedures to protect children's information
• Deleting children's personal information upon the Institution's request

9. Liability and Indemnification

Each party will be responsible for its respective obligations under this DPA:

• Eleve is liable for implementing appropriate security measures and processing data in accordance with this DPA
• The Institution is liable for obtaining necessary consents and complying with applicable privacy laws
• Neither party will be liable for failures caused by the other party's breach of this DPA

10. Term and Termination

This DPA takes effect when the Institution begins using the Services and continues until terminated by either party or until all Student Data has been deleted, whichever is later.

Either party may terminate this DPA if the other party materially breaches its obligations and fails to cure the breach within 30 days of written notice.

11. Changes to This Agreement

Eleve may update this DPA to reflect changes in data protection laws or business practices. Material changes will be communicated to Institutions at least 30 days in advance via email.

12. Contact Information

Related Documents