This online document is a review template. A district-specific DPA becomes binding only when executed by authorized parties; the executed agreement controls if it differs from this page.
This Data Protection Addendum ("DPA") governs the processing of data when Classvero is used by or on behalf of a school, district, or educational agency ("Institution"). It supplements the Terms of Service and Privacy Policy.
1. Definitions
"Institution Data" — any data submitted to Classvero by Institution personnel
"Student Data" — any education records or personally identifiable student information
"Authorized Users" — Institution staff with valid accounts
"Services" — the Classvero platform and related features
2. Roles & Responsibilities
Institution — Data Controller. Determines the purposes and means of processing Institution Data.
Classvero — Data Processor. Processes data only on documented instructions from the Institution.
Under FERPA, Classvero acts as a "school official" with a legitimate educational interest, performing services otherwise performed by the Institution.
3. Purpose Limitation
Classvero processes Institution Data solely to:
Provide the contracted educational services
Maintain, support, and improve the Services
Fulfill legal obligations
Classvero will not use Institution Data for advertising, marketing, or to build user profiles beyond what is necessary to provide the Services.
4. Student Data Protections
Student PII is not required to use the Service
No persistent student accounts or profiles are created
Live Lesson and Live Check participation requires only a short-lived access code; students may enter an optional name or display name (up to 30 characters), no student account is created, and email addresses and phone numbers are refused
Any incidental student data is processed only as instructed by the Institution
Student data is never sold, rented, or disclosed to third parties for commercial purposes
Student data is not used for targeted advertising or behavioral profiling
5. FERPA Alignment
Classvero complies with FERPA requirements applicable to school officials. Specifically:
Access to education records is limited to authorized personnel performing legitimate educational functions
Education records are not re-disclosed without Institution authorization except as required by law
The Institution retains ownership and control of all education records
Upon contract termination, education records are returned or destroyed as directed by the Institution
6. GDPR Compliance (EU/EEA Institutions)
For Institutions subject to the General Data Protection Regulation (GDPR):
Classvero acts as a Data Processor under Article 28 GDPR
Processing occurs only on documented instructions from the Institution (Data Controller)
All Classvero personnel with data access are bound by confidentiality obligations
Appropriate technical and organizational measures (TOMs) are implemented per Article 32 GDPR
Sub-processors are engaged only with prior written notice; the Institution may object
Classvero assists the Institution in meeting data subject rights requests (Articles 15–22)
Security incidents involving Institution Data are communicated without undue delay as required by applicable law and the executed agreement
Data Protection Impact Assessments (DPIAs) are supported upon request
International transfers of EU data rely on Standard Contractual Clauses (SCCs) or equivalent safeguards
7. State Privacy Laws (USA)
Classvero is designed to support compliance with state student privacy laws including but not limited to:
SOPIPA (CA) — no behavioral targeting using student data
NY Education Law § 2-d — district-specific requirements can be addressed in an executed agreement where applicable
COPPA — student participation is school/teacher-directed and designed to avoid direct student identifiers
Additional state-specific addenda available upon request
8. Security Measures
Encryption in transit (TLS 1.2+) and at rest (AES-256)
Role-based access controls and least-privilege internal access
Role-based application access controls and administrative authorization checks
Security capabilities provided by the underlying hosted platform, supplemented by application-level reviews
Logging and monitoring appropriate to the configured service environment
Documented incident response procedures
9. Breach Notification
If Classvero becomes aware of a confirmed security incident involving Institution Data:
The Institution will be notified without undue delay in accordance with applicable law and the executed agreement
Notification will include: nature of the incident, categories of data affected, approximate number of individuals, likely consequences, and remediation measures
Classvero will cooperate with the Institution's breach response obligations
10. Subprocessors
Classvero uses vetted third-party subprocessors (infrastructure, AI, analytics) bound by confidentiality and data protection obligations at least as protective as this DPA. The current subprocessor list is available upon request at support@classvero.com. Institutions will receive advance notice of material subprocessor changes.
11. Data Retention & Deletion
Data is retained only as necessary for service delivery
Upon Institution request or contract termination, data will be returned or deleted within 30 days
Residual backup copies are handled according to the underlying infrastructure provider's backup lifecycle and applicable contractual terms
Any requested deletion confirmation is subject to the capabilities and terms of the executed agreement
12. Audit Rights
Institutions may request written confirmation of compliance with this DPA annually. Classverowill provide documentation or third-party audit summaries where available. On-site audits may be arranged by mutual agreement with reasonable advance notice.