School Data Agreement

This Agreement describes how Edufied collects, uses, stores, and protects student and staff personal information provided by or on behalf of the School, and the obligations of both parties in relation to that information.

Edufied collects the following student data as entered by the School's teachers:

Edufied does not collect student email addresses, home addresses, phone numbers, dates of birth, or government-issued identification.

Edufied uses student and School data solely to provide the educational services described in the Platform. Specifically:

• To authenticate students and manage their access to assigned tools.
• To display learning progress and activity data to the responsible teacher.
• To enable the features of the Edufied applications assigned to the School's classes.

Edufied will not:

• Use student data for targeted advertising or behavioural profiling.
• Sell student data to any third party.
• Use student data for any commercial purpose unrelated to providing the Platform.
• Share student data with third parties except as described in Section 5 (Sub-Processors) and Section 7 (Legal Requirements).

The School is responsible for:

• Ensuring that teachers create student accounts only for students enrolled at the School.
• Obtaining any parental or guardian consents required by applicable law before creating student accounts.
• Ensuring that the personal information provided to Edufied is accurate and up to date.
• Notifying Edufied promptly at schools@edufied.com.au if a student's data must be corrected or deleted.

Edufied uses the following sub-processors to operate the Platform. All are bound by data processing agreements:

Edufied will notify Schools of any material changes to its sub-processors by updating this Agreement and posting a notice on edufied.com.au.

Edufied implements reasonable technical and organisational security measures to protect School data, including:

• Encryption in transit (TLS) and at rest.
• Cryptographic hashing of all passwords and student PINs.
• Role-based access controls ensuring teachers can only access their own students and classes.
• Regular review of security practices.

In the event of a data breach likely to result in serious harm, Edufied will:

• Notify the School at the contact email on file within 72 hours of becoming aware of the breach.
• Notify the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.
• Take reasonable steps to contain the breach and prevent further harm.

The School should notify Edufied immediately at privacy@edufied.com.au if it becomes aware of any suspected breach involving Platform data.

• On request: The School may request deletion of all student data at any time by contacting schools@edufied.com.au. Edufied will complete the deletion within 30 days.
• On termination: When a teacher deletes their account, their students' data will be deleted in accordance with our data retention policy.
• Individual records: Teachers can delete individual student records at any time from within the Platform dashboard.

The School may request access to student data by contacting schools@edufied.com.au. Teachers can also view and edit student records directly through the Platform dashboard.

Edufied may be required to disclose School data to law enforcement or a regulatory authority if required by law or a valid court order. Where legally permitted, Edufied will notify the School before making any such disclosure.

For Schools in the United States: Edufied acts as a "school official" under the Family Educational Rights and Privacy Act (FERPA) with a legitimate educational interest in student data. Edufied will:

• Use student data only for the educational purposes for which the School has engaged the Platform.
• Not re-disclose student data to third parties without the School's consent, except as required by law.
• Maintain the confidentiality of education records in accordance with FERPA requirements.

This Agreement is governed by the laws of Western Australia, Australia.

Email: schools@edufied.com.au
Operated by: Joshua Rentenaar trading as Edufied
ABN: 91 731 785 958
Location: Western Australia, Australia