DATA PROCESSING AGREEMENT
Between:
[School/District Name] ("School")
[Address]
[Contact Information]
And:
Imakie ("Service Provider")
[Address to be provided]
Email: contact@imakie.ai
1. Purpose and Scope
This Data Processing Agreement ("DPA") is incorporated into and governed by the Imakie Terms of Service. It governs the processing of Student Data (as defined in FERPA) by Service Provider on behalf of School.
2. Definitions
Student Data: Any information directly related to a student that is maintained by School and created, collected, or received by Service Provider through the use of Imakie services.
Educational Records: Records directly related to a student and maintained by an educational agency or institution, as defined under FERPA.
3. Service Provider Obligations
Service Provider agrees to:
- Use Student Data solely to provide services to School
- Not use Student Data for any commercial purpose, including targeted advertising
- Not disclose Student Data except as required by law or authorized by School
- Implement appropriate security measures to protect Student Data
- Notify School of any unauthorized disclosure within 72 hours
- Delete or return Student Data upon termination or as requested by School
4. School Obligations
School agrees to:
- Obtain necessary parental consents as required by applicable law
- Provide clear notice to parents about third-party services
- Ensure educators are trained on student privacy requirements
- Configure Imakie settings appropriately for student privacy
5. Data Security
Service Provider maintains:
- Encryption of data in transit and at rest
- Role-based access controls
- Regular security assessments and audits
- Employee training on data privacy
- Incident response procedures
6. Subprocessors
Service Provider may use the following subprocessors to provide services:
- Google Cloud Platform (hosting and database)
- OpenAI (text generation)
- Stability AI / Replicate (image generation)
Service Provider will provide 30 days notice of any new subprocessors. School may object to new subprocessors by contacting contact@imakie.ai.
7. Data Breach Notification
In the event of a data breach affecting Student Data, Service Provider will:
- Notify School within 72 hours of discovery
- Provide details about the nature and scope of the breach
- Describe remediation steps taken
- Cooperate with School's investigation and notification obligations
8. Data Retention and Deletion
- Active student data retained while account is active
- Upon School request, Student Data will be deleted within 30 days
- Upon termination, all Student Data will be deleted within 90 days unless School requests earlier deletion
- School may export all Student Data at any time through the service interface
9. Compliance with Laws
Service Provider agrees to comply with:
- Family Educational Rights and Privacy Act (FERPA)
- Children's Online Privacy Protection Act (COPPA)
- Protection of Pupil Rights Amendment (PPRA)
- State student privacy laws as applicable
10. Term and Termination
This DPA remains in effect for the duration of the Imakie Terms of Service. Upon termination:
- School may request return or deletion of all Student Data
- Service Provider will cease all use of Student Data
- Deletion will be completed within 30 days unless legally required to retain
11. Limitation of Liability
Notwithstanding any limitation of liability in the Terms of Service, Service Provider's liability for any breach of this DPA shall not be limited.
12. Governing Law
This DPA shall be governed by the laws of [State/Jurisdiction].