School Data Privacy and FERPA Addendum

Effective Date: September 16, 2026 Service Provider: Skhillz Academy, LLC

This School Data Privacy and FERPA Addendum (“Addendum”) applies when a school, school district, local educational agency, or other educational institution (“School”) enters into an agreement with Skhillz Academy, LLC for Skhillz Script™ and the School provides student education records or personally identifiable student information to Skhillz Academy.

This Addendum supplements the applicable institutional agreement.

1. Purpose

Skhillz Academy will process School Data only to provide, maintain, secure, support, and improve the School-requested educational service in ways authorized by the School and applicable law.

2. FERPA Scope

FERPA applies to covered educational agencies and institutions, not automatically to every education technology company.

Where the School discloses personally identifiable information from education records to Skhillz Academy under FERPA’s school-official exception or another lawful basis, Skhillz Academy agrees to comply with the restrictions applicable to that authorized disclosure.

3. School Official Conditions

Where the parties rely on FERPA’s school-official exception, the parties intend that Skhillz Academy:

1. performs an institutional service or function for which the School would otherwise use employees or other authorized parties;
2. is under the School’s direct control with respect to the use and maintenance of education records provided under the arrangement;
3. uses education-record information only for the purpose for which the disclosure was made;
4. does not redisclose personally identifiable information except as authorized by FERPA, the School, or applicable law;
5. has a legitimate educational interest in the records necessary to perform the contracted service.

4. School Data

“School Data” may include:

• student name or identifier;
• school or class identifier;
• teacher or educator assignments;
• grade level;
• handwriting practice;
• lesson history;
• progress information;
• scores;
• completion data;
• account and roster information;
• other student information submitted or generated through the School’s use of Skhillz Script™.

5. Data Ownership and Control

As between the School and Skhillz Academy, the School retains control of School Data provided by or on behalf of the School, subject to applicable student and parent rights.

Skhillz Academy acquires no ownership interest in School Data merely by processing it.

6. Authorized Uses

Skhillz Academy may use School Data only to:

• provide Skhillz Script™;
• authenticate authorized users;
• manage rosters and accounts;
• provide instruction and practice;
• calculate and display learner progress;
• generate School-requested reports;
• maintain security;
• troubleshoot;
• provide technical support;
• comply with law.

School Data may not be used for unrelated advertising, behavioral profiling, or unrelated commercial purposes.

7. COPPA in School Context

For students under 13, a School may provide COPPA authorization on behalf of parents only to the extent legally permitted and only for educational use for the School’s benefit.

Skhillz Academy remains responsible for its own COPPA obligations.

Where Skhillz Academy relies on School authorization:

• we provide the School with required information about collection and use;
• collection is limited to information reasonably necessary for the educational service;
• data is not used for unrelated marketing or commercial purposes;
• the School may make our Children’s Privacy Notice available to parents.

8. No Sale or Targeted Advertising

Skhillz Academy will not:

• sell School Data;
• sell children’s personal information;
• use School Data for targeted behavioral advertising;
• create advertising profiles from School Data;
• use School Data to advertise unrelated third-party products to students.

9. Service Providers and Subprocessors

Skhillz Academy may use service providers or subprocessors reasonably necessary to provide the Service.

Any service provider receiving protected School Data must be subject to contractual or other legally appropriate restrictions requiring it to process data only for authorized purposes, maintain appropriate security, protect confidentiality, and avoid unauthorized redisclosure.

Skhillz Academy remains responsible for managing its subprocessors consistent with the applicable agreement.

9.1 Skhillz Academy’s Own Administrative Records

Skhillz Academy maintains an internal administrative record of the licenses it has issued, including in the staff administration area of the Skhillz Success Portal™, which it operates. This lets one company administer licensing, renewals, and support across its programs from one place.

For a School, that record holds the institution’s name and type, the number of seats licensed, the number of classes, staff, and enrolled students expressed as counts, the start and end dates of the license, and any licensing inquiry the School sent us.

It holds no student names, no student work, no scores, and no student login credentials. It therefore contains no personally identifiable information from education records, and this internal record is not a redisclosure of School Data for the purposes of Section 16.

10. Security

Skhillz Academy will maintain reasonable administrative, technical, and physical safeguards appropriate to the nature of School Data.

Safeguards are designed to include:

• role-based access controls;
• least-privilege access;
• authentication;
• encryption in transit;
• appropriate encryption at rest;
• logging and monitoring;
• vulnerability and patch management;
• incident-response procedures;
• personnel access restrictions;
• service-provider oversight.

11. Security Incident Notification

If Skhillz Academy confirms unauthorized access to or acquisition of protected School Data, Skhillz Academy will notify the School without unreasonable delay and, where practicable, within 72 hours after confirmation, unless law enforcement or applicable law requires a different timing.

The notice will include available information reasonably necessary for the School to understand and respond to the incident.

This contractual notification standard does not replace any shorter period required by applicable law.

12. Access, Correction, and FERPA Requests

Skhillz Academy will reasonably assist the School in responding to lawful requests to inspect, review, correct, export, or delete education records maintained through Skhillz Script™.

Where FERPA rights are exercised through the School, Skhillz Academy may direct the parent or eligible student to the School and will cooperate with the School’s authorized instructions.

13. Data Retention and Disposition

Skhillz Academy will retain School Data only for as long as needed to fulfill the contracted educational purpose or as otherwise instructed by the School or required by law.

Upon termination of the School’s agreement, or earlier upon valid School instruction, Skhillz Academy will return, delete, or de-identify School Data as required by the agreement.

Unless the School agreement specifies a shorter period:

• active-system School Data will ordinarily be deleted or returned within 90 days after the applicable disposition instruction;
• residual encrypted backups may persist for up to 180 days before normal overwrite;
• backup data will not be used for ordinary business purposes.

Upon request, Skhillz Academy will provide reasonable confirmation of completion of the applicable deletion process.

Permanent Deletion by an Authorized School or District Administrator

An authorized School or District Administrator may permanently delete an individual student record from within Skhillz Script™. Teachers cannot. Skhillz Academy does not delete individual student records on its own initiative.

The School should export any records it wishes to keep before deleting, because Skhillz Academy does not offer restoration of an individual deleted student record as a service.

What deletion does, stated precisely:

• the student profile, all practice progress, every recorded attempt, class enrollments, teacher notes, and any certificate are removed from the live system immediately and together;
• an audit entry is retained recording that a record existed and which account deleted it. It contains no student name, login code, or scores;
• residual encrypted backup copies may persist for up to 180 days before being overwritten through normal backup cycles, consistent with the retention terms above. Those backups are not used for ordinary business purposes and are not searched or restored to answer support requests;
• Skhillz Academy does not undertake to restore a deleted student record, and a School should treat deletion as irreversible for operational purposes.

Skhillz Academy may retain aggregate, de-identified product analytics derived from usage, as described in the Privacy Policy. That retained information contains no student name, login code, school-assigned identifier, class, teacher, school, or district, and is reported only in groupings large enough that an individual learner cannot be singled out.

14. De-Identified and Aggregate Data

Skhillz Academy may use data that has been properly de-identified so that it cannot reasonably be used to identify an individual student, where permitted by the institutional agreement and applicable law.

Skhillz Academy will not attempt to re-identify data that has been treated as de-identified for purposes of this Section.

15. Direct Control

Where required for the School’s FERPA disclosure, Skhillz Academy acknowledges that its use and maintenance of education records is subject to the School’s direct control through this Addendum, the institutional agreement, documented School instructions, and applicable privacy and security requirements.

16. Redisclosure

Skhillz Academy will not redisclose personally identifiable information from education records except to authorized subprocessors necessary to provide the contracted service and subject to appropriate restrictions, as directed or authorized by the School, or where legally permitted or required.

17. Conflict

If this Addendum conflicts with general Skhillz Script™ consumer terms regarding School Data, this Addendum controls for School Data.

A separately negotiated institutional privacy agreement may supersede this Addendum where it expressly states that it does so.

18. Contact

Skhillz Academy, LLC 1317 Edgewater Dr., Suite 458 Orlando, Florida 32804 Email: privacy@skhillzacademy.org