Data Processing Agreement

Linked from the school onboarding flow. Schools are asked to review and accept this as part of approval.

This Data Processing Agreement ("DPA") forms part of the Terms of Service between [LEGAL ENTITY NAME] ("PagePledge," "we") and the School ("you," "the Controller") when the School uses PagePledge to process Personal Information.

1. Roles

• The School is the Data Controller. The School determines what personal information to upload to PagePledge (student rosters), who has access (teachers, admins), and the purposes for which it is used (running a read-a-thon).
• PagePledge is the Data Processor. PagePledge processes personal information solely on the School's behalf and in accordance with these Terms.

2. Scope of processing

PagePledge processes the following categories of personal information on behalf of the School:

• Students: first name, last name, classroom assignment, grade, reading minutes logged, donations received
• Staff: name, email, role at the school
• Parents: email address (only after they activate a student), reading minutes they log
• Donors: name, email, billing address, donation amounts, public messages

PagePledge processes this information for the following purposes only:

• Running the School's read-a-thon campaigns
• Generating take-home activation sheets
• Accepting and recording donations
• Displaying leaderboards and student pages
• Sending transactional and digest emails as described in the Privacy Policy

3. PagePledge's obligations

PagePledge agrees to:

1. Process personal information only on the School's documented instructions (which include the use of the Service as described in these Terms).
2. Ensure that staff authorized to access personal information are bound by confidentiality.
3. Implement appropriate technical and organizational security measures, including:
   • Encryption of sensitive data at rest and in transit
   • Access controls limiting who can view production data
   • Audit logging of sign-in events and administrative actions
   • Regular backups
4. Assist the School in responding to requests from individuals to exercise their PIPEDA rights (access, correction, deletion, etc.).
5. Notify the School without undue delay (within 72 hours where feasible) of any Personal Information Breach affecting the School's data.
6. Delete or return all personal information at the School's request upon termination, subject to any legal retention requirements.
7. Engage sub-processors only as disclosed in the Privacy Policy and under equivalent contractual terms.

4. Sub-processors

PagePledge uses the following sub-processors to deliver the Service:

PagePledge will notify the School before adding or replacing a sub-processor. The School may object to a new sub-processor in good faith; if PagePledge cannot resolve the objection, the School may terminate the agreement.

5. School's obligations

The School agrees to:

1. Obtain any necessary parental consent or notification required by its local school board, provincial ministry, or other applicable regulations before uploading student information to PagePledge.
2. Ensure uploaded data is accurate and limited to what is necessary for the campaign.
3. Promptly update or delete information when students leave the school or when corrections are needed.
4. Maintain the confidentiality of administrative credentials and promptly revoke access when staff leave.
5. Use the Service in compliance with PIPEDA, Quebec Law 25 (if applicable), and any provincial education privacy rules.

6. Data transfers

PagePledge stores data primarily in Canada. Some sub-processors may transfer data to the United States under standard contractual safeguards. The School acknowledges and consents to this.

7. Term and termination

This DPA remains in effect for as long as the School uses PagePledge. Upon termination, PagePledge will archive the School's data for 2 years, after which it will be permanently deleted, unless the School requests earlier deletion in writing.

8. Liability

Liability under this DPA is subject to the limitations in the Terms of Service.

9. Contact for privacy matters

For all data protection and privacy matters:
privacy@pagepledge.com