# Data Privacy Agreement Template (Draft)

**Status:** Draft pending counsel review. Not a signed contract until both parties execute a counsel-approved version.

**Parties:** Learning Style Quiz ("Processor") and the educational institution named below ("Controller").

**Scope:** Use of the Teams product for School or Department plans, including rostering participants, quiz administration, results dashboards and playbook delivery.

## 1. Roles

The Controller determines the purposes of processing student or learner data. The Processor processes that data only to provide the Teams Service described in the product Terms.

## 2. Categories of data

For K-12: first name, last initial, quiz answers and derived learning-style results, group membership, and related operational logs.

For University Department plans: first name, last name, email, quiz answers and results, group membership, and related operational logs.

No advertising identifiers are collected from participants for marketing.

## 3. Processor obligations

- Process personal data only on documented instructions from the Controller (including configuration inside the Teams product).
- Ensure personnel are bound to confidentiality.
- Implement appropriate technical and organizational measures (access control, encryption in transit, password hashing, org-scoped queries, audit logging of admin actions).
- Not sell personal data or use participant data for advertising.
- Delete or return personal data after the retention periods in the Privacy Policy (archived participants hard-deleted 12 months after archive; organization deletion after a 30-day grace window), unless law requires retention.
- Notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller data.

## 4. Subprocessors

Current subprocessors include hosting, Stripe (billing for the Controller's subscription) and Mailgun (transactional email). The Processor will keep a current list available on request.

## 5. Assistance

The Processor will reasonably assist the Controller with data subject requests that the Controller cannot fulfill alone inside the product, and with security and DPIA questions related to the Service.

## 6. International transfers

Describe transfer mechanisms applicable to the Controller's jurisdiction once counsel has reviewed hosting locations.

## 7. Term

This agreement tracks the Controller's paid School or Department subscription and survives termination for so long as the Processor retains Controller personal data.

---

Controller legal name: _______________________________

Controller signatory: _______________________________ Date: __________

Processor signatory: _______________________________ Date: __________