Important: This Addendum applies automatically, without further signature, wherever the Client is an educational agency or institution that processes student data through the Licensed Product. Unless a written agreement states otherwise, the latest terms of this document apply to all new and renewing Subscriptions from the effective date below.

Student Data Protection Addendum

Version 1.0  |  Effective Date: November 30, 2026

This Student Data Protection Addendum (this “SDPA”) forms part of the Master Service Agreement (“MSA”) between ID123 Inc. (“Service Provider”) and the educational agency or institution subscribing to the Licensed Product (“Client” or “Educational Agency”), together with the Data Processing Addendum (“DPA”) and applicable Product Addendum. The Educational Agency is the Customer of Record as defined in the MSA. It applies automatically, without further signature, wherever Client is a school, school district, local or state educational agency, college, university, or other institution subject to student privacy law, and Client processes Student Data through the Licensed Product.

Capitalized terms not defined here have the meanings given in the MSA or DPA.

1. Definitions

1.1 “Student Data” means personally identifiable information relating to a student that is provided to, or collected by, the Service Provider through the Licensed Product at the direction of the Educational Agency. Student Data includes Education Records and, where applicable, “student data”, “covered information”, “student personally identifiable information” and equivalent terms defined in applicable student privacy law.

1.2 “Education Records” has the meaning given in the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g and 34 C.F.R. Part 99 (“FERPA”).

1.3 “School Official” has the meaning given in 34 C.F.R. § 99.31(a)(1).

1.4 “De-identified Data” means data from which all direct and indirect identifiers have been removed such that there is no reasonable basis to believe the information can be used to identify an individual student.

1.5 “Targeted Advertising” means presenting advertisements selected on the basis of information obtained or inferred over time from a student’s online activity. It does not include advertising to a student at an online location based on that student’s current visit, or in response to a single search query, provided no persistent profile is retained.

2. FERPA — School Official Designation

2.1 The Educational Agency designates the Service Provider as a “School Official” with a “legitimate educational interest” in Education Records, within the meaning of 34 C.F.R. § 99.31(a)(1)(i)(B), for the purpose of performing an institutional service or function for which the Educational Agency would otherwise use its own employees — namely the creation, issuance, management and verification of student identification credentials.

2.2 The Service Provider will: (a) perform that institutional service or function under the direct control of the Educational Agency with respect to the use and maintenance of Education Records; (b) use Education Records only for the purposes authorized by this Agreement; and (c) not redisclose Education Records to any third party, other than to sub-processors engaged in accordance with the DPA to perform the Services, except as expressly permitted by this SDPA or as directed in writing by the Educational Agency, and in either case only in a manner consistent with 34 C.F.R. § 99.33(a).

2.3 The Educational Agency is responsible for determining whether its disclosure to the Service Provider is made under the School Official exception, the Directory Information exception, or with written parental or eligible student consent, and for issuing any annual notification required by 34 C.F.R. § 99.7.

2.4 Requests by a parent or eligible student to inspect, review or seek amendment of Education Records are the responsibility of the Educational Agency. The Service Provider will refer any such request it receives to the Educational Agency and will assist in accordance with Section 6 of the DPA.

2.5 Student Wallet Data. Where a student’s ID Wallet account is registered with an email address in the Educational Agency’s domain, the Service Provider Processes that account information, device information and any support request the student submits directly on behalf of the Educational Agency, and that data is Student Data for the purposes of this SDPA. Where the Educational Agency is a PreK–12 school or school district, a student’s ID Wallet account is Processed on behalf of the Educational Agency whatever email address it uses. Subject to the Educational Agency’s identification of its student card templates and email domains as described in Section 9.4 of the Product Addendum, the student may not register with or move to a personal email address. Where the Educational Agency is another kind of institution and a student who meets the requirements in the EULA registers with, or moves the account to, a personal email address, the Service Provider becomes an independent controller only of the student’s ID Wallet account information, as described in Sections 9.3 and 9.4 of the Product Addendum, and does not control any Student Data provided by the Educational Agency. Digital ID Card records issued by the Educational Agency remain Student Data in either case.

3. Ownership and Control of Student Data

As between the parties, Student Data is and remains the property of, and under the control of, the Educational Agency and, as applicable, the student or the student’s parent or guardian. The Service Provider acquires no right in Student Data other than the limited right to process it as necessary to provide the Licensed Product and Services.

4. Permitted and Prohibited Uses

4.1 The Service Provider will process Student Data solely to provide the Licensed Product and Services to the Educational Agency, to maintain and improve the security and operational integrity of the Licensed Product, to respond to support requests, and to comply with law.

4.2 The Service Provider will not: (a) sell, rent, lease, trade or otherwise disclose Student Data for consideration, except in connection with a merger, acquisition or asset sale in which the successor is bound by obligations no less protective than this SDPA; (b) use Student Data for Targeted Advertising, or disclose it to any party for that purpose; (c) use Student Data to create a profile of a student except in furtherance of the educational purposes authorized by the Educational Agency; (d) use Student Data for any commercial purpose unrelated to provision of the Licensed Product; or (e) re-identify De-identified Data, or permit any third party to do so.

4.3 The Service Provider may use De-identified Data only as permitted by Section 7.4.3 of the MSA, provided it does not disclose De-identified Data with knowledge that the recipient intends to re-identify it, and does not attach De-identified Data to a student’s record.

4.4 Sub-processor Derived Data. Notwithstanding Sections 4.1 to 4.3, a Sub-processor that holds Student Data in accordance with the DPA may derive from it statistics, classifications and frequently occurring terms only if the derived data (a) meets the definition of De-identified Data in Section 1.4, (b) contains no verbatim Student Data, (c) is not disclosed or used with knowledge that the recipient intends to re-identify it, and (d) is described for that Sub-processor on the Sub-processors page. The Service Provider will not otherwise permit a Sub-processor to use Student Data for any purpose other than performing the Services.

5. Children’s Online Privacy Protection Act (COPPA)

5.1 Where the Licensed Product is used to issue credentials to students under 13 years of age, the Educational Agency represents that it has the authority to provide, and does provide, the consent required under COPPA, 15 U.S.C. §§ 6501–6506 and 16 C.F.R. Part 312, on behalf of the parents of those students, in accordance with FTC guidance permitting school-based consent for services used solely for an educational purpose.

5.2 The Service Provider collects from students only the information reasonably necessary to issue and maintain a credential, and does not condition participation on the disclosure of more information than is reasonably necessary.

5.3 On request from the Educational Agency, or from a parent through the Educational Agency, the Service Provider will disclose the types of personal information collected from a student, permit its review, and delete it.

6. Protection of Pupil Rights Amendment (PPRA)

Where the Educational Agency configures a form field within the mobile application to collect information from students, the Educational Agency is responsible for ensuring that the field does not solicit information protected by 20 U.S.C. § 1232h without the notice and consent that statute requires.

7. SOPIPA and Equivalent State Laws

The restrictions in Section 4, the security program referred to in Section 13 and the deletion provisions in Section 12 are intended to satisfy California Business and Professions Code §§ 22584–22585 (SOPIPA) and substantially equivalent statutes in other states.

8. New York Education Law § 2-d and 8 NYCRR Part 121

Where the Educational Agency is a New York educational agency, this Section applies and, to the extent of any conflict, controls.

8.1 The Service Provider will maintain administrative, operational and technical safeguards and practices that align with the NIST Cybersecurity Framework.

8.2 The Service Provider will: (a) limit internal access to Student Data to those individuals with a legitimate educational interest; (b) not use Student Data for any purpose other than those authorized in the Agreement; (c) not disclose Student Data to any other party without the prior written consent of the parent or eligible student, except to the Service Provider’s authorized representatives, such as sub-processors, to the extent they are carrying out the Agreement, or as required by statute or court order with notice to the Educational Agency; (d) maintain reasonable safeguards against unauthorized access; and (e) use encryption to protect Student Data in motion and at rest.

8.3 The Service Provider will notify the Educational Agency of any breach or unauthorized release of Student Data in the most expedient way possible and without unreasonable delay, and in any event no later than seven (7) calendar days from discovery, and will cooperate with the Educational Agency and law enforcement in investigating the incident. Where the incident is attributable to the Service Provider, it will reimburse the Educational Agency for the reasonable costs of notifying affected parents, eligible students, teachers and principals.

8.4 The supplemental information required by 8 NYCRR § 121.3 is set out in Exhibit A, which the Educational Agency may publish with its Parents Bill of Rights for Data Privacy and Security.

9. Illinois Student Online Personal Protection Act (SOPPA), 105 ILCS 85

Where the Educational Agency is an Illinois school or district, this Section applies and, to the extent of any conflict, controls.

9.1 The Service Provider’s published Sub-processor list identifies each third party with access to Student Data and the location in which it processes data.

9.2 The Service Provider will notify the Educational Agency of any breach of Student Data in the most expedient time possible and without unreasonable delay, and in any event no later than thirty (30) calendar days from determination that a breach occurred, and will provide the information the Act requires. The Service Provider’s notification commitment under MSA Section 7.8.1 applies in addition to this statutory outer limit.

9.3 The Service Provider will delete Student Data on request of the Educational Agency within the periods set out in Section 12.

9.4 The Service Provider will provide the Educational Agency, on request, with the information necessary for it to satisfy its own publication obligations under 105 ILCS 85/27.

10. California Education Code § 49073.1

Where the Educational Agency is a California local educational agency, the provisions required by Education Code § 49073.1(b) are those in Section 2 (FERPA), Section 3 (ownership and control), Section 4 (use of Student Data and Targeted Advertising), Section 13 (security and breach notification) and Section 12 (retention and deletion), together with the following:

10.1 Pupils may retain possession and control of their own pupil-generated content through the Educational Agency, which may export it at any time using the Licensed Product’s export functions.

10.2 The Service Provider will notify affected pupils and parents of an unauthorized disclosure of pupil records through, and in coordination with, the Educational Agency.

11. Colorado Student Data Transparency and Security Act

Where the Educational Agency is a Colorado local education provider, the Service Provider will provide on request the information the Educational Agency needs to publish the inventory of student personally identifiable information required by C.R.S. § 22-16-101 et seq. The restrictions in Section 4 and the deletion provisions in Section 12 apply.

12. Retention, Return and Deletion

12.1 Student Data is retained only for so long as necessary to provide the Services to the Educational Agency, and in any event subject to the limits in Section 7.2.4 of the MSA.

12.2 During the Term, the Educational Agency may delete Student Data at any time through the ID Management System. On expiration or termination, Student Data is returned or deleted in accordance with Sections 10.3.2 and 10.3.3 of the MSA.

12.3 Where a specific state statute requires deletion within a shorter period on request of a parent, student or Educational Agency, that period controls.

13. Security and Breach Notification

13.1 The Service Provider maintains the information security program described in Section 7.5 of the MSA and Appendix 2 of the DPA.

13.2 Security Incidents affecting Student Data are notified in accordance with Section 7.8 of the MSA and, where they apply, Sections 8.3 and 9.2.

14. Order of Precedence

This SDPA prevails over the Data Processing Addendum and the MSA to the extent that it specifically addresses the matter in conflict, consistent with Section 1.3 of the MSA, and a state-specific Section of this SDPA applicable to the Educational Agency prevails over the remainder of this SDPA. In all other respects the order of precedence in Section 1.3 of the MSA applies.

Exhibit A — Supplemental Information for the Parents Bill of Rights (8 NYCRR § 121.3)

Required disclosure ID123 response
Exclusive purposes for which Student Data will be used To create, issue, display, manage and verify student identification credentials, and to provide related support.
How the Service Provider will ensure subcontractors abide by data protection and security requirements Every subcontractor with access to Student Data is bound by written data protection obligations in accordance with Section 5.4 of the Data Processing Addendum. The current list is published at id123.io/terms/dpa/subprocessors/.
When the agreement expires and what happens to Student Data on expiration On expiration or termination of the subscription, Student Data may be exported by the Educational Agency and is then securely deleted within 30 days, or within any longer agreed exit period up to 90 days. Deletion is certified in writing on request.
Whether and how a parent or eligible student may challenge the accuracy of Student Data Requests are made to the Educational Agency, which has self-service access to correct Student Data in the ID Management System. The Service Provider will assist on request.
Where Student Data will be stored, described so as not to compromise security In encrypted storage within the cloud data region in which the Educational Agency’s Account is hosted, with replicas and backups held only in the same country. New York educational agencies are served from a data region located in the United States.
Security protections taken to ensure Student Data will be protected Encryption at rest and in transit, least-privilege access controls, multi-factor authentication, and the further measures described in Appendix 2 of the Data Processing Addendum, aligned with the NIST Cybersecurity Framework.