Short Answer, Inc. Data Processing Addendum

By using Short Answer, Inc. and associated services, you agree to the following data processing addendum.

Exhibit A

Short Answer, Inc. Data Protection Addendum

1. United States

With respect to Users in the United States, the following provisions shall apply:

1.1 Definitions. Capitalized words used in this Data Protection Addendum that are not expressly defined in this Data Protection Addendum have the meaning set forth in the Terms of Service.

a. “Data Protection Legislation” means applicable federal, state, local, and municipal laws and regulations in the United States that relate to the privacy, data protection or data security of Personal Data.

b. “Personal Data” means information about a specific individual that is provided, submitted, or otherwise made available to Short Answer by or on behalf of the School or any School Community member in connection with any of the Platform that constitutes “personal data”, “personal information”, “personally identifiable information” or similar term under applicable law.

c. “Process” shall have the same meaning as set out in the applicable Data Protection Legislation or if no such meaning or concept exists, it shall be the means by which Short Answer collects, uses, stores, discloses, or transfers Personal Data.

1.2 Compliance with Laws; Roles. Each Party shall comply with all Data Protection Legislation applicable to it in its respective Processing of Personal Data under the Terms of Service. For purposes of this DPA and as between the Parties, School is the controller of the Personal Data and Short Answer is the processor of such data.

1.3 Notices and Consents. School shall provide all notices and obtain all such consents required under applicable Data Protection Legislation (including, without limitation, consents required under the Family Education Rights and Privacy Act, 20 U.S.C. § 1232g and its implementing regulations, 34 C.F.R. Part 99 (together, “FERPA”)) from the Users to allow Short Answer to Process the Personal Data to provide the Platform and the Site and as otherwise described in the Terms of Service, including in this Data Protection Addendum (the “Notices and Consents”). School represents and warrants that it has obtained and will maintain the Notices and Consents for all Users through the entire term of the Terms of Service.

1.4 Details of Processing. Personal Data will be Processed for the purposes set forth in the Terms of Service and any applicable Order Forms.

1.5 Short Answer Obligations.

a. Short Answer shall implement and maintain reasonable administrative, technical and organizational measures that are designed to preserve the confidentiality and availability of Personal Data Processed by Short Answer via the Platform. Short Answer’s technical and organizational measures, as set forth in Short Answer’s [Information Security Overview], are available upon request and may be updated from time to time. School has reviewed such measures and agrees that the measures are appropriate taking into account the state of the art, the costs of implementation, nature, scope, context and purposes of the processing of Personal Data hereunder.

b. Short Answer Short Answer shall take reasonable steps to ensure that any employees who have access to the Personal Data are trained on applicable Data Protection Legislation and to ensure that employees do not disclose Personal Data for reasons other than those necessary for their Processing of the Personal Data.

c. Short Answer engages certain third-party entities to Process the Personal Data on Short Answer’s behalf ("Subprocessors"). Information about Subprocessors, including their functions and locations, is available at https://docs.google.com/document/d/1EEzuI3tPz6ZPnffVRqVLO6NNuPpCfj09jJUBjfq0lCM/edit?usp=sharing: (as may be updated by Short Answer from time to time, subject to Short Answer’s obligations contained in this Section 1.5) or such other website address as Short Answer may provide to School from time to time (the “Subprocessor Site”). Short Answer shall enter into a written contract with each Subprocessor containing terms that offer substantially similar levels of data protection obligations and protection for Personal Data as those set out in this Section. Short Answer shall be liable for all acts and omissions of any Subprocessor to the same extent Short Answer would be under the Terms of Service if they were Short Answer’s acts or omissions. School consents to Short Answer engaging the Subprocessors for the purposes set forth in the Terms of Service and this DPA. Notwithstanding the foregoing, where School has the right to do so under applicable Data Protection Legislation, (a) Short Answer will notify such School of the engagement of any new Subprocessor after the effective date of the Terms of Service by updating the Subprocessor Site at least 15 days before such Subprocessor Processes Personal Data; (b) if such School objects to such engagement in a written notice to Short Answer within 15 days after being notified of the engagement on reasonable grounds relating to the protection of Personal Data, such School and Short Answer will work together in good faith to consider a mutually acceptable resolution to such objection; (c) if the Parties are unable to reach a mutually agreeable resolution within a reasonable timeframe, such School may, within 30 days of its initial notification of its objection to Short Answer, as its sole and exclusive remedy, terminate the Terms of Service and cancel the Access to the Platform by providing written notice to Short Answer and pay Short Answer for all amounts due and owing under the Terms of Service as of the date of such termination; and (d) if such School does not object to Short Answer’s appointment of a Subprocessor during the objection period referred to in this Section 1.5(c), such School shall be deemed to have approved the engagement and ongoing use of that Subprocessor.

d. If Short Answer becomes aware of a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to the Personal Data (a “Security Incident”), Short Answer shall inform School, within a reasonable amount of time, taking into account the timeframes required by Data Protection Legislation, with respect to the Security Incident. Short Answer will provide reasonable information, cooperation, and updates of material developments to enable School to fulfill any data breach reporting obligations it may have under Data Protection Legislation. However, Short Answer provision of information and cooperation shall be at School’s cost and expense to the extent any Security Incidents were caused by School or its Users or Data Subjects (as defined below). Short Answer may take such other measures as it deems appropriate to mitigate the effects of the Security Incident.

1.6 Data Subject Inquiries. School shall be solely responsible for responding to and fulfilling any inquiries from Users and other data subjects, including parents and legal guardians of Users where the User is a student of School (collectively, “Data Subjects”) regarding their Personal Data in connection with the Processing under the Terms of Service, including any requests to exercise their rights under applicable Data Protection Legislation, and School shall handle all Data Subject inquiries in accordance with applicable Data Protection Legislation. School understands that Short Answer is not required to take any action in response to any requests from Data Subjects except to notify such Data Subjects to contact School. To the extent School cannot obtain a copy of, delete or amend the Personal Data directly within the Platform, School may contact Short Answer and Short Answer, with School’s express written permission and provided School has obtained the appropriate consent from the applicable Data Subject, will provide a copy of, delete or amend such Data Subject’s Personal Data in accordance with School’s instructions. To the extent legally permitted, School shall be responsible for reasonable costs arising out of Short Answer’s provision of assistance with School’s Data Subject requests. School shall indemnify, defend, and hold harmless Short Answer and its affiliates, subsidiaries, successors and assigns (and the officers, directors, employees, sublicensees, Schools, and agents of Short Answer and its affiliates, subsidiaries, successors, and assigns), from and against any and all losses, demands, liabilities, damages, fines, settlements, expenses, and costs (including without limitation reasonable attorneys’ fees and costs), arising from, in connection with, Short Answer complying with School’s instructions under this Terms of Service.

1.7 Authorized Disclosure of Personal Data.

a. School acknowledges and agrees that, at School’s request and reasonable cost, Short Answer may provide Personal Data to third-parties or other entities to whom School requests Short Answer provide Personal Data (e.g., State Board of Education). School shall make such a request to disclose Personal Data in writing (“Authorization”). School acknowledges and agrees that each Authorization will result in School electing, in its sole discretion, to transfer the Personal Data to the recipients that School selects.

b. The entities identified in Section 1.7(a) are collectively defined as “Recipients.”

c. School acknowledges that User Content may contain Personal Data and may be subject to Data Protection Legislation. School will hold Short Answer harmless, and not liable in any way, for Short Answer’s disclosure of Personal Data to the Recipients in accordance with an Authorization.

d. Short Answer makes no warranty (a) that the use of the Personal Data by the Recipient is valid or in compliance with applicable Data Protection Legislation and School’s organization’s policies or (b) that Personal Data will remain secure upon transfer to the Recipient, and disclaims any responsibility for the transfer. School acknowledges that the Personal Data will be provided on an “as is”, “as available” basis.

1.8 Data Retention. Short Answer will delete Personal Data within a reasonable amount of time after the termination or expiration of the Terms of Service, except that Short Answer may retain Personal Data as required by applicable legal requirements or as agreed by School. For the avoidance of doubt, the foregoing shall not apply to Anonymized Data (as defined below). Short Answer retains Personal Data and Student Data only for as long as reasonably necessary to provide the Service and fulfill its educational purposes. To minimize our data footprint, Short Answer automatically deletes accounts that have been inactive for a period of ten (10) consecutive months. An account is considered inactive when no User associated with the account has accessed the Service during that period. As part of this process, Short Answer will use commercially reasonable efforts to provide advance notice prior to deletion. Specifically, an email notification will be sent to the email address associated with the account after approximately eight (8) months of inactivity, and a final reminder email will be sent approximately seven (7) days prior to deletion. Upon deletion of an inactive account, associated Student Data and Personal Data are deleted from active systems, except where retention is required by applicable law, requested by the applicable School or district, or necessary for legitimate backup, security, audit, or compliance purposes, in accordance with any applicable Data Processing Agreement.

1.9 Short Answer Data. School acknowledges and agrees that Short Answer may create and derive performance, system, and operational data, aggregated data, anonymized data and de-identified data from Processing related to the Terms of Service, including in connection with the Platform (collectively, “Anonymized Data”). In generating such data, Short Answer shall (a) take reasonable measures to ensure that such data cannot be associated with a Data Subject, or where required by applicable Data Protection Legislation, (b) where required by applicable Data Protection Legislation, publicly commit to maintain and use such data in aggregated, anonymized or de-identified form, and (c) not attempt to reidentify such data, except as permitted under Data Protection Legislation.

1.10 Education Records. As applicable, to the extent Short Answer has access to “Education Records” and “Personally Identifiable Information” (as those terms are defined in FERPA) in connection with its provision of the Products: (a) School agrees that Short Answer has met the criteria for being a “School Official” with “Legitimate Educational Interests” (as those terms are used in FERPA) in such Education Records and Personally Identifiable Information; and (b) Short Answer agrees that such Education Records and Personally Identifiable Information will be used only for authorized purposes under the Terms of Service, and it will not redisclose such Education Records or Personally Identifiable Information except with Authorization from School and where such redisclosure is otherwise permitted under FERPA.

1.11 Compliance; Audits.

a. Taking into account the nature of the Processing of Personal Data by Short Answer and the information available to Short Answer, Short Answer shall provide such information and assistance to School as School may reasonably request (insofar as such information is available to Short Answer and the sharing thereof does not compromise the security, confidentiality, integrity or availability of any data Processed by Short Answer) to help School meet its obligations under Data Protection Legislation, including in relation to the security of Personal Data, the reporting and investigation of Security Incidents, the demonstration of School’s compliance with such obligations and the performance of any data protection assessments.

b. Subject to Section 1.11(c) below, Short Answer shall make available to School such information as School may reasonably request for Short Answer to demonstrate compliance with Data Protection Legislation and this DPA. Without limitation of the foregoing, School may conduct (in accordance with this Terms of Service), at its sole cost and expense, and Short Answer will reasonably cooperate with, reasonable audits (including inspections, manual reviews, automated scans and other technical and operational testing that School is entitled to perform under Data Protection Legislation), in each case, whereby School or a qualified and independent auditor appointed by School using an appropriate and accepted audit control standard or framework may audit Short Answer’s technical and organizational measures in support of such compliance and the auditor’s report is provided to School and Short Answer upon School’s request.

c. School shall give Short Answer reasonable advance notice of any such audits. Short Answer need not cooperate with any audit (a) performed by any individual or entity who has not entered into a non-disclosure agreement with Short Answer on terms acceptable to Short Answer in respect of information obtained in relation to the audit; (b) conducted outside of Short Answer’s normal business hours at the relevant site; or (c) on more than one occasion in any calendar year during the term of the Terms of Service, except for any additional audits that School is required to perform under Data Protection Legislation. The audit must be conducted in accordance with Short Answer’s safety, security or other relevant policies, must not impact the security, confidentiality, integrity or availability of any data Processed by Short Answer and must not unreasonably interfere with Short Answer’s business activities. School shall not conduct any scans or technical or operational testing of Short Answer’s applications, websites, services, networks or systems without Short Answer’s prior approval (which shall not be unreasonably withheld).

1.12 State Specific Privacy Addenda. If applicable, the Parties agree to the State Specific Data Protection Addenda for the applicable state(s).

1.13 Updates to this DPA. Notwithstanding anything to the contrary in the Terms of Service, Short Answer reserves the right to modify this DPA from time to time in its sole discretion and without School’s prior consent except where required by applicable law (“Updated DPA”). School agrees that any Updated DPA will be effective immediately upon Short Answer emailing the Updated DPA to School, unless Short Answer is required by applicable law to obtain School’s consent, in which case, such Updated DPA will be effective immediately upon the provision of such consent. Short Answer will also endeavor to notify School of any material revision to this DPA at least ten (10) days prior to such revision coming into effect, using School’s email address.

State Specific Addenda

Capitalized words used in this State Specific Data Protection Addendum but not defined herein have the meanings given to them in the Data Protection Addendum or in the Terms of Service.

California

With respect to Pupil Records (as defined in Cal. Educ. Code § 49073.1) that Short Answer processes on behalf of a School in California, the following provisions shall apply to the extent required by applicable law:

1. Pupil Records that Short Answer processes on behalf of School are the property of and under the control of School, except a User may retain possession and control of User-Generated Content where the User opens a personal account.

2. Short Answer shall limit its use of Pupil Records to those purposes specified in the Terms of Service, the Data Protection Addendum, and the Privacy Policy.

3. Procedures for the review and correction of Pupil Records shall be in accordance with the Data Protection Addendum.

4. Short Answer shall implement, maintain, and use reasonable measures to ensure the security and confidentiality of Pupil Records as specified in the Data Protection Addendum.

5. Procedures for notification in the event of unauthorized disclosure of Pupil Records shall be in accordance with the terms of the Data Protection Addendum.

6. Short Answer certifies that retention of Pupil Records shall be limited in accordance with the terms of the Data Protection Addendum.

7. Short Answer’s and School’s access to and use of Education Records and Personally Identifiable Information (as defined in FERPA) shall be subject to the terms of the Data Protection Addendum.

8. Short Answer shall not use Personal Data in Pupil Records to engage in targeted advertising.

With respect to Personal Information (as defined in the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the “CCPA”)) that is subject to the CCPA that Short Answer processes on behalf of a School in California, the following provisions shall apply to the extent required by applicable law:

1. The Parties acknowledge and agree that, to the extent School discloses any Personal Information to Short Answer, it does so for the limited and specific purpose of providing the Platform to School. Accordingly, Short Answer shall Process Personal Information only as necessary to provide the Platform, as required for the operation of the business of School, and to perform Short Answer’s other obligations under the Terms of Service or the Data Protection Addendum.

2. Short Answer shall comply with all obligations under the CCPA applicable to service providers (as defined in the CCPA) and provide the same level of privacy protection to any Personal Information as provided under the CCPA.

3. Short Answer shall not (a) sell or share any Personal Information (including as “sale” and “share” are defined under the CCPA); (b) retain, use, or disclose any Personal Information for any purpose other than (i) to provide the Platform to School, (ii) for a commercial purpose other than providing the Platform, or (iii) as otherwise permitted under the CCPA or under the Terms of Service or the Data Protection Addendum; or (c) combine Personal Information with any other personal information that Short Answer obtained outside of the provision of the Platform to School. For the avoidance of doubt, the foregoing prohibits Short Answer from retaining, using, or disclosing Personal Information outside of the direct business relationship between Short Answer and School except as otherwise permitted under the CCPA or under the Terms of Service or the Data Protection Addendum.

4. Short Answer shall notify School of any new Subprocessors it engages prior to such engagement in accordance with the Data Protection Addendum.

If Short Answer makes a determination that it can no longer meet its obligations under this Section or the CCPA, it shall notify School promptly but in no event later than five (5) business days after Short Answer makes such a determination. Short Answer acknowledges and agrees that School has the right to: (i) take reasonable and appropriate steps to help to ensure that Short Answer uses Personal Information in a manner consistent with School’s CCPA obligations, and (ii) upon notice, take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Information.

Colorado

With respect to Student Personally Identifiable Information (as defined in Colo. Rev. Stat. Ann. § 22-16-103) that Short Answer processes on behalf of a School in Colorado, the following provisions shall apply to the extent required by applicable law:

1. Short Answer shall comply in all material respects with the requirements of Colo. Rev. Stat. § 22-16-108 with regard to the provision of clear information regarding collection, use, and disclosure of Student Personally Identifiable Information, as specified in the Data Protection Addendum and Privacy Policy.

2. Short Answer shall comply in all material respects with Colo. Rev. Stat. § 22-16-109 with regard to the collection, use, and disclosure of Student Personally Identifiable Information, as specified in the Data Protection Addendum and Privacy Policy.

3. Short Answer shall comply in all material respects with the requirements of Colo. Rev. Stat. § 22-16-110 with regard to data security and retention of Student Personally identifiable information, as specified in the Data Protection Addendum and Privacy Policy.

Connecticut

With respect to Student Information, Student Records, and Student-generated Content (as those terms are defined in Conn. Gen. Stat. § 10-234aa) (collectively, “CT Student Data”) that Short Answer processes on behalf of a School in Connecticut, the following provisions shall apply to the extent required by applicable law:

1. CT Student Data that Short Answer processes on behalf of School are School Data and under the control of School.

2. Short Answer retention of CT Student Data shall be in accordance with the Data Protection Addendum and Privacy Policy.

3. Short Answer shall limit its use of CT Student Data to those purposes specified in the Terms of Service, Data Protection Addendum, and Privacy Policy.

4. Procedures for the review and correction of CT Student Data shall be in accordance with the Privacy Policy.

5. Short Answer shall implement, maintain, and use reasonable measures to ensure the security and confidentiality of CT Student Data as specified in the Data Protection Addendum.

6. Procedures for notification in the event of unauthorized disclosure of CT Student Data shall be in accordance with the terms of the Data Protection Addendum.

7. Short Answer and School access to and use of Education Records and Personally Identifiable Information (as defined in FERPA) shall be subject to the terms of the Data Protection Addendum.

8. Laws of the state of Connecticut shall govern rights and duties with regard to CT Student Data, as specified in the Terms of Service.

9. In the event that any provision or the application of the Terms of Service or Data Protection Addendum is held invalid by a court of competent jurisdiction, severability of terms shall be in accordance with the Terms of Service.

District of Columbia

With respect to Personally Identifiable Student Information (as defined in D.C. Code § 38-831.01(14)) that Short Answer processes on behalf of a School in the District of Columbia, the following provisions shall apply to the extent required by applicable law:

1. [Procedures for notification in the event of unauthorized disclosure of Personally Identifiable Student Information shall be in accordance with the terms of the Data Protection Addendum.]

2. Personally Identifiable Student Information that Short Answer processes on behalf of School are School Data and under the control of School.

3. [Retention of Personally Identifiable Student Information shall be limited in accordance with the terms of the Data Protection Addendum.]

Idaho

With respect to Student Data (as defined in Idaho Code Ann. § 33-133) that Short Answer processes on behalf of a School in Idaho, the following provisions shall apply to the extent required by applicable law:

1. Short Answer is permitted to use de-identified data, which may include Aggregated Data, as disclosed in the Data Protection Addendum and Privacy Policy, as applicable.

2. Short Answer is permitted to use Student Data for secondary uses with consent of a student’s parent or guardian and as disclosed in accordance with the Data Protection Addendum and Privacy Policy, as applicable.

3. Short Answer shall not use (including for marketing or advertising purposes) or sell Student Data except as specified in the Data Protection Addendum or with express prior parental consent.

Illinois

With respect to Covered Information (as defined in 105 Ill. Comp. Stat. Ann § 85/5) that Short Answer processes on behalf of a School in Illinois, the following provisions shall apply to the extent required by applicable law:

1. The types of Covered Information for which Short Answer may act as a processor on behalf of School under the Terms of Service are specified in the Data Protection Addendum and Privacy Policy, as applicable.

2. The Platform provided to School by Short Answer are specified in the Terms of Service.

3. Short Answer and School access to and use and disclosure of Education Records and Personally Identifiable Information (as defined in FERPA) shall be subject to FERPA, in accordance with the terms of the Data Protection Addendum.

4. Procedures in the event of a security breach shall be in accordance with the terms of the Data Protection Addendum; provided that, if the security breach is attributed to Short Answer, any costs and expenses incurred by the School in investigating and remediating the breach will be allocated between Short Answer and the School.

5. Short Answer’s retention of Covered Information shall be in accordance with the Data Protection Addendum and Privacy Policy, as applicable.

6. Short Answer agrees that School may publish [a redacted copy] of the Terms of Service and Data Protection Addendum on its website and/or make the documents available for inspection by the general public at its administrative office, as applicable.

New York

With respect to personally identifiable information (as defined in N.Y. Comp. Codes R. & Regs. tit. 8, § 121.1(m)) (“NY PII”) that Short Answer processes on behalf of a School in New York, the following provisions shall apply to the extent required by applicable law (for the avoidance of doubt, NY PII is a subset of Personal Data as defined in the Terms of Service):

1. Short Answer certifies that its technologies, safeguards and practices align with the NIST Cybersecurity Framework.

2. Short Answer shall comply in all material respects with School’s data security and privacy policy and applicable state and federal laws.

3. Short Answer shall limit access to NY PII it processes on behalf of School in accordance with the Data Protection Addendum and Privacy Policy.

4. Short Answer shall limit its use of NY PII to those purposes specified in the Terms of Service, Data Protection Addendum, and Privacy Policy.

5. Short Answer shall not disclose NY PII except in accordance with the Data Protection Addendum and Privacy Policy.

6. Short Answer shall implement, maintain, and use reasonable measures that are designed to ensure the security and confidentiality of NY PII as specified in the Data Protection Addendum.

7. Short Answer shall use encryption to protect electronic NY PII in transit or in storage.

8. Short Answer shall not sell NY PII and shall limit its use and disclosure of NY PII in accordance with the Data Protection Addendum and Privacy Policy.

9. Data Security and Privacy Plan

a. Short Answer will implement applicable data security and privacy requirements as specified in the Data Protection Addendum.

b. Short Answer shall implement, maintain, and use reasonable measures that are designed to ensure the security and confidentiality of NY PII as specified in the Data Protection Addendum.

c. A parent’s bill of rights is incorporated as part of this addendum [as Exhibit XX], and Short Answer shall comply in all material respects with its terms.

d. Short Answer shall train its officers and employees on applicable laws prior to granting access to User data as specified in the Data Protection Addendum.

e. Short Answer shall require that Subprocessors protect NY PII and manage breaches and unauthorized disclosure as specified in the Data Protection Addendum.

f. Short Answer shall manage data security and privacy incidents as specified in the Data Protection Addendum. Procedures for notification in the event of breaches and unauthorized disclosures shall be in accordance with the terms of the Data Protection Addendum.

g. Short Answer’s retention of NY PII shall be limited in accordance with the Data Protection Addendum.

Utah

With respect to Student Data (as defined in Utah Code Ann. § 53E-9-301(17)) that Short Answer processes on behalf of a School in Utah, the following provisions shall apply to the extent required by applicable law:

1. Short Answer shall limit its collection, use, storage, and sharing of Student Data to those purposes specified in the Terms of Service, Data Protection Addendum, and Privacy Policy, as applicable.

2. Processing of Student Data by Subprocessors shall be in accordance with the Data Protection Addendum and Privacy Policy, as applicable.

3. Short Answer’s retention of Student Data shall be limited in accordance with the terms of the Terms of Service, Data Protection Addendum, and Privacy Policy, as applicable.

4. Short Answer shall not use Student Data for purposes other than those specified in the Terms of Service and Data Protection Addendum and except as permitted by Utah Code Ann. § 53E-9-309(4) or as requested by the School.

5. Short Answer agrees that, at School’s request, School or School’s designee may conduct an audit of Short Answer, in accordance with reasonable and mutually agreed-upon procedures, to verify compliance with the Terms of Service and Data Processing Terms of Service to the extent required by Utah Code Ann. § 53E-9-309.

Virginia

With respect to Student Personal Information (as defined in Va. Code Ann. § 22.1-289.01) that Short Answer processes on behalf of a School in Virginia, the following provisions shall apply to the extent required by applicable law:

1. The types of Student Personal Information for which Short Answer may act as a processor on behalf of School shall be specified in the Data Protection Addendum and Privacy Policy, as applicable.

2. Privacy of Student Personal Information processed by Short Answer on behalf of School shall be subject to the Data Protection Addendum and Privacy Policy, as applicable, and notification of material changes shall be in accordance with the Data Protection Addendum.

3. Short Answer shall maintain reasonable measures to ensure the security, privacy, confidentiality, and integrity of Student Personal Information as specified in the Data Protection Addendum.

4. Procedures for access to and the review and correction of Student Personal Information shall be in accordance with the Data Protection Addendum and Privacy Policy, as applicable.

5. Short Answer shall not collect, maintain, use, or share Student Personal Information except for purposes specified in the Terms of Service, Data Protection Addendum, and/or Privacy Policy, except with consent of the School or student’s parent or legal guardian, as applicable.

6. Short Answer shall require that its Subprocessors of Student Personal Information on behalf of School comply with Short Answer’s policies and security measures in accordance with the Data Protection Addendum.

7. Short Answer’s retention of Student Personal Information shall be limited in accordance with the terms of the Data Protection Addendum and Privacy Policy, as applicable.

8. Short Answer shall not use Student Personal Information to engage in targeted advertising to students.

9. Short Answer shall not use Student Personal Information to create a personal profile of a student, except for the purposes specified in the Terms of Service, Data Protection Addendum, and Privacy Policy, as applicable.

10. Short Answer shall not knowingly sell Student Personal Information except the extent that Short Answer is sold to or acquired by a successor entity that purchases, merges with, or otherwise acquires Short Answer