# WYG Student Data Privacy Addendum — Illinois Draft **Status:** Attorney review required before use **Agreement:** This addendum is attached to the WYG School Pilot Agreement between [SCHOOL] and [WYG LEGAL ENTITY]. **Effective date:** [DATE] ## 1. Purpose and order of precedence This Student Data Privacy Addendum ("DPA") governs WYG's processing of student data for the School-authorized football instruction and assessment Service. It is intended to address Illinois SOPPA (105 ILCS 85), FERPA, COPPA where applicable, and other requirements identified by the School. If this DPA conflicts with general online terms, this DPA controls for School Data. ## 2. Definitions "School Data" means information supplied by or for the School or generated through authorized use. "Student Data" means School Data linked or reasonably linkable to a student, including SOPPA covered information and FERPA-protected education-record information when applicable. "Process" means collect, access, maintain, use, disclose, transmit, or delete. "Service Provider" means a contractor used by WYG to operate the Service. ## 3. Service and data categories WYG provides private roster enrollment, football playbook instruction, full-concept testing, answer review, and readiness reporting. Data categories may include: display name or School roster identifier; team-scoped username; protected credential; optional email; role, position, and optional jersey number; program and team membership; playbooks and uploads; assignments; route drawings and selected answers; scores, attempts, timestamps, review notes and decisions; support communications; session, access, device-class, and administrative audit information. The School will not provide health, disability, biometric, precise-location, government-identifier, financial, or unrelated academic information unless the parties amend this DPA in writing. ## 4. School instruction and FERPA direct control WYG acts as a School official with a legitimate educational interest solely to perform an institutional service the School would otherwise perform through employees or other authorized personnel. WYG is under the School's direct control with respect to use and maintenance of education records. WYG will use Student Data only for the authorized purpose and will not redisclose it except as the School directs, this DPA permits, or law requires. The School may direct WYG to add, deactivate, export, correct, restrict, return, or delete Student Data. WYG will provide information reasonably needed for the School to monitor compliance. ## 5. Prohibited conduct WYG will not knowingly: use Student Data for targeted advertising; build a student profile except for the School-authorized educational purpose; sell or rent Student Data; use Student Data for an unrelated commercial purpose; claim ownership of School Data; disclose Student Data except as authorized; or condition a student's participation on providing unnecessary information. WYG will not use Student Data to train a general-purpose artificial-intelligence model. ## 6. COPPA school context If the Service collects personal information online from a child under 13 based on School authorization, WYG will limit processing to the School-benefit educational context and no other commercial purpose. WYG will give the School the notice required of WYG, enable School review and deletion, and permit the School to stop further use or collection. WYG remains responsible for COPPA obligations applicable to WYG and will not represent that the School bears that responsibility. ## 7. Access and security WYG will use reasonable security procedures designed to protect Student Data from unauthorized access, destruction, use, modification, or disclosure. Measures include program-scoped authorization, role controls, hashed credentials and tokens, revocable sessions and invitations, private file access, server-side grading keys, immutable testing evidence, administrative audit events, production change control, and provider-managed encrypted transport and storage controls. Access by WYG personnel is limited to an authorized operational need and subject to confidentiality. Before launch, WYG will complete the verification gates identified in the Security Summary and provide any material findings requested by the School. ## 8. Service providers and disclosure WYG may disclose Student Data to listed Service Providers only as needed to deliver the Service. WYG will contractually restrict each provider from using Student Data for another purpose, prohibit further disclosure except to deliver the contracted service, and require reasonable security. WYG will provide the School a current list at the beginning of the Illinois fiscal year and calendar year and when a material change occurs. Current providers are listed in WYG's Subprocessor List. Government or legal requests will be reviewed for validity. Unless prohibited, WYG will notify the School before disclosure and will disclose only what is legally required. ## 9. Student and parent rights support WYG will support the School's response to authorized access, electronic-copy, correction, restriction, and deletion requests. Parents and students should ordinarily direct requests to the School so the School can verify authority and applicable recordkeeping obligations. When the School notifies WYG of a factual inaccuracy maintained by WYG, WYG will correct it and confirm completion within the period required by applicable law, and no later than 90 calendar days for a SOPPA correction notice. ## 10. Retention, return, and deletion Student Data will be retained only while needed for the authorized Service and according to the signed Data Retention Schedule. When the School states that data is no longer needed, WYG will export or transfer it as requested and complete deletion within [30] calendar days, unless the School selects a different period or law requires retention. WYG will provide written deletion confirmation. Data subject to a documented legal hold will be isolated, access-restricted, and deleted when the hold ends. ## 11. Security incidents WYG will maintain the Breach Notification Procedure. For a breach of Student Data, WYG will notify the School without unreasonable delay after determination, target initial notice within 72 hours, and in no event later than the maximum period applicable to WYG under Illinois SOPPA. Notice will include known timing, affected data and students, likely consequences, containment, mitigation, contact information, and updates. WYG will preserve evidence and reasonably assist the School's investigation and required notices. If a breach is attributable to WYG, investigation, remediation, legal, notice, credit-monitoring, and regulatory cost allocation will be: [COUNSEL AND PARTIES TO COMPLETE BEFORE SIGNATURE]. ## 12. Audit and compliance assistance On reasonable written request, WYG will provide relevant policies, service-provider information, incident history applicable to the School, data categories, and evidence of controls. Audit method, confidentiality, scope, frequency, and cost: [COUNSEL TO COMPLETE]. WYG will notify the School if it can no longer meet a material DPA obligation and will cooperate on remediation or suspension. ## 13. Changes, sale, and termination WYG will not materially change Student Data practices during the pilot without School authorization and required notice. A successor in a merger, acquisition, or sale must assume this DPA for previously collected Student Data, or WYG will return/delete it as the School directs. At termination, the Export and Deletion Procedure applies. ## 14. School publication and contacts The parties acknowledge that Illinois public schools may need to post the written agreement, operator details, data elements, service-provider list, parent procedure, and breach information. The School may publish this DPA with only legally permitted redactions. WYG will provide a business address and finalized service-provider details before signature. School privacy contact: [NAME / EMAIL / PHONE] WYG privacy and security contact: wygplaybookapp@gmail.com WYG business address: [COMPLETE BEFORE SIGNATURE] ## 15. Signatures **SCHOOL:** ____________________ Date: __________ **WYG:** _______________________ Date: __________