Common use of Data Security and Privacy Plan Clause in Contracts

Data Security and Privacy Plan. Vendor agrees that it will protect the confidentiality, privacy and security of the Protected Data received from Participating Educational Agencies in accordance with Erie 1 BOCES’ Parents Bill of Rights for Data Privacy and Security, a copy of which has been signed by the Vendor and is set forth below. Additional elements of Vendor’s Data Security and Privacy Plan are as follows: (a) In order to implement all state, federal, and local data security and privacy requirements, including those contained within this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order to protect the security, confidentiality and integrity of the Protected Data that it receives under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations set forth in Erie 1 BOCES’ “Supplemental Information about the MLSA” below. (d) For any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying breaches and unauthorized disclosures, and Vendor will provide prompt notification of any breaches or unauthorized disclosures of Protected Data in accordance with Section 6 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all applicable state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Arlington Central School District and Canva Pty Ltd.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by applicable state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the applicable federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Pine Valley Central School District and Kialo GmbH.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. Vendor Swank Motion Pictures Inc. agrees that it will protect the confidentiality, privacy and security of the Protected Data received from Participating Educational Agencies in accordance with Erie 1 BOCES’ the BOCES Parents Bill of Rights for Data Privacy and Security, a copy of which has been signed by the Vendor Swank Motion Pictures Inc. and is set forth below. Additional elements of Vendor’s Swank Motion Pictures Inc.’ Data Security and Privacy Plan are as follows: (a) In order to implement all state, federal, and local data security and privacy requirements, including those contained within this Data Sharing and Confidentiality AgreementDPA, consistent with Erie 1 BOCES’ BOCES data security and privacy policy, Vendor Swank Motion Pictures Inc. will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this [ see attached Swank Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance.Privacy Policy _ ] (b) In order to protect the security, confidentiality and integrity of the Protected Data that it receives under the MLSASwank Motion Pictures Inc. AGREEMENT, Vendor Swank Motion Pictures Inc. will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSASwank Motion Pictures Inc. AGREEMENT: [▇▇▇▇▇://▇▇▇▇▇▇▇.▇▇▇/blocksi-edu-agreement.php][ See attached Swank Data Privacy Policy (c) Vendor Swank Motion Pictures Inc. will comply with all obligations set forth in Erie 1 BOCES’ B OCES “Supplemental Information about the MLSAAGREEMENT” below. (d) For any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who have access to Protected Data, Vendor Swank Motion Pictures Inc. has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws.[ (e) Vendor Swank Motion Pictures Inc. [check one] will [X] X _will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSASwan k Motion Pictures Inc. AGREEMENT. In the event that Vendor Swank Motion Pictures Inc. engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSASwank Motion Pictures Inc. AGREEMENT, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ BOCES “Supplemental Information about the MLSASwank Motion Pictures Inc. AGREEMENT,” below. (f) Vendor Swank Motion Pictures Inc. will manage data security and privacy incidents that implicate Protected Data, including identifying identify breaches and unauthorized disclosures, and Vendor Swank Motion Pictures Inc. will provide prompt notification of any breaches or unauthorized disclosures of Protected Data in accordance with Section 6 of this Data Sharing and Confidentiality Agreement. (g) Vendor Swank Motion Pictures Inc. will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA AGREEMENT is terminated or expires, as more fully described in Erie 1 BOCES’ BOCES “Supplemental Information about the MLSAAGREEMENT,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between District and Quizizz Inc.” Vendor’s obligations described within this section include, but are not limited to: i. its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and ii. its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth as Appendix A and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Appendix entitled “Supplemental Information about a Master Agreement between the MLSA” belowDistrict and the Vendor, Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the data protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. Vendor agrees that it will protect the confidentiality, privacy and security of the Protected Data received from Participating Educational Agencies in accordance with Erie 1 BOCES’ Parents Bill of Rights for Data Privacy and Security, a copy of which has been signed by the Vendor and is set forth below. Vendor’s Data Security and Privacy Plan can be found in Exhibit E Additional elements of Vendor’s Data Security and Privacy Plan are as follows: (a) In order to implement all state, federal, and local data security and privacy requirements, including those contained within this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In As required by the NIST Cybersecurity Framework, in order to protect the security, confidentiality and integrity of the Protected Data that it receives under the MLSA, , a. Vendor will have the following reasonable administrative, technical, operational operational, and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇.▇▇▇/blocksi i. Data Security: 1. Data-eduat-agreement.php]rest & data-in-transit is encrypted 2. Data leak protections are implemented ii. Information Protection Processes and Procedures: 1. Data destruction is performed according to contract and agreements 2. A plan for vulnerability management is developed and implemented iii. Protective Technology: 1. Log/audit records are ascertained, implemented, documented, and reviewed according to policy 2. Network communications are protected iv. Identity Management, Authentication and Access Control: 1. Credentials and identities are issued, verified, managed, audited, and revoked, as applicable, for authorized dev (c) Vendor will comply with all obligations set forth in Erie 1 BOCES’ “Supplemental Information about the MLSA” below. (d) For any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] x will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying breaches and unauthorized disclosures, and Vendor will provide prompt notification of any breaches or unauthorized disclosures of Protected Data in accordance with Section 6 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Arlington Central School District and Global Compliance Network, Inc. Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational, and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between BRIARCLIFF MANOR UFSD and Dyknow.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Chazy Central Rural School District and [Name of Vendor].” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between [Jasper-Troupsburg Central School District] and [DeltaMath].” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Panama Central School and [Name of Vendor].” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between CEWW BOCES and YouScience, LLC.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Panama Central School and Learning A-Z,LLC.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Jamestown City School District and Inter-State Studio & Publishing Co. ” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. Vendor agrees that it will protect the confidentiality, privacy and security of the Protected Data received from Participating Educational Agencies in accordance with Erie 1 BOCES’ Parents Bill of Rights for Data Privacy and Security, a copy of which has been signed by the Vendor and is set forth below. Additional elements of Vendor’s Data Security and Privacy Plan are as follows: (a) In order to implement all state, federal, and local data security and privacy requirements, including those contained within this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order to protect the security, confidentiality and integrity of the Protected Data that it receives under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇IXL has implemented a variety of physical, administrative and technological safeguards designed to preserve the integrity and security of the personal information collected and to protect against unauthorized access to data. These include internal reviews of IXL’s data collection, storage, and processing practices and security measures, as well as physical security measures to guard against unauthorized access to systems where IXL stores personal data. IXL restricts access to personal information to IXL employees, contractors, and agents who need to know that information in order to operate, develop, or improve IXL’s services. Details are further outlined in IXL’s Data Processing Addendum.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations set forth in Erie 1 BOCES’ “Supplemental Information about the MLSA” below. (d) For any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] x will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying breaches and unauthorized disclosures, and Vendor will provide prompt notification of any breaches or unauthorized disclosures of Protected Data in accordance with Section 6 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Jamestown City School District and Amplify Education, Inc.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Honeoye Central School District and Breakout EDU.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Master Agreement. (c) Vendor will have comply with all obligations contained within the following reasonable administrative, technical, operational section set forth in this Exhibit below entitled “Supplemental Information about a Master Agreement between Panama Central School and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇.▇▇▇/blocksi-edu-agreement.php].” Vendor’s obligations described within this section include, but are not limited to: (ci) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the data protection obligations imposed on Vendor will comply with all obligations set forth in Erie 1 BOCES’ “Supplemental Information about by state and federal law and the MLSA” belowMaster Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Jamestown City School District and Vista Higher Learning ” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to comply in writing with the MLSA” belowsame data security and privacy standards required of Vendor under this agreement and applicable state and federal law. and (ii) its obligation to follow certain procedures for the deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided required, or will provide or require training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents Bill the terms of the District’s ▇▇▇▇ of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between District and Quizizz Inc.” Vendor’s obligations described within this section include, but are not limited to: i. its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and ii. its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational, and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between BRIARCLIFF MANOR UFSD and EXL Inc..” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents Bill the terms of the District’s ▇▇▇▇ of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Cheektowaga Central School District and Smartest Edu. Inc..” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between ▇▇▇▇▇▇ Central School District and [CommonLit, Inc.].” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Panama Central School and [ExploreLearning, LLC].” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Mohonasen Central School District and Chrome Hero LLC.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between PNWBOCES and [LocalLive].” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational, and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between BRIARCLIFF MANOR UFSD and Eduware Inc..” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Washington-Saratoga-▇▇▇▇▇▇-▇▇▇▇▇▇▇▇-Essex BOCES and Texthelp Inc ”. Vendor’s obligations described within this section include, but are not limited to: i. its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and ii. its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Arlington Central School District and [ExploreLearning] Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Jamestown City School District and Learning A-Z ” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Washington-Saratoga-▇▇▇▇▇▇-▇▇▇▇▇▇▇▇-Essex BOCES and Check Point Software Technologies Ltd. ”. Vendor’s obligations described within this section include, but are not limited to: i. its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and ii. its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents Bill the terms of the District’s ▇▇▇▇ of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational, and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between BRIARCLIFF MANOR UFSD and Newsela, Inc.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about the MLSA” below.a Master Agreement between Washington-Saratoga ▇▇▇▇▇▇-▇▇▇▇▇▇▇▇-Essex BOCES and Riverside Assessments, LLC dba Riverside Insights ”. Vendor’s obligations described within this section include, but are not limited to: (d) For any of i. its officers or employees (or officers or employees of any of its obligation to require subcontractors or assignees) who have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents persons or entities to perform its obligations under the MLSA, whom it will require such subcontractors, assignees, or other authorized agents may disclose Protected Data (if any) to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about acknowledging that the MLSA,” below. (f) data protection obligations imposed on Vendor will manage data security by state and privacy incidents that implicate Protected Data, including identifying breaches federal law and unauthorized disclosuresthe Master Agreement shall apply to the subcontractor, and Vendor will provide prompt notification of any breaches or unauthorized disclosures of Protected Data in accordance with Section 6 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement ii. its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data at such time that upon termination, expiration or assignment (to the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about extent authorized) of the MLSA,” belowMaster Agreement.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational, and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between BRIARCLIFF MANOR UFSD and Boom Learning.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will has policies in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor agrees to comply with Erie 1 BOCES’ Parents Bill the terms of the District’s ▇▇▇▇ of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor. Vendor and is set forth below. Additional elements of Vendor’s Data Security and Privacy Plan are agrees as follows: (a) In order to Vendor will implement all applicable state, federal, and local data security and privacy requirements, laws including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Jamestown City School District and the MLSAUniversity of Oregon” belowVendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to ensure the data protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the maintenance, return, transition, deletion and/or destruction of Protected Data as authorized by the Master Agreement upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between ▇▇▇▇▇▇ Central School District and [Name of Vendor].” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Arlington Central School District and [NYSCATE] Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Jamestown City School District and Cengage Learning.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Honeoye Central School District and Flat For Education.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Arlington Central School District and [Rethink Ed].” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Arlington Central School District and [Wordwall].” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational, and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between BRIARCLIFF MANOR UFSD and Tree Frog Publishing LLC.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents Bill the terms of the District’s ▇▇▇▇ of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational, and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between BRIARCLIFF MANOR UFSD and Sphero.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational, and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between BRIARCLIFF MANOR UFSD and MakeMusic, Inc..” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Arlington Central School District and [Wiris].” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Bloomfield Central School District and Tools for Schools.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents Bill the terms of the District’s ▇▇▇▇ of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational, and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between BRIARCLIFF MANOR UFSD and Explain Everything.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational, and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between BRIARCLIFF MANOR UFSD and VISTA Higher Learning.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Honeoye Central School District and CLPS Consultants.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents Bill the terms of the District’s ▇▇▇▇ of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational, and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between BRIARCLIFF MANOR UFSD and Turning Technologies.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between [Jasper-Troupsburg Central School District] and [AET].” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Washington-Saratoga- ▇▇▇▇▇▇-▇▇▇▇▇▇▇▇-Essex BOCES and Kaseya US, LLC”. Vendor’s obligations described within this section include, but are not limited to: i. its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements that impose on the MLSA” belowsubcontractor the same data protection obligations imposed on Vendor by state and federal law and the Master Agreement, and ii. its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Arlington Central School District and [Lexia Voyager Sopris Inc. ] Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between the MLSADistrict and Tutteo Inc.” belowVendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the data protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Washington-Saratoga-▇▇▇▇▇▇-▇▇▇▇▇▇▇▇-Essex BOCES and ModMath I.P., LLC”. Vendor’s obligations described within this section include, but are not limited to: i. its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and ii. its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between PNWBOCES and TEXTHELP INC..” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational, and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between BRIARCLIFF MANOR UFSD and Pivot Interactives SBC.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement Between ▇▇▇▇▇▇ Central School District and Class Solver LLC.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Arlington Central School District and [Sway Medical, Inc.] Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor's Plan for protecting the District's Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District's Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s 's Data Security and Privacy Plan for protection of the District's Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District's data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Greater Amsterdam School District and NEPRIS INC.” Vendor's obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Jasper-Troupsburg Central School District and AssistiveWare.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to : Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy. Vendor will have specific administrative, Vendor will: Review its data security operational and privacy policy technical safeguards and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Master Agreement. [Name of Vendor] Vendor will have comply with all obligations contained within the following reasonable administrative, technical, operational and physical safeguards and practices section set forth in place throughout the term of the MLSA: [▇▇▇▇▇://this Exhibit below entitled “Supplemental Information about a Master Agreement between ▇▇▇▇▇▇▇▇ Central School District and YouScience, LLC .▇▇▇/blocksi-edu-agreement.php] ” Vendor’s obligations described within this section include, but are not limited to: its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (cif any) to execute written agreements acknowledging that the data protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. Vendor has provided or will comply with all obligations set forth in Erie 1 BOCES’ “Supplemental Information about provide training on the MLSA” below. (d) For federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors (other than subcontractors that are limited to hosting data storage or providing technology infrastructure) or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents Bill the terms of the District’s ▇▇▇▇ of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational, and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between BRIARCLIFF MANOR UFSD and Make Music - SmartMusic.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Arlington Central School District and Math Medic. Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents Bill the terms of the District’s ▇▇▇▇ of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Jamestown City School District and Pixton Comics Inc. ” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth below. Vendor.Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Grand Island Central School District and *COMPANY NAME*.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy privacy, and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents Bill the terms of the District’s ▇▇▇▇ of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all applicable state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such complianceSupplement. (b) In order Vendor will have specific administrative, operational, and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Supplement below entitled “Supplemental Information about a Master Agreement between District and Nearpod.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality AgreementSupplement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement Between ▇▇▇▇▇▇ Central School District and 3P Learning].” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational, and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between BRIARCLIFF MANOR UFSD and Savvas Learning Company LLC.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging data protection obligations consistent with those imposed on Vendor by state and federal law and the MLSA” belowMaster Agreement, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data Protected Data for any of its officers or employees (and will ensure that its subcontractors or assignees are contractually required to train their respective officers or employees) who will have access to Protected Data, prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will protect has the easyCBM Teacher Deluxe Security & Compliance White Paper in place to describe the confidentiality, privacy and security of measures for the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, and federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between ▇▇▇▇▇▇ Central School District and the MLSAUniversity of Oregon.” belowVendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the data protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data Protected Data for any of its officers or employees who will have access to Protected Data, prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and has developed and implemented plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to implement Vendor will comply with all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Washington-Saratoga- ▇▇▇▇▇▇-▇▇▇▇▇▇▇▇-Essex BOCES and Desmos, Inc.” Vendor’s obligations described within this section include, but are not limited to: i. its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements, including, but not limited to, terms of service, acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and ii. its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data Protected Data for any of its officers or employees who will have access to Protected Data, prior to their receiving access, as follows: Annually, . Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to shall also ensure that these individuals are aware of and familiar any subcontractors it engages to facilitate its obligations under the Master Agreement will comply with all applicable data security federal and privacy lawsstate laws governing confidentiality of Protected Data. A current list of third party subcontractors can be found at ▇▇▇▇▇://▇▇▇▇▇▇.▇▇▇/desmosinc/policies/blob/master/third-party-services.md which is updated from time to time. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement Between ▇▇▇▇▇▇ Central School District and ExamGen, Inc..” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Jamestown City School District and EDpuzzle Inc.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging data protection obligations consistent with those imposed on Vendor by state and federal law and the MLSA” belowMaster Agreement , and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data Protected Data for any of its officers or employees who will have access to Protected Data, prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose make sure that, prior to disclosing Protected Data to any subcontractor or assignee, such subcontractor or assignee complies with federal and state laws governing confidentiality of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying breaches and unauthorized disclosures, and Vendor will provide prompt notification of any breaches or unauthorized disclosures of Protected Data in accordance with Section 6 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Master Agreement. (c) Vendor will have comply with all obligations contained within the following reasonable administrative, technical, operational section set forth in this Exhibit below entitled “Supplemental Information about a Master Agreement between Jamestown City School District and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇.▇▇▇/blocksi-edu-agreement.php].” Vendor’s obligations described within this section include, but are not limited to: (ci) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the data protection obligations imposed on Vendor will comply with all obligations set forth in Erie 1 BOCES’ “Supplemental Information about by state and federal law and the MLSA” belowMaster Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents Bill the terms of the District’s ▇▇▇▇ of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational, and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between BRIARCLIFF MANOR UFSD and Better Chinese.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Arlington Central School District and [▇▇▇▇▇ Software].” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents Bill the terms of the District’s ▇▇▇▇ of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational, and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between BRIARCLIFF MANOR UFSD and ▇▇▇▇▇ ▇▇▇▇▇.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Arlington Central School District and [Swank Motion Pictures, Inc.] Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Eden Central School District and Delightex, Inc.” Vendor’s obligations described within this section include, but are not limited to: i. its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and ii.its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational, and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between BRIARCLIFF MANOR UFSD and CodeMonkey Studios Ltd..” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Jamestown City School District and Banzai.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents Bill the terms of the District’s ▇▇▇▇ of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational, and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between BRIARCLIFF MANOR UFSD and Socrative.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents Bill the terms of the District’s ▇▇▇▇ of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Friendship Central School District and Da Capo Web Development.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Pine Valley Central School District and Institute for Mutilsensory Education _.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between the MLSADistrict and Big Ideas Math.” belowVendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the data protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Panama Central School and Quizizz.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between ▇▇▇▇▇▇▇▇ Central School District and Securly. Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between CEWW BOCES and [Behavior University].” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Panama Central School and [Garbanzo].” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Jamestown City School District and News Literacy Project ” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Jamestown City School District and XtraMath ” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Arlington Central School District and [ Translate My Slide ] Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational, and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between BRIARCLIFF MANOR UFSD and Tract.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Panama Central School and Listen Innovation, Inc.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement Between ▇▇▇▇▇▇ Central School District and PlanbookEdu LLC.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Arlington Central School District and [VOCES Digital].” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between CEWW BOCES and Vendor.” Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.

Data Security and Privacy Plan. As more fully described herein, throughout the term of the Master Agreement, Vendor agrees that it will have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data received it receives from Participating Educational Agencies in accordance the District. Vendor’s Plan for protecting the District’s Protected Data includes, but is not limited to, its agreement to comply with Erie 1 BOCES’ Parents the terms of the District’s Bill of Rights for Data Privacy Security and SecurityPrivacy, a copy of which is set forth below and has been signed by the Vendor and is set forth belowVendor. Additional elements components of Vendor’s Data Security and Privacy Plan for protection of the District’s Protected Data throughout the term of the Master Agreement are as follows: (a) In order to Vendor will implement all state, federal, and local data security and privacy requirements, requirements including those contained within the Master Agreement and this Data Sharing and Confidentiality Agreement, consistent with Erie 1 BOCES’ the District’s data security and privacy policy, Vendor will: Review its data security and privacy policy and practices to ensure that they are in conformance with all applicable federal, state, and local laws and the terms of this Data Sharing and Confidentiality Agreement. In the event Vendor’s policy and practices are not in conformance, the Vendor will implement commercially reasonable efforts to ensure such compliance. (b) In order Vendor will have specific administrative, operational and technical safeguards and practices in place to protect the security, confidentiality and integrity of the Protected Data that it receives from the District under the MLSA, Vendor will have the following reasonable administrative, technical, operational and physical safeguards and practices in place throughout the term of the MLSA: [▇▇▇▇▇://▇▇▇▇▇▇▇Master Agreement.▇▇▇/blocksi-edu-agreement.php] (c) Vendor will comply with all obligations contained within the section set forth in Erie 1 BOCES’ this Exhibit below entitled “Supplemental Information about a Master Agreement between Arlington Central School District and [ n2y LLC ] Vendor’s obligations described within this section include, but are not limited to: (i) its obligation to require subcontractors or other authorized persons or entities to whom it may disclose Protected Data (if any) to execute written agreements acknowledging that the MLSA” belowdata protection obligations imposed on Vendor by state and federal law and the Master Agreement shall apply to the subcontractor, and (ii) its obligation to follow certain procedures for the return, transition, deletion and/or destruction of Protected Data upon termination, expiration or assignment (to the extent authorized) of the Master Agreement. (d) For Vendor has provided or will provide training on the federal and state laws governing confidentiality of Protected Data for any of its officers or employees (or officers or employees of any of its subcontractors or assignees) who will have access to Protected Data, Vendor has provided or will provide training on the federal and state laws governing confidentiality of such data prior to their receiving access, as follows: Annually, Vendor will require that all of its employees (or officers or employees of any of its subcontractors or assignees) undergo data security and privacy training to ensure that these individuals are aware of and familiar with all applicable data security and privacy laws. (e) Vendor [check one] will [X] will not utilize sub-contractors for the purpose of fulfilling one or more of its obligations under the MLSA. In the event that Vendor engages any subcontractors, assignees, or other authorized agents to perform its obligations under the MLSA, it will require such subcontractors, assignees, or other authorized agents to execute written agreements as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below. (f) Vendor will manage data security and privacy incidents that implicate Protected Data, including identifying Data and will develop and implement plans to identify breaches and unauthorized disclosures, and . Vendor will provide prompt notification to the District of any breaches or unauthorized disclosures of Protected Data in accordance with the provisions of Section 6 5 of this Data Sharing and Confidentiality Agreement. (g) Vendor will implement procedures for the return, transition, deletion and/or destruction of Protected Data at such time that the MLSA is terminated or expires, as more fully described in Erie 1 BOCES’ “Supplemental Information about the MLSA,” below.