Student Data Privacy Addendum (United States)

3 October 2026

Dokumentu hau ez dago oraindik itzulita: ingelesa bertsioa erakusten da, eta hori da indarrean dagoena.

Student Data Privacy Addendum — Schools in the United States

Version: 1.1
Last updated: October 2026

This Addendum applies when a private or independent school in the United States uses Kluppy under the Terms of Service for Schools, including during a free trial. It describes how KLUPPY, S.L. ("Kluppy") collects, uses, protects and deletes Student Data. Public school districts and other public bodies require a separate written agreement, including the applicable student data terms, signed by authorised representatives before any student account is activated. Payment, a purchase order or use of the Service does not by itself establish contracting authority.

1. Definitions

• Student Data: any information about an identified or identifiable student that the School or its users provide to Kluppy, or that is generated through their use of the Service.
• Education Records: records that are education records within the meaning of the Family Educational Rights and Privacy Act (FERPA).
• Parent: a parent or legal guardian of a student, or an eligible student under FERPA.
• Schedule 1: the description of each feature and the personal data it uses, in the Terms of Service for Schools, which forms part of this Addendum.

Other capitalised terms have the meaning given in the Terms of Service for Schools.

2. Control and purpose

Student Data remains under the School's control, and Kluppy acquires no ownership of it. Kluppy uses Student Data only to provide the Service to the School, for the School's educational purposes, and for no other purpose. Nothing in this Addendum limits the rights that Parents and students have under applicable law.

School Accounts are never converted into personal accounts, and Student Data is not transferred to any consumer service. A student who wishes to continue outside the School must create a separate personal account, with verifiable parental consent where COPPA requires it (clause 5.3 of the Terms). Only an account that already belonged to the user before joining the School returns to its holder when the School withdraws the licence (clause 5.2 of the Terms); the School then stops seeing its data.

3. FERPA

Where FERPA applies to the School and to the disclosure, the School designates Kluppy as a school official with a legitimate educational interest, and Kluppy:

• performs an institutional service for which the School would otherwise use its own staff;
• is under the School's direct control with respect to the use and maintenance of Education Records;
• uses Education Records only for the purposes for which they were disclosed and complies with the FERPA requirements on redisclosure. It discloses them to its sub-processors only to provide the Service, under written obligations equivalent to this Addendum, and otherwise only where the law requires it, limited to what is required and, where lawful, after notifying the School.

The School is responsible for including in its annual FERPA notification the criteria under which it treats service providers such as Kluppy as school officials.

For Schools to which FERPA does not apply, the commitments of this clause apply as contractual obligations, without representing that FERPA applies.

4. COPPA

Kluppy collects personal information of students under 13 relying on the School's authorisation, solely for the educational use of the Service and for no other commercial purpose. For that purpose:

• before collecting that information, Kluppy provides the School with the direct notice COPPA requires, which describes its practices (this Addendum, Schedule 1 and Kluppy's Privacy Policy), and reasonably verifies that the person giving the authorisation acts for the School (clause 4.2 of the Terms);
• the School may review the personal information collected from its students, ask Kluppy to delete it and prevent its further collection or use, including by deleting accounts from the administration panel;
• Kluppy does not require a student to provide more information than is reasonably necessary to use the Service;
• Kluppy remains responsible for its own obligations as an operator under COPPA, including its written information security program, which it provides to the School on request, and its written data retention policy, published as the Data Retention Policy.

The absence of dates of birth in the Service does not limit these protections: Kluppy applies them to all the School's students.

5. Student Data collected

Kluppy collects and processes the Student Data listed in Schedule 1:

• full name, alias or username, and email address where the School provides one;
• the School and the student's groups;
• typing activity and progress data (speed, accuracy, timings, the letters the student finds difficult), levels and achievements;
• game results in leagues and head-to-head games, which are open to players of other schools and are shown to them only with the student's alias, never with the student's name or email address; the School can switch leagues, head-to-head games and friends off for its students;
• technical usage data needed to operate and secure the Service;
• where the School activates the assessment module, the period aggregates of the evidence reports and teacher observations.

The hand-placement level uses the camera only on the student's device: no image leaves the device or is stored. Kluppy does not collect students' age, date of birth or sensitive categories of data. Teachers and administrators provide their name and email address to use the administration panel.

6. Prohibited uses

Kluppy does not:

• use Student Data for targeted advertising, or show advertising to students;
• sell, rent or trade Student Data;
• build profiles of students for any purpose other than the educational purposes of the Service, or create engagement, risk or behavioural scores about students for its own purposes;
• use Student Data to train artificial intelligence models; students do not use conversational AI (clause 12 of the Terms);
• use Student Data to market products or services to students or Parents.

7. Parent requests

Parents normally exercise their rights to review, correct or delete their child's Student Data through the School. If a Parent contacts Kluppy directly, Kluppy will verify the Parent's identity, coordinate with the School and respond without undue delay, without restricting any right the Parent has under applicable law.

8. Security

Kluppy maintains reasonable administrative, technical and physical safeguards to protect Student Data, including encryption in transit and at rest, role-based access control, logical isolation of each school's data, daily backups, logging of security events and confidentiality obligations for its staff. They are described in Annex II of Kluppy's Data Processing Agreement and form part of Kluppy's written information security program, which Kluppy reviews at least once a year.

9. Retention and deletion

Clause 13.6 of the Terms of Service for Schools and the Data Retention Policy apply to Student Data. In particular:

• Kluppy keeps Student Data only for as long as needed to provide the Service to the School;
• the School can permanently delete a student's account and data at any time from the administration panel; the records of the assessment module, and any other Student Data, are deleted by Kluppy on the School's request without undue delay and within 30 days. Accounts the School creates with no licence available are created blocked and are deleted if 180 days go by without a licence;
• after a licence withdrawal, the end of a trial or the end of the Service, access is blocked and Student Data is kept, without being used for any other purpose, for 180 days, unless the School instructs earlier return or deletion. The period follows the school year, so that a school that returns the following year keeps its students' progress. The School may request a complete export in a structured format (JSON) at any time;
• deleted data may remain in encrypted backups for up to 7 days (point-in-time recovery) and up to 35 days (daily backups), used only to recover from incidents;
• data that the law requires Kluppy to keep, such as invoices, is kept only for that purpose and does not include Student Data.

10. Security incidents

If Kluppy becomes aware of unauthorized access to, or acquisition, use, disclosure, alteration, destruction or loss of, Student Data, it shall notify the School without undue delay and, in any case, send an initial notice within 48 hours, or sooner where the law requires. The initial notice is not delayed until the investigation is complete. It will include the information available at that time: what happened, the categories of data and approximate number of students concerned, the measures taken and a contact point. Kluppy shall send updates as further information becomes available and cooperate with the School so that it can meet any obligation to notify Parents or authorities. This clause does not limit any obligation of Kluppy to notify directly that the law imposes.

11. Sub-processors and location of the data

Kluppy uses the sub-processors listed in Schedule 1 and in Annex III of its Data Processing Agreement, under written data protection obligations. Student Data is stored in the European Union; Schedule 1 states which providers process data elsewhere. Kluppy will inform the School of any intended addition or replacement at least 30 days in advance. If the School objects on reasonable grounds, clause 13.5 of the Terms of Service for Schools applies.

12. State student privacy laws

Several states regulate operators of online services used by schools, and some of those laws also cover private schools (for example, SOPIPA in California, SOPPA in Illinois or Education Law §2-d in New York for certain schools and programs). Before Kluppy processes Student Data, the parties shall identify the state requirements that apply, according to the School's state and type of school, and sign any terms or schedules those laws require. Kluppy complies with the state laws that apply to it as an operator. A review of a proposed agreement, or the need for a separate signature, does not limit either party's legal obligations.

13. Order of precedence and duration

As regards Student Data, mandatory law prevails, followed by this Addendum, Schedule 1 of the Terms of Service for Schools, Kluppy's Data Processing Agreement and the Terms of Service for Schools. A separate agreement signed by both parties prevails where it identifies expressly the provision it amends, to the extent permitted by law. This Addendum applies for as long as Kluppy processes Student Data.

Student Data Privacy Addendum — Schools in the United States · Kluppy · Version 1.1 · October 2026