FERPA Posture

This FERPA Posture statement (this "Statement") describes the manner in which Wendel, Inc. ("Wendel") handles Education Records in connection with the Wendel platform (the "Services") on behalf of the educational institutions that subscribe to the Services (each, a "School"). It addresses the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, and its implementing regulations at 34 C.F.R. Part 99 (collectively, "FERPA"). Where this Statement and a Wendel-and-School data-processing agreement diverge, the data-processing agreement shall control.

Capitalized terms used and not defined herein have the meanings ascribed to them in the Wendel Privacy Policy. For purposes of this Statement:

1. "Education Record" means any record, file, document, or other material containing information directly related to a student and maintained by an educational agency or institution or by a person acting for such agency or institution, as defined in 34 C.F.R. § 99.3.
2. "Eligible Student" means a student who has attained the age of eighteen (18) or is attending a postsecondary institution.
3. "Personally Identifiable Information" or "PII" has the meaning ascribed to it in 34 C.F.R. § 99.3.
4. "Directory Information" means the categories of information so designated by the School in accordance with 34 C.F.R. § 99.37, which may include name, grade level, photograph, and dates of attendance.

Each School executing a subscription with Wendel thereby designates Wendel as a "school official" with "legitimate educational interests" under the exception set forth at 34 C.F.R. § 99.31(a)(1)(i)(B). In so designating Wendel, the School confirms that:

1. Wendel performs an institutional service or function for which the School would otherwise use its own employees;
2. Wendel is under the direct control of the School with respect to the use and maintenance of Education Records; and
3. Wendel is subject to the requirements of 34 C.F.R. § 99.33(a) governing the use and re-disclosure of PII from Education Records.

Wendel may use Education Records solely (a) to provide and maintain the Services as directed by the School; (b) to provide End Users with secure access to information to which they are entitled under FERPA and applicable School policies; (c) to support and improve the Services in a manner that does not result in re-disclosure of PII from Education Records outside the narrow exceptions set forth in Section 5; and (d) to comply with applicable law and respond to lawful process. Wendel shall not use Education Records to engage in targeted advertising, to train or improve machine-learning models, or for any purpose unrelated to the provision of the Services.

Wendel will not re-disclose PII from Education Records to any third party except (a) at the express written direction of the School; (b) as required by applicable law, valid legal process, or a lawful request from a governmental authority (in which event Wendel will give the affected School prior written notice and an opportunity to seek a protective order, except where such notice is prohibited by law); or (c) to a Subprocessor engaged under written contract on terms no less protective than those imposed by the School's data-processing agreement. Wendel shall maintain a record of each disclosure of PII from Education Records made under the foregoing exceptions, as contemplated by 34 C.F.R. § 99.32.

The School determines, in its sole discretion, which categories of information constitute Directory Information for purposes of FERPA. The School may configure the Services to expose or suppress particular categories of Directory Information through tenant-level settings. Wendel will follow the School's configuration and will not designate any category of information as Directory Information on its own initiative. Where a student or parent has opted out of the disclosure of Directory Information, the School is responsible for reflecting that opt-out in the Services.

FERPA affords parents of students under the age of eighteen (18), and Eligible Students, the right to:

1. inspect and review the student's Education Records maintained by the School;
2. request that the School amend Education Records believed to be inaccurate, misleading, or otherwise in violation of the student's privacy rights, and to a hearing if the School declines such request;
3. consent to disclosures of PII from Education Records, except to the extent FERPA authorizes disclosure without consent; and
4. file a complaint with the U.S. Department of Education's Student Privacy Policy Office concerning alleged failures by the School to comply with FERPA.

All such requests should be directed in the first instance to the School. Wendel will support the School in fulfilling verified requests within commercially reasonable timeframes.

Where End Users under the age of thirteen (13) interact with the Services, Wendel processes Education Records pursuant to the School's authority under the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506, and its implementing regulations at 16 C.F.R. Part 312, including the "school authorization" exception at 16 C.F.R. § 312.5(c)(4). The School represents that it has obtained any parental consent required by COPPA or that it is permitted to provide such consent on behalf of parents. Wendel limits the collection of information from children under thirteen to that reasonably necessary for the educational purpose for which it is provided.

Wendel acknowledges that many states impose obligations on educational technology providers in addition to those imposed by FERPA. Wendel complies with the state student-privacy statutes enumerated in Section 10of the Privacy Policy and with any additional state-specific obligations that the School identifies in writing or in the executed data-processing agreement. Where a state's requirements are more stringent than those of FERPA, the more-stringent requirements shall apply with respect to End Users to whom that state's law applies.

Wendel receives the following categories of PII from the School and/or its End Users in the ordinary course of operating the Services: (a) student legal name and preferred name; (b) grade level; (c) school-issued email address; (d) optional internal student identifier; (e) club memberships and roles; (f) event registrations; (g) check-in timestamps and modalities; and (h) communications voluntarily submitted to Wendel. Wendel does not receive government-issued identifiers, biometric identifiers, financial information, immigration status, or any category of Sensitive Personal Information not enumerated in this paragraph, except to the extent expressly directed in writing by the School.

Wendel retains Education Records for the duration of the School's subscription and for a tail period of twelve (12) months thereafter, during which the School may extract or request return of Education Records in an industry-standard machine-readable format. Following the tail period, Wendel will irrevocably destroy or de-identify all remaining Education Records in accordance with NIST SP 800-88 Rev. 1. The School may at any time during the Subscription Term request that Wendel delete or return Education Records pertaining to specific students or categories. Wendel will complete such deletion or return within thirty (30) days of the verified request.

Upon Wendel's confirmation of any unauthorized disclosure of, or access to, Education Records, Wendel will notify the affected School without undue delay and in any event no later than seventy-two (72) hours after confirmation. The notification will include the information set forth inSection 17 of the Privacy Policy and any additional information necessary for the School to fulfill its own notification obligations under FERPA, applicable state law, and the executed data-processing agreement.

All Wendel personnel with access to Education Records complete mandatory training, prior to commencement of duties and at least annually thereafter, covering (a) the FERPA framework and the "school official" exception; (b) Wendel's obligations under this Statement and any executed data-processing agreement; (c) acceptable use and prohibited disclosures; and (d) Wendel's incident-response procedures. Completion is tracked and audited.

Wendel maintains an audit log of all access to Education Records by Wendel personnel and of all administrative actions taken within a School's tenant. The audit log is retained for a minimum of one (1) year and is made available to the School upon request. Each School may exercise reasonable oversight of Wendel's compliance with this Statement, including by means of (a) review of Wendel's information-security policies; (b) review of the most recent third-party penetration-test summary; and (c) a written response to a reasonable security questionnaire.

Questions concerning this Statement should be directed to privacy@trywendel.com. Concerning specific Education Records, parents and Eligible Students should contact the School directly.