Common use of Subscribing LEA Clause in Contracts

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ NORTHSIDE ISD ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx NORTHSIDE ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems xxxxxxx (ISO 27000 XXX 00000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “"F” " DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“"Edspex”") works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“"Cybersecurity Frameworks”") that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) □ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 □ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 □ International Standards Organization (ISO) Information technology — - Security techniques — - Information security management systems (ISO 27000 series) □ Secure Controls Framework Council, LLC Security Controls Framework (SCF) □ Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) □ Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “"G” " Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “"G”", Supplemental SDPC State Terms for Texas (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-Xxxxxx ISD Coppell lSD ] (the “"Local Education Agency” " or “"LEA”") and [ [ARTSONIA ] (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy TermsTerms . The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ Harvard Community ] and the ProviderProvider . **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: _ Printed Name: Title/PositionTitle/ Posit ion: _ SCHOOL DISTRICT NAMENAM E: _ DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “"F” " DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“" Edspex”" ) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principlesprinciples * (“"Cybersecurity Frameworks”") that may be utilized utilize d by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) □ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 □ National Institute of Standards and Technology (NIST) Techno logy NIST SP 800-53, Cybersecurity Cyber security Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International □ Int ernational Standards Organization (ISO) Information technology — - Security techniques — Information - Inform at ion security management systems (ISO 27000 seriesserie s) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) □ Office of the Under Secretary of Defense for Acquisition Acquisiti on and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMCCM MC , ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx htt p:// www.eds pex.orq for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “"G” " - Supplemental SDPC State Terms for Texas Illinois Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-Xxxxxx ISD ] Harvard Community Unit School District 50 (the “"Local Education Agency” " or “"LEA”" ) and [ ] Nearpod Inc. (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ iDismiss, LLC ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: LEA BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Narragansett School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: (School District Name): BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:Massachusetts

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Chico USD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. EXHIBIT “G” Supplemental SDPC State Terms for Texas California Version 1.0 This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Chico USD, located at 0000 X Xxxxxxx Xxxxxx ISD ] (the Xxxxx, XX 00000(the “Local Education Agency” or “LEA”) and [ ] Originator Inc., located at 000 Xxxxxx Xx #00 Xxx Xxxxxx, XX 00000 (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Bunker Hill CUSD #8 and the Provider. Xxxxxx'x Database Solutions, Inc. DBA: Embrace® **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) X National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems xxxxxxx (ISO 27000 XXX 00000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR͂ FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “"G” " Supplemental SDPC (Student Data Privacy Consortium) State Terms for Texas Illinois Version 1.0 IL-NDPAv1.0a (Revised March 15, 2021) This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-Xxxxxx ISD ] (the “Bunker Hill CUSD #8(the "Local Education Agency” " or “"LEA”") and [ ] Xxxxxx'x Database Solutions, Inc DBA: Embrace® (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Lombard District 44 and the Provider. Xxxxxx'x Database Solutions, Inc. DBA: Embrace® **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) X National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR͂ FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “"G” " Supplemental SDPC (Student Data Privacy Consortium) State Terms for Texas Illinois Version 1.0 IL-NDPAv1.0a (Revised March 15, 2021) This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-Xxxxxx ISD ] (the “---N/A---(the "Local Education Agency” " or “"LEA”") and [ ] Xxxxxx'x Database Solutions, Inc DBA: Embrace® (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Xxxx Xxxx School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: 12/06/2023 Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) ✔ Secure Controls Framework Council, LLC Security Controls Framework (SCF) ✔ Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here STANDARD STUDENT DATA PRIVACY AGREEMENT (NDPA Standard Version 1.0/Vendor Modified etc.) EXHIBIT “G” Supplemental SDPC State Terms for Texas Arkansas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously I Service providers must comply with the attached Arkansas Act 754 of 2023 Student Data Privacy Agreement (Vendor Security Act. Service providers must comply with Arkansas Act 1196 of 2015 Student Online Personal Information Protection Act. EXHIBIT “DPA”) by H” Additional Terms or Modifications Version XXX and between [ Lubbock-Xxxxxx ISD ] (Provider agree to the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental following additional terms and conditions and policies applicable modifications: This is a free text field that the parties can use to add or modify terms in or to the DPA) as follows:. If there are no additional or modified terms, this field should read “None.”

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ Infobase Holdings, Inc ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: Lafayette District Schools, Mayo, Florida BY: Date: Printed Name: Xxxx Xxxxxx Title/Position: Network Manager SCHOOL DISTRICT NAME: LAFAYETTE DISTRICT SCHOOLS, MAYO, FLORIDA DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Xxxx Xxxxxx Network Administrator Address: 000 XX Xxxxxx Xxxxx Xxxx, XX 00000 Telephone Number: 000-000-0000 Email: xxxxxxx@xxxxxxxx.xxx EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. Standard Data Privacy Agreement between Lafayette District Schools, Mayo, Florida and . Generation Genius *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here Page | 20 of 25 EXHIBIT “G” Supplemental SDPC State Terms for Texas [State] Version 1.0 This Standard Data Privacy Agreement between Lafayette District Schools, Mayo, Florida and . Generation Genius [The State Supplement is an optional set of terms that will be generated on an as-needed basis in collaboration between the national SDPC legal working group and the State Consortia. The scope of these State Supplements will be to address any state specific data privacy statutes and their requirements to the extent that they require terms in addition to or different from the National Standard Clauses. The State Supplements will be written in a manner such that they will not be edited/updated by individual parties and will be posted on the SDPC website to provide the authoritative version of the terms. Any changes by LEAs or Providers will be made in amendment form in an Exhibit (Exhibit “G”, Supplemental SDPC State H” in this proposed structure).] Page | 21 of 25 EXHIBIT “H” Additional Terms for Texas (or Modifications THIS EXHIBIT “Supplemental State Terms”), H” effective simultaneously with the attached Student Data Date Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] Lafayette District Schools, Mayo, Florida, (the “Local Education Agency” or “LEA”) and [ ] Generation Genius , (the “Provider”), ) is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ Cengage Learning, Inc. ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Xxxx Xxxxx Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) ✔ Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ CodeHS ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the “Local Education Agency” or “LEA”) and [ [America’s Software Corp] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ Aledo ISD ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: Xxxxxxxx Xxxx (Nov 1, 2023 09:17 CDT) BY: Xxxxxxxx Xxxx Date: Nov 1, 2023 Printed Name: Xxxxxxxx Xxxx Title/Position: Software Application Integration Admin SCHOOL DISTRICT NAME: Aledo ISD DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) ✔ Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx Aledo ISD ] (the “Local Education Agency” or “LEA”) and [ Progress Learning ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Date:01/22/2024 Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ Vispero (Freedom ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ Labyrinth Learning ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems xxxxxxx (ISO 27000 XXX 00000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD Deer Park Independent School District ] (the “Local Education Agency” or “LEA”) and [ SchoolStatus ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Ceres Unified and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) ✔ Other framework information - Please specify: SOC 2, Type 1 Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental here. This Amendment for SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Ceres Unified, located at 0000 Xxxxxxxx Xxxxxx ISD ] (the Ceres, CA 95307(the “Local Education Agency” or “LEA”) and [ ] TechSmith Corporation, located at 00 Xxxxxxxx Xxxx Xxxx Xxxxxxx, Xxxxxxxx 00000 Xxxxxx Xxxxxx (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Cabot School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: 05/21/2024 Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here STANDARD STUDENT DATA PRIVACY AGREEMENT (NDPA Standard Version 1.0/Vendor Modified etc.) EXHIBIT “G” Supplemental SDPC State Terms for Texas Arkansas Version 1.0 This Exhibit “G”I Service providers must comply with Arkansas Act 1196 of 2015, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”)as amended, effective simultaneously the Student Online Personal Information Protection Act, codified at Ark. Code Xxx. § 6-18-109 Student Online. Service providers must comply with Arkansas Act 754 of 2023, the attached Student Data Privacy Agreement (Vendor Security Act, codified as Ark. Code Xxx. §§ 6-18-2601 to 6-18-2608. EXHIBIT “DPA”) by H” Additional Terms or Modifications Version XXX and between [ Lubbock-Xxxxxx ISD ] (Provider agree to the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental following additional terms and conditions and policies applicable to the DPA) as followsmodifications:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Lancaster SD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. EXHIBIT “G” Supplemental SDPC State Terms for Texas California Version 1.0 This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Lancaster SD, located at 00000 Xxxxx Xxxxxx ISD ] (the Xxxxxxxxx, XX 00000(the “Local Education Agency” or “LEA”) and [ ] Class Creator, located at 000 Xxxxxxxxxx Xxxx Xxxx XX Xxx 00000 Xxxxxxxxxx, XX 00000 (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Pekin Public Schools District 108 and the Provider. Xxxxxx'x Database Solutions, Inc. DBA: Embrace® **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) X National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR͂ FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “"G” " Supplemental SDPC (Student Data Privacy Consortium) State Terms for Texas Illinois Version 1.0 IL-NDPAv1.0a (Revised March 15, 2021) This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-Xxxxxx ISD ] (the “Pekin Public Schools District 108(the "Local Education Agency” " or “"LEA”") and [ ] Xxxxxx'x Database Solutions, Inc DBA: Embrace® (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ Mansfield ISD ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx Mansfield ISD ] (the “Local Education Agency” or “LEA”) and [ [ations Pty Ltd trading as Vi] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Sylvan Union School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. EXHIBIT “G” Supplemental SDPC State Terms for Texas California Version 1.0 This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Sylvan Union School District, located at 000 Xxxxxx ISD ] (the Xxxxxx Xxxxxxx, XX 00000(the “Local Education Agency” or “LEA”) and [ ] SOAR Learning, Inc., located at XX Xxx 000 Xxxx Xxxxx, Xxxxxxxx 00000 Xxxxxx Xxxxxx (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Greenbrier School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here STANDARD STUDENT DATA PRIVACY AGREEMENT (NDPA Standard Version 1.0/Vendor Modified etc.) EXHIBIT “G” Supplemental SDPC State Terms for Texas [State] Version 1.0 This Exhibit I Service providers must comply with Arkansas § 6-18-109 Student Online Personal Information Protection Act. xxxxx://xxx.xxxxxx.xxxxx.xx.xx/Home/FTPDocument?path=%2FBills%2F2015%2FPublic%2FHB1961.pdf EXHIBIT “G”, Supplemental SDPC State H” Additional Terms for Texas (“Supplemental State Terms”), effective simultaneously with or Modifications Version XXX and Provider agree to the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental following additional terms and conditions and policies applicable to the DPA) as followsmodifications:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ Myriad Sensors, Inc ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Cache County School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** [Insert Name of Subscribing LEA: ] BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) X National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 X National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems xxxxxxx (ISO 27000 XXX 00000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) X Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) principles* (“Cybersecurity Frameworks”) that may be utilized by Provider. Cybersecurity Frameworks Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here Contact information for data security concerns or questions: xxxxxxxx@xxxxxxxxx.xxx EXHIBIT “G” – Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit NONE. EXHIBIT “G”, Supplemental SDPC State H” – Additional Terms for Texas (“Supplemental State Terms”), effective simultaneously with or Modifications LEA and Provider agree to the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental following additional terms and conditions and policies applicable modifications: NONE FINAL - Cache County (UT) Spotify_Vendor Modified_With Exhibit E Aug_ 10, 2021 Final Audit Report 2021-08-11 "FINAL - Cache County (UT) Spotify_Vendor Modified_With Exhi bit E Aug_ 10, 2021" History Document created by Xxxx Xxxxxxxx (xxxxx@xxxxxxx.xxx) 2021-08-11 - 0:08:47 AM GMT- IP address: 73.158.137.126 Document emailed to the DPAXxxxxxx Xxxx (xxxxx@xxxxxxx.xxx) as followsfor signature 2021-08-11 - 0:10:15 AM GMT Email viewed by Xxxxxxx Xxxx (xxxxx@xxxxxxx.xxx) 2021-08-11 - 9:41:33 AM GMT- IP address: 66.249.93.197 Document e-signed by Xxxxxxx Xxxx (xxxxx@xxxxxxx.xxx) Signature Date: 2021-08-11 - 9:41:48 AM GMT - Time Source: server- IP address: 109.249.184.170 Agreement completed. 2021-08-11 - 9:41:48 AM GMT Created: By: Status: 2021-08-11 Xxxx Xxxxxxxx (xxxxx@xxxxxxx.xxx) Signed Transaction ID:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: The School Board of Hamilton County, Florida BY: Date: Printed Name: Xxxxx Xxxxxxx Title/Position: Director of Teaching & Learning Services SCHOOL DISTRICT NAME: THE SCHOOL BOARD OF HAMILTON COUNTY, FLORIDA DESIGNATED REPRESENTATIVE OF LEA: Name: Xxxxx Xxxxxxx Title: Director of Teaching & Learning Services Address: 0000 Xxxxxxx 000 X, Xxxxx 0, Xxxxxx, Xx 00000 Telephone Number: (000) 000-0000 Email: xxxxx.xxxxxxx@xxxxxxxxxx.xxx EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-800- 171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here Standard Data Privacy Agreement between Xxxxxxxx District Schools, Jasper, Florida and . P a g e | 20 EXHIBIT “G” Supplemental SDPC State Terms for Texas [State] Version 1.0 This [The State Supplement is an optional set of terms that will be generated on an as-needed basis in collaboration between the national SDPC legal working group and the State Consortia. The scope of these State Supplements will be to address any state specific data privacy statutes and their requirements to the extent that they require terms in addition to or different from the National Standard Clauses. The State Supplements will be written in a manner such that they will not be edited/updated by individual parties and will be posted on the SDPC website to provide the authoritative version of the terms. Any changes by LEAs or Providers will be made in amendment form in an Exhibit (Exhibit “G”H” in this proposed structure).] Standard Data Privacy Agreement between Xxxxxxxx District Schools, Supplemental SDPC State Jasper, Florida and . P a g e | 21 EXHIBIT “H” Additional Terms for Texas (or Modifications THIS EXHIBIT “Supplemental State Terms”), H” effective simultaneously with the attached Student Data Date Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] The School Board of Hamilton County, Florida, (the “Local Education Agency” or “LEA”) and [ ] , (the “Provider”), ) is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] North Xxxxx School District 200 and the Provider. Xxxxxx'x Database Solutions, Inc. DBA: Embrace® **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) X National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems xxxxxxx (ISO 27000 XXX 00000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR͂ FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “"G” " Supplemental SDPC (Student Data Privacy Consortium) State Terms for Texas Illinois Version 1.0 IL-NDPAv1.0a (Revised March 15, 2021) This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-Xxxxxx ISD ] (the “North Xxxxx School District 200(the "Local Education Agency” " or “"LEA”") and [ ] Xxxxxx'x Database Solutions, Inc DBA: Embrace® (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Fort Xxxxx Public Schools and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here STANDARD STUDENT DATA PRIVACY AGREEMENT (NDPA Standard Version 1.0/Vendor Modified etc.) EXHIBIT “G” Supplemental SDPC State Terms for Texas Arkansas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously I Service providers must comply with the attached Arkansas Act 754 of 2023 Student Data Privacy Agreement (Vendor Security Act. Service providers must comply with Arkansas Act 1196 of 2015 Student Online Personal Information Protection Act. EXHIBIT “DPA”) by H” Additional Terms or Modifications Version XXX and between [ Lubbock-Xxxxxx ISD ] (Provider agree to the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental following additional terms and conditions and policies applicable modifications: This is a free text field that the parties can use to add or modify terms in or to the DPA. If there are no additional or modified terms, this field should read “None.” AR_NDPA_v10_23 Digital Compliance Final Audit Report 2024-05-28 "AR_NDPA_v10_23 Digital Compliance" History Document digitally presigned by Xxxxx Xxxxxxxxx (xxxxxxxxxx@xxxxx.xxx) as follows:2024-05-28 - 2:26:38 PM GMT Document digitally presigned by Xxxxx Xxxxxxxxx (xxxxxxxxxx@xxxxx.xxx) 2024-05-28 - 2:28:41 PM GMT Document digitally presigned by Xxxxx Xxxxxxxxx (xxxxxxxxxx@xxxxx.xxx) 2024-05-28 - 2:30:31 PM GMT Document created by Xxxxxx Xxxxxx (xxxxxxx@xxxxxxxxxxxxxxxx.xxx) 2024-05-28 - 3:52:37 PM GMT Document emailed to Xxxxx Xxxxxxx (xxxxxxxx@xxxxxxxxxxxxxxxx.xxx) for signature 2024-05-28 - 3:53:20 PM GMT Email viewed by Xxxxx Xxxxxxx (xxxxxxxx@xxxxxxxxxxxxxxxx.xxx) 2024-05-28 - 5:27:04 PM GMT Document e-signed by Xxxxx Xxxxxxx (xxxxxxxx@xxxxxxxxxxxxxxxx.xxx) Signature Date: 2024-05-28 - 5:27:11 PM GMT - Time Source: server Agreement completed. 2024-05-28 - 5:27:11 PM GMT Created: 2024-05-28 By: Status: Transaction ID: Xxxxxx Xxxxxx (xxxxxxx@xxxxxxxxxxxxxxxx.xxx) Signed

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name San Bernardino County Superintendent of Originating LEA] Schools and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. EXHIBIT “G” Supplemental SDPC State Terms for Texas California Version 1.0 This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: San Bernardino County Superintendent of Schools, located at 000 X X Xxxxxx ISD ] (the Xxx Xxxxxxxxxx, XX 00000(the “Local Education Agency” or “LEA”) and [ ] Double Time Docs LLC, located at 00 Xxxxxxxxxxx Xxxx Xxxxxxxxxxxxx, XX 00000 (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Murrieta Valley USD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. EXHIBIT “G” Supplemental SDPC State Terms for Texas California Version 1.0 This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Murrieta Valley USD, located at 00000 Xxxxxx ISD ] (the Xx. Murrieta, CA 92562(the “Local Education Agency” or “LEA”) and [ ] Booster Enterprises, Inc., located at 0000 Xxxxxxxx Xxxxxxx Xxxxxxxxx Xxxxxxx, XX 00000 (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Anaheim Union High SD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. EXHIBIT “G” Supplemental SDPC State Terms for Texas California Version 1.0 This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the between: Anaheim Union High SD, located at XX Xxx 0000 Xxxxxxx, XX 00000(the “Local Education Agency” or “LEA”) and [ ] Educado, Inc., located at 0000 X Xxxxxxxx Xxx Xxxx X Xxxxxxx, XX 00000 (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Rocklin USD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. EXHIBIT “G” Supplemental SDPC State Terms for Texas California Version 1.0 This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Rocklin USD, located at 0000 Xxxxxx ISD ] (the Xxxxxxx Xxxxx Rocklin, CA 95677(the “Local Education Agency” or “LEA”) and [ ] FlexiSCHED, located at 000 Xxxx Xxxxxx Xxxxxx Portage, WI 53901 United States (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] San Xxxxx Valley Unified School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental here. This Amendment for SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the between: San Xxxxx Valley Unified School District, located at 000 Xxx Xxxxxxx Xxxx Xxxxxxxx, XX 00000(the “Local Education Agency” or “LEA”) and [ ] Music Sales Digital Services, LLC, located at 000 Xxxxxxx Xxxxxx 00xx Xxxxx Xxx Xxxx, XX 00000 Xxxxxx Xxxxxx (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Xxxxxxx School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: 02/01/2024 Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here STANDARD STUDENT DATA PRIVACY AGREEMENT (NDPA Standard Version 1.0/Vendor Modified etc.) EXHIBIT “G” Supplemental SDPC State Terms for Texas Arkansas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously I Service providers must comply with the attached Arkansas Act 754 of 2023 Student Data Privacy Agreement (Vendor Security Act. Service providers must comply with Arkansas Act 1196 of 2015 Student Online Personal Information Protection Act. EXHIBIT “DPA”) by H” Additional Terms or Modifications Version XXX and between [ Lubbock-Xxxxxx ISD ] (Provider agree to the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental following additional terms and conditions and policies applicable modifications: This is a free text field that the parties can use to add or modify terms in or to the DPA) as follows:. If there are no additional or modified terms, this field should read “None.”

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) X National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “"G” " - Supplemental SDPC (Student Data Privacy Consortium) State Terms for Texas Illinois Version 1.0 IL-NDPAv1.0a (Revised March 15, 2021) This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-Xxxxxx ISD ] _Lincoln Community H_ igh _School District 404 (the “"Local Education Agency” or “"LEA”") and [ ] _ Fluency Matters (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] White Hall School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: White Hall School District BY: Date: 03/05/2024 Printed Name: Xxxxx Xxxxxxx Title/Position: WHSD IT Director SCHOOL DISTRICT NAME: White Hall School District DESIGNATED REPRESENTATIVE OF LEA: Name: Xxxxx Xxxxxxx Title: WHSD IT Director Address: 0000 X Xxxxxxx Xxx Xxxxx Xxxx, XX 00000 Telephone Number: 000-000-0000 Email: xxxxxxxx@xxxxxxxxxxx.xxx EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) YES National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here STANDARD STUDENT DATA PRIVACY AGREEMENT (NDPA Standard Version 1.0/Vendor Modified etc.) EXHIBIT “G” Supplemental SDPC State Terms for Texas Arkansas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously I Service providers must comply with the attached Arkansas Act 754 of 2023 Student Data Privacy Agreement (Vendor Security Act. Service providers must comply with Arkansas Act 1196 of 2015 Student Online Personal Information Protection Act. EXHIBIT “DPA”) by H” Additional Terms or Modifications Version XXX and between [ Lubbock-Xxxxxx ISD ] (Provider agree to the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental following additional terms and conditions and policies applicable to the DPA) as followsmodifications:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 X International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Carlinville CUSD #1 and the Provider. Xxxxxx'x Database Solutions, Inc. DBA: Embrace® **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) X National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR͂ FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “"G” " Supplemental SDPC (Student Data Privacy Consortium) State Terms for Texas Illinois Version 1.0 IL-NDPAv1.0a (Revised March 15, 2021) This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-Xxxxxx ISD ] (the “Carlinville CUSD #1(the "Local Education Agency” " or “"LEA”") and [ ] Xxxxxx'x Database Solutions, Inc DBA: Embrace® (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert [ InseJ Originating LEA Name of Originating LEA] 1 and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: _ _ _Date: :__ _ _ Printed Name: _ _ _ Title/Position: Position SCHOOL DISTRICT NAME: _ DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: Page17o/20 EXHIBIT “"F” " DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“"Edspex”") works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“"Cybersecurity Frameworks”") that may be utilized by Provider . Cybersecurity Frameworks □ MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) □ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 Technology National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Technology Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 □ International Standards Organization (ISO) □ □ Information technology — - Security techniques — - Information security management systems xxxxxxx (ISO 27000 XXX 00000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) □ Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Cybersecurity Maturity Model Certification Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here Page18af20 EXHIBIT “"G” " Supplemental SDPC State Terms for Texas [State] Version 1.0 This _ [The State Supplement is an optional set of terms that will be generated on an as-needed basis in collaboration between the national SDPC legal working group and the State Consortia. The scope of these State Supplements will be to address any state specific data privacy statutes and their requirements to the extent that they require terms in addition to or different from the National Standard Clauses. The State Supplements will be written in a manner such that they will not be edited/updated by individual parties and will be posted on the SDPC website to provide the authoritative version of the terms. Any changes by LEAs or Providers will be made in amendment form in an Exhibit “G”, Supplemental SDPC State (Exhibit "H" in this proposed structure).] Page19o/20 EXHIBIT "H" Additional Terms for Texas (“Supplemental State Terms”), effective simultaneously with or Modifications Version LEA and Provider agree to the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental following additional terms and conditions and policies applicable modifications: This is a free text field that the paGies can use to add or modify terms in or to the DPA) as follows:. If there are no additional or modified terms, this field should read "None."

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the ProviderDPA. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Xxxxx Xxxxxxxx TO ACCEPT THE GENERAL OFFER, THE SUBSCRIBING XXX MUST DELIVER THIS SIGNED EXHIBIT TO THE PERSON AND EMAIL ADDRESS LISTED BELOW _____________________ ______________________ xxxxx@xxxxxxxxxx.xxx General Manager Name: Title: _________________________ Email Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . [INSERT ADDITIONAL DATA SECURITY REQUIREMENTS BELOW] Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) } □ National Institute of Standards and Technology (NIST) - NIST Cybersecurity Framework Version 1.1 □ National Institute of Standards and Technology (NIST) - NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 □ International Standards Organization (ISO) - Information technology — - Security techniques — - Information security management systems (ISO 27000 series) □ Secure Controls Framework Council, LLC - Security Controls Framework (SCF) □ Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) - Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx lmPACT Applications has taken relevant pieces from those listed above as well as other standards and applied those that are appropriate for further details about the noted frameworksour environment. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated 's performance in the attached DPA areas of Availability, Privacy and amends Security conforms to regulations as established by the DPA AICPA standards. Provider is ISO 13485 certified. MASTER ECASD DPA_IA signed Final Audit Report 2022-05-17 "MASTER ECASD DPA_IA signed" History Document digitally presigned by DocuSign\, Inc. (and all supplemental terms and conditions and policies applicable xxxxxxxxxxxxxxxxx@xxxxxxxx.xxx) 2022-05-17 - 3:39:58 PM GMT Document created by Xxxx Xxxxxx (xxxxxxx@xxxxx.xx) 2022-05-17 - 3:43:53 PM GMT Document emailed to the DPAXxxxx Xxxxxx (xxxxxxx@xxxxx.xx) as follows:for signature 2022-05-17 - 3:44:40 PM GMT Email viewed by Xxxxx Xxxxxx (xxxxxxx@xxxxx.xx) 2022-05-17 - 6:04:32 PM GMT Document e-signed by Xxxxx Xxxxxx (xxxxxxx@xxxxx.xx) Signature Date: 2022-05-17 - 6:04:48 PM GMT - Time Source: server Agreement completed. 2022-05-17 - 6:04:48 PM GMT Created: 2022-05-17 By: Status: Transaction ID: Xxxx Xxxxxx (xxxxxxx@xxxxx.xx) Signed

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] East Aurora School District 131 and the Provider. Xxxxxx'x Database Solutions, Inc. DBA: Embrace® **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) X National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems xxxxxxx (ISO 27000 XXX 00000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR͂ FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “"G” " Supplemental SDPC (Student Data Privacy Consortium) State Terms for Texas Illinois Version 1.0 IL-NDPAv1.0a (Revised March 15, 2021) This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-Xxxxxx ISD ] (the “East Aurora School District 131(the "Local Education Agency” " or “"LEA”") and [ ] Xxxxxx'x Database Solutions, Inc DBA: Embrace® (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Ceres Unified and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. EXHIBIT “G” Supplemental SDPC State Terms for Texas California Version 1.0 This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Ceres Unified, located at 0000 Xxxxxxxx Xxxxxx ISD ] (the Ceres, CA 95307(the “Local Education Agency” or “LEA”) and [ ] Digital Inspiration, located at 0/000 Xxxxx Xxxxx Xxxx, XX 000000 Xxxxx (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques — Information security management systems xxxxxxx (ISO 27000 XXX 00000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx Midway ISD ] (the “Local Education Agency” or “LEA”) and [ Stukent, Inc. ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ Grayslake CHSD 12 ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems xxxxxxx (ISO 27000 XXX 00000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” – Supplemental SDPC State Terms for Texas Illinois Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] Grayslake CHSD 127 (the “Local Education Agency” or “LEA”) and [ ] MakeMusic, Inc. (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ Xxxxxx XxXxxxx ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ Tigard-Tualatin School District ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Oregon Version 1.0 1.1 This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas Oregon (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbockbetween: Tigard-Xxxxxx ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”)Tualatin School District, is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:located at 0000 XX Xxxxxxxx St., Tigard, OR

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating originating LEA] : Bellevue School District 405 and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Name of Subscribing LEA: BYBy: _ Xxxxx XxXxxx (Dec 15, 2021 19:34 CST) Date: _ Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: _ _ Email: 1190353v1 EXHIBIT “F” F”‌ DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider Provider. Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. 1190353v1 EXHIBIT “G” – Supplemental SDPC State Terms for Texas [State] Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:1.0

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEASouth Sanpete School Di_] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems xxxxxxx (ISO 27000 XXX 00000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas [State] Version 1.0 This [The State Supplement is an optional set of terms that will be generated on an as-needed basis in collaboration between the national SDPC legal working group and the State Consortia. The scope of these State Supplements will be to address any state specific data privacy statutes and their requirements to the extent that they require terms in addition to or different from the National Standard Clauses. The State Supplements will be written in a manner such that they will not be edited/updated by individual parties and will be posted on the SDPC website to provide the authoritative version of the terms. Any changes by LEAs or Providers will be made in amendment form in an Exhibit (Exhibit “G”, Supplemental SDPC State H” in this proposed structure).] EXHIBIT “H” Additional Terms for Texas (“Supplemental State Terms”), effective simultaneously with or Modifications Version LEA and Provider agree to the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental following additional terms and conditions and policies applicable to the DPA) as followsmodifications:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Sacramento City USD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. EXHIBIT “G” Supplemental SDPC State Terms for Texas California Version 1.0 This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Sacramento City USD, located at 0000 00xx Xxxxxx ISD ] (the Xxxxxxxxxx, XX 00000(the “Local Education Agency” or “LEA”) and [ ] The Language Gym Limited, located at Xx 0 00/X Xxxxxx 00 00 Xxxxxx Xxxxxx Xxxx Xxxx, Xxxxxx Xxx 999077 Hong Kong (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques — Information security management systems xxxxxxx (ISO 27000 XXX 00000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx Midway ISD ] (the “Local Education Agency” or “LEA”) and [ Learning Ally ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems xxxxxxx (ISO 27000 XXX 00000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the “Local Education Agency” or “LEA”) and [ Wayside Publishing ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Fort Xxxxx Public Schools and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Xxxxx Xxxxx Date: 03/13/24 Printed Name: Xxxxx Xxxxx Title/Position: Director of Technology SCHOOL DISTRICT NAME: Cossatot River School District DESIGNATED REPRESENTATIVE OF LEA: Name: Xxxxx Xxxxx Title: Director of Technology Address: 000 Xxxxxx Xxxxx, Xxxxxx, XX Telephone Number: Email: 000-000-0000 xxxxxx@xxxxxxxx.xx EXHIBIT “"F” " DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“"Edspex”") works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“"Cybersecurity Frameworks”") that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — - Security techniques — - Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here STANDARD STUDENT DATA PRIVACY AGREEMENT {NDPA Standard Version 1.0/Vendor Modified etc.) EXHIBIT “"G” " Supplemental SDPC State Terms for Texas [State] Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously I Service providers must comply with the attached Arkansas§ 6-18-109 Student Online Personal Information Protection Act. xxxxx://xxx.x xxxxx.xxxxx.xx.xx/ Acts/Document ?type=pdf&act=1196&ddBienniumSession=2015%2F2015R Service providers must comply with Arkansas§ 6-18-2505 and§ 6-18-2507 Student Data Privacy Agreement (“DPA”) by Vendor Security Act. xxxxx://xxx.xxxxxx.xxxxx.xx.xx/Bills/FTPDocument?path=%2FBills%2F2023R%2FPublic%2FH Bl 757.pdf EXHIBIT "H" Additional Terms or Modifications D Version XXX and between [ Lubbock-Xxxxxx ISD ] (Provider agree to the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental following additional terms and conditions and policies applicable modifications: This is a free text field that the parties can use to add or modify terms in or to the DPA) as follows:. If there are no additional or modified terms, this field should read "None."

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” F DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 California This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] between: , located at (the “Local Education Agency” or “LEA”) and [ ] , located at (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Lodi Unified School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) ✔ Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. EXHIBIT “G” Supplemental SDPC State Terms for Texas California Version 1.0 This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the between: Lodi Unified School District, located at 0000 X Xxxx Xx Xxxx Xx 00000 Xxxx, XX 00000(the “Local Education Agency” or “LEA”) and [ ] Codemoji, located at 0000 xxxx xxxxxxxxx xxx 0X Xxxxxxx, XX 00000 (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Lodi Unified School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. EXHIBIT “G” Supplemental SDPC State Terms for Texas California Version 1.0 This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the between: Lodi Unified School District, located at 0000 X Xxxx Xx Xxxx Xx 00000 Xxxx, XX 00000(the “Local Education Agency” or “LEA”) and [ ] WordMasters Challenge, located at 000 X 00x Xx Xxxx Xxxxxx, XX 00000 (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) ✔ Secure Controls Framework Council, LLC Security Controls Framework (SCF) ✔ Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) ✔ Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the “Local Education Agency” or “LEA”) and [ CrisisGo, Inc. ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Ceres Unified and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) ✔ Other framework information - Please specify:The All The Right Type website uses encryption to secure any data exchanged to the server. Our US server is located in Columbus, OH. Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental here. This Amendment for SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Ceres Unified, located at 0000 Xxxxxxxx Xxxxxx ISD ] (the Ceres, CA 95307(the “Local Education Agency” or “LEA”) and [ ] Ingenuity Works Inc., located at 0000 Xxxxxxx Xxxxxx Xxxxx 0000 Xxxxxxxx, XX 00000 Xxxxxx Xxxxxx (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEASouth Sanpete School Di_s] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems xxxxxxx (ISO 27000 XXX 00000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas [State] Version 1.0 This [The State Supplement is an optional set of terms that will be generated on an as-needed basis in collaboration between the national SDPC legal working group and the State Consortia. The scope of these State Supplements will be to address any state specific data privacy statutes and their requirements to the extent that they require terms in addition to or different from the National Standard Clauses. The State Supplements will be written in a manner such that they will not be edited/updated by individual parties and will be posted on the SDPC website to provide the authoritative version of the terms. Any changes by LEAs or Providers will be made in amendment form in an Exhibit (Exhibit “G”, Supplemental SDPC State H” in this proposed structure).] EXHIBIT “H” Additional Terms for Texas (“Supplemental State Terms”), effective simultaneously with or Modifications UT 1.0 Version LEA and Provider agree to the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental following additional terms and conditions and policies applicable to the DPA) as followsmodifications:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock[Cypress-Xxxxxx ISD Fairbanks ISD] (the “Local Education Agency” or “LEA”) and [ Smore ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Ceres Unified and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. EXHIBIT “G” Supplemental SDPC State Terms for Texas California Version 1.0 This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Ceres Unified, located at 0000 Xxxxxxxx Xxxxxx ISD ] (the Ceres, CA 95307(the “Local Education Agency” or “LEA”) and [ ] Class Composer, located at 0000 Xxxxxx Xxxxxx Xxxxx 000 Xxxxxxx, XX 00000 (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Cutter Morning Star School and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) ✔ Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here STANDARD STUDENT DATA PRIVACY AGREEMENT (NDPA Standard Version 1.0/Vendor Modified etc.) EXHIBIT “G” Supplemental SDPC State Terms for Texas [State] Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously I Service providers must comply with the attached Arkansas Act 754 of 2023 Student Data Privacy Agreement (Vendor Security Act. Service providers must comply with Arkansas Act 1196 of 2015 Student Online Personal Information Protection Act. EXHIBIT “DPA”) by H” Additional Terms or Modifications Version XXX and between [ Lubbock-Xxxxxx ISD ] (Provider agree to the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental following additional terms and conditions and policies applicable modifications: This is a free text field that the parties can use to add or modify terms in or to the DPA) as follows:. If there are no additional or modified terms, this field should read “None.”

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Alameda Unified School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. EXHIBIT “G” Supplemental SDPC State Terms for Texas California Version 1.0 This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the between: Alameda Unified School District, located at 0000 Xxxxxxxxxx Xx Xxxxxxx, XX 00000(the “Local Education Agency” or “LEA”) and [ ] youmebee Ltd, located at The Gate, Keppoch Street, United Kingdom Cardiff, AK CF243JW (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the “Local Education Agency” or “LEA”) and [ [Press4Kids Inc. ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Trumann School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: 11/27/2023 Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) ✔ Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here STANDARD STUDENT DATA PRIVACY AGREEMENT (NDPA Standard Version 1.0/Vendor Modified etc.) EXHIBIT “G” Supplemental SDPC State Terms for Texas [State] Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously I Service providers must comply with the attached Arkansas Act 754 of 2023 Student Data Privacy Agreement (Vendor Security Act. Service providers must comply with Arkansas Act 1196 of 2015 Student Online Personal Information Protection Act. EXHIBIT “DPA”) by H” Additional Terms or Modifications Version XXX and between [ Lubbock-Xxxxxx ISD ] (Provider agree to the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental following additional terms and conditions and policies applicable to the DPA) as followsmodifications:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ XX Xxxxx ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” F”‌ DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here Additionally, the Girls Who Code Security White Paper can be found here: xxxxx://xxxxxxxxxxxx.xxx/assets/ downloads/craft-prod/downloads/GWC-Security-Whitepaper-1.pdf EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ Girls Who Code, Inc. ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems xxxxxxx (ISO 27000 XXX 00000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) ✔ Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “"G” " - Supplemental SDPC (Student Data Privacy Consortium) State Terms for Texas Illinois Version 1.0 IL-NDPAv1.0a (Revised March 15, 2021) This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-Xxxxxx ISD ] Pleasantdale School District 107 (the “"Local Education Agency” or “"LEA”") and [ ] Dearborns Consulting LLC (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating originating LEA] : Bellevue School District 405 and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Name of Subscribing LEA: BYBy: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: 1190353v1 EXHIBIT “F” F”‌ DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider Provider. Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. 1190353v1 EXHIBIT “G” – Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:[State]

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 X National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ Learning Without Tears ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems xxxxxxx (ISO 27000 XXX 00000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) ✔ Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “"G” " - Supplemental SDPC (Student Data Privacy Consortium) State Terms for Texas Illinois Version 1.0 IL-NDPAv1.0a (Revised March 15, 2021) This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-Xxxxxx ISD ] Junior High School (the “"Local Education Agency” or “"LEA”") and [ ] Dearborns Consulting LLC (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEASouth Sanpete School Di_] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas [State] Version 1.0 This [The State Supplement is an optional set of terms that will be generated on an as-needed basis in collaboration between the national SDPC legal working group and the State Consortia. The scope of these State Supplements will be to address any state specific data privacy statutes and their requirements to the extent that they require terms in addition to or different from the National Standard Clauses. The State Supplements will be written in a manner such that they will not be edited/updated by individual parties and will be posted on the SDPC website to provide the authoritative version of the terms. Any changes by LEAs or Providers will be made in amendment form in an Exhibit (Exhibit “G”, Supplemental SDPC State H” in this proposed structure).] EXHIBIT “H” Additional Terms for Texas (“Supplemental State Terms”), effective simultaneously with or Modifications Version XXX and Provider agree to the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental following additional terms and conditions and policies applicable to the DPA) as followsmodifications:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Wasco Union Elementary SD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. EXHIBIT “G” Supplemental SDPC State Terms for Texas California Version 1.0 This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Wasco Union Elementary SD, located at 0000 0xx Xxxxxx ISD ] (the Xxxxx, XX 00000(the “Local Education Agency” or “LEA”) and [ ] Toy Theater, located at 000 Xxxxx Xxxxxx Ottawa, Ontario K2P0S9 Canada (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) ✔ Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: The School Board of *YOUR COUNTY* County, Florida BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: THE SCHOOL BOARD OF *YOUR COUNTY* COUNTY, FLORIDA DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider Provider. Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here Agreement Between the School Board of Monroe County, Florida P a g e | 47 of 51 EXHIBIT “G” Supplemental SDPC State Terms for Texas [State] Version 1.0 This [The State Supplement is an optional set of terms that will be generated on an as- needed basis in collaboration between the national SDPC legal working group and the State Consortia. The scope of these State Supplements will be to address any state specific data privacy statutes and their requirements to the extent that they require terms in addition to or different from the National Standard Clauses. The State Supplements will be written in a manner such that they will not be edited/updated by individual Parties and will be posted on the SDPC website to provide the authoritative version of the terms. Any changes by LEAs or Providers will be made in amendment form in an Exhibit (Exhibit “G”, Supplemental SDPC State H” in this proposed structure).] EXHIBIT “H” Additional Terms for Texas (or Modifications THIS EXHIBIT “Supplemental State Terms”), H” effective simultaneously with the attached Student Data Date Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] The School Board of Monroe County, Florida, (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), Provider is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] CUSD200 - Wheaton and the Provider. Class Companion **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY#:: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) X National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “"G” " - Supplemental SDPC (Student Data Privacy Consortium) State Terms for Texas Illinois Version 1.0 IL-NDPAv1.0a (Revised March 15, 2021) This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-Xxxxxx ISD ] CUSD200 - Wheaton (the “"Local Education Agency” or “"LEA”") and [ ] Class Companion (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Roseville Joint Union High SD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. EXHIBIT “G” Supplemental SDPC State Terms for Texas California Version 1.0 This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the between: Roseville Joint Union High SD, located at 0000 Xxxxx Xxx Xxxxxxxxx, XX 00000(the “Local Education Agency” or “LEA”) and [ ] EditMentor, Inc., located at 000 Xxxxx Xxxxxx Xxxxx 2 Beverly Hills, CA 90212 (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Rocklin USD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. EXHIBIT “G” Supplemental SDPC State Terms for Texas California Version 1.0 This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Rocklin USD, located at 0000 Xxxxxx ISD ] (the Xxxxxxx Xxxxx Rocklin, CA 95677(the “Local Education Agency” or “LEA”) and [ ] NoodleTools, Inc., located at PO Box 60214 Palo Alto, CA 94306 (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] South Holland School District 150 and the Provider. Xxxxxx'x Database Solutions, Inc. DBA: Embrace® **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) X National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems xxxxxxx (ISO 27000 XXX 00000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR͂ FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “"G” " Supplemental SDPC (Student Data Privacy Consortium) State Terms for Texas Illinois Version 1.0 IL-NDPAv1.0a (Revised March 15, 2021) This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-Xxxxxx ISD ] (the “South Holland School District 150(the "Local Education Agency” " or “"LEA”") and [ ] Xxxxxx'x Database Solutions, Inc DBA: Embrace® (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) ✔ Secure Controls Framework Council, LLC Security Controls Framework (SCF) ✔ Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) ✔ Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD Deer Park Independent School District ] (the “Local Education Agency” or “LEA”) and [ DreamBox Learning Inc ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Union Ridge School District 86 and the Provider. Xxxxxx'x Database Solutions, Inc. DBA: Embrace® **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) X National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR͂ FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “"G” " Supplemental SDPC (Student Data Privacy Consortium) State Terms for Texas Illinois Version 1.0 IL-NDPAv1.0a (Revised March 15, 2021) This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-Xxxxxx ISD ] (the “Union Ridge School District 86(the "Local Education Agency” " or “"LEA”") and [ ] Xxxxxx'x Database Solutions, Inc DBA: Embrace® (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Cambridge Public Schools and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5PROVIDER. ** Subscribing LEA: (School District Name): BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 x International Standards Organization (ISO) Organization** Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This **Please see the following Attachment to Exhibit “G”F” for an explanation of Provider’s current practices. Attachment to Exhibit “F” Provider is actively working towards certification with ISO 27001 because Provider takes data privacy and security seriously. In the meantime, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with Provider has detailed below the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as security standards it currently follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Lodi Unified School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. EXHIBIT “G” Supplemental SDPC State Terms for Texas California Version 1.0 This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the between: Lodi Unified School District, located at 0000 X Xxxx Xx Xxxx Xx 00000 Xxxx, XX 00000(the “Local Education Agency” or “LEA”) and [ ] Clickteam, located at PO Box 965 Fairview, OR 97230 (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Twin Rivers and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. EXHIBIT “G” Supplemental SDPC State Terms for Texas California Version 1.0 This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Twin Rivers, located at 0000 Xxxxxx ISD ] (the Xxxxxxxxx XxXxxxxxx, CA 95652(the “Local Education Agency” or “LEA”) and [ ] Xxxxx Xxxxxxxxx Co, located at PO BOX 41058 Santa Barbara, CA 93140 United States (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Twin Rivers and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. EXHIBIT “G” Supplemental SDPC State Terms for Texas California Version 1.0 This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Twin Rivers, located at 0000 Xxxxxx ISD ] (the Xxxxxxxxx XxXxxxxxx, CA 95652(the “Local Education Agency” or “LEA”) and [ ] Soft Skills AHA, located at 00 Xxxxxxxxx Xxxx Xxxxxx Xxxx Xxxxxx, XX 00000 (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: Lafayette District Schools, Mayo, Florida BY: Date: Printed Name: Xxxx Xxxxxx Title/Position: Network Manager Standard Data Privacy Agreement between Lafayette District Page | 18 of 25 Schools, Mayo, Florida and Sivic Solutions Group, LLC . SCHOOL DISTRICT NAME: LAFAYETTE DISTRICT SCHOOLS, MAYO, FLORIDA DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Xxxx Xxxxxx Network Administrator Address: 000 XX Xxxxxx Xxxxx Xxxx, XX 00000 Telephone Number: 000-000-0000 Standard Data Privacy Agreement between Lafayette District Schools, Mayo, Florida and . Sivic Solutions Group, LLC Email: xxxxxxx@xxxxxxxx.xxx Page | 19 of 25 EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. Standard Data Privacy Agreement between Lafayette District Schools, Mayo, Florida and . Sivic Solutions Group, LLC *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here Page | 20 of 25 EXHIBIT “G” Supplemental SDPC State Terms for Texas [State] Version 1.0 This Standard Data Privacy Agreement between Lafayette District Schools, Mayo, Florida and . Sivic Solutions Group, LLC [The State Supplement is an optional set of terms that will be generated on an as-needed basis in collaboration between the national SDPC legal working group and the State Consortia. The scope of these State Supplements will be to address any state specific data privacy statutes and their requirements to the extent that they require terms in addition to or different from the National Standard Clauses. The State Supplements will be written in a manner such that they will not be edited/updated by individual parties and will be posted on the SDPC website to provide the authoritative version of the terms. Any changes by LEAs or Providers will be made in amendment form in an Exhibit (Exhibit “G”, Supplemental SDPC State H” in this proposed structure).] Page | 21 of 25 EXHIBIT “H” Additional Terms for Texas (or Modifications THIS EXHIBIT “Supplemental State Terms”), H” effective simultaneously with the attached Student Data Date Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] Lafayette District Schools, Mayo, Florida, (the “Local Education Agency” or “LEA”) and [ ] Sivic Solutions Group, LLC , (the “Provider”), ) is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: 7/6/2021 Printed Name: Xxxxxx Xxxxx Title/Position: IT Director SCHOOL DISTRICT NAME: Xxxxx Preparatory Academy DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: 1190353v1 EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) X National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems xxxxxxx (ISO 27000 XXX 00000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:1190353v1

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ Northwest ISD ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx Northwest ISD ] (the “Local Education Agency” or “LEA”) and [ XXX LABS ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ SNO Sites ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ San Antonio College ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock[Cypress-Xxxxxx ISD Fairbanks ISD] (the “Local Education Agency” or “LEA”) and [ Xello Inc ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Lancaster SD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. EXHIBIT “G” Supplemental SDPC State Terms for Texas California Version 1.0 This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Lancaster SD, located at 00000 Xxxxx Xxxxxx ISD ] (the Xxxxxxxxx, XX 00000(the “Local Education Agency” or “LEA”) and [ ] NurseNotes, located at 000 XX Xxxxxx Blvd #176 Issaquah, WA 98027 (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Xxxxx Xxxxxx Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here EXHIBIT “G” Supplemental SDPC State Terms for Texas Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ Xxxxx Scientific, Inc ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating originating LEA] and : Snoqualmie Valley Schaonodl District the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Name of Subscribing LEA: BYBy: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: 1190353v1 EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider Provider. Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) X Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit xxxx://xxx.xxxxxx.xxx for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. 1190353v1 EXHIBIT “G” – Supplemental SDPC State Terms for Texas [State] Version 1.0 This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:1.0

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Lodi Unified School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING XXX MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: EXHIBIT “F” DATA SECURITY REQUIREMENTS Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) ✔ Other framework information - Please specify:We employ proprietary encryption algorithms to protect the limited, non-PII application usage data transmitted from the running application to our anti-piracy and usage tracking server.Once received, the data is stored in an unencrypted state on a server which is secured behind firewalls and located in a secure co-location facility. Please visit xxxx://xxx.xxxxxx.xxx xxxx://xxx.xxxxxx.xxx/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here here. EXHIBIT “G” Supplemental SDPC State Terms for Texas California Version 1.0 This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-Xxxxxx ISD ] (the between: Lodi Unified School District, located at 1300 X Xxxx Xx Xxxx Xx 00000 Xxxx, XX 00000(xhe “Local Education Agency” or “LEA”) and [ ] Ashlar-Vellum, located at 9600 Xxxxx Xxxxx Xxxxx Xxxxx 000X-0000 Xxxxxx, XX 00000 (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.