Common use of Subscribing LEA Clause in Contracts

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ NORTHSIDE ISD ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ NORTHSIDE ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ iDismiss, LLC ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“"Edspex”") works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“"Cybersecurity Frameworks”") that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) □ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 □ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 □ International Standards Organization (ISO) Information technology — - Security techniques — - Information security management systems (ISO 27000 series) □ Secure Controls Framework Council, LLC Security Controls Framework (SCF) □ Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) □ Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “"G”", Supplemental SDPC State Terms for Texas (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-▇▇▇▇▇▇ ISD Coppell lSD ] (the “"Local Education Agency” " or “"LEA”") and [ [ARTSONIA ] (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ CEV Multimedia, LLC ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Narragansett School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy TermsTerms . The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ Harvard Community ] and the ProviderProvider . **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: _ Printed Name: Title/PositionTitle/ Posit ion: _ SCHOOL DISTRICT NAMENAM E: _ DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“" Edspex”" ) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principlesprinciples * (“"Cybersecurity Frameworks”") that may be utilized utilize d by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) □ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 □ National Institute of Standards and Technology (NIST) Techno logy NIST SP 800-53, Cybersecurity Cyber security Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International □ Int ernational Standards Organization (ISO) Information technology — - Security techniques — Information - Inform at ion security management systems (ISO 27000 seriesserie s) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) □ Office of the Under Secretary of Defense for Acquisition Acquisiti on and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMCCM MC , ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ htt p:// www.eds pex.orq for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-▇▇▇▇▇▇ ISD ] Harvard Community Unit School District 50 (the “"Local Education Agency” " or “"LEA”" ) and [ ] Nearpod Inc. (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) ✔ Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) ✔ Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ SpecialNeedsWare, Inc. ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BYSubscribing LEA: BYx: Date: 5/03/2023 Printed Name: JxOExTTExRIxOS Title/Position: CxOORxDINAxTORxFORxDIGxITALxLEAxRNINxG SCHOOL DISTRICT NAME: :xNORxTHxEAxST xISD DESIGNATED REPRESENTATIVE OF LEA: NameNamex: JOxETxTExRIOxS xx Title: CxOORxDINAxTOR FxOR DxIGITAxL LExARNINxG Address: 9x803xBRxOAxDWxAY xSANxANxTOxNIOxTXx782x17x Telephone Number: x210x.356x.89x48 xx Email: ▇▇▇▇▇▇▇▇@▇▇▇▇▇▇▇▇.▇▇▇▇ xx The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ Studies Weekly, Inc. ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 X National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Clovis USD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Clovis USD, located at ▇▇▇▇ ▇▇▇▇▇▇▇ ISD ] (the ▇▇▇▇▇▇ Clovis, CA 93611(the “Local Education Agency” or “LEA”) and [ ] The Positivity Project, located at PO Box 87644 Fayetteville, NC 28304 (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Bunker Hill CUSD #8 and the Provider. ▇▇▇▇▇▇'▇ Database Solutions, Inc. DBA: Embrace® **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) X National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems ▇▇▇▇▇▇▇ (ISO 27000 ▇▇▇ ▇▇▇▇▇ series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR͂ FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-Bunker Hill CUSD #8(the "Local Education Agency" or "LEA") and ▇▇▇▇▇▇'▇ ISD ] Database Solutions, Inc DBA: Embrace® (the “Local Education Agency” or “LEA”) and [ ] (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Palmdale SD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Palmdale SD, located at ▇▇▇▇▇ ▇▇▇▇ ▇▇ ▇▇▇▇ ▇▇▇▇▇▇▇▇, ▇▇ ISD ] ▇▇▇▇▇(the “Local Education Agency” or “LEA”) and [ ] Thinking Maps Inc, located at ▇▇▇ ▇▇▇▇▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇ ▇▇▇▇, ▇▇ ▇▇▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇▇ (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] El Segundo USD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: El Segundo USD , located at641 ▇▇▇▇▇▇▇ ISD ] ▇▇▇▇▇▇ ▇▇ ▇▇▇▇▇▇▇ ▇▇ ▇▇▇▇▇ (the “Local Education Agency” or “LEA”) and [ ] True Progress LLC (the “Provider”). , is incorporated located at PO Box 5753, Hanover, NH 03755 All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Heyworth CUSD #4 and the Provider. ▇▇▇▇▇▇'▇ Database Solutions, Inc. DBA: Embrace® **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) X National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR͂ FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-Heyworth CUSD #4(the "Local Education Agency" or "LEA") and ▇▇▇▇▇▇'▇ ISD ] Database Solutions, Inc DBA: Embrace® (the “Local Education Agency” or “LEA”) and [ ] (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Sycamore Community School District 427 and the Provider. ▇▇▇▇▇▇'▇ Database Solutions, Inc. DBA: Embrace® **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) X National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR͂ FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-Sycamore Community School District 427(the "Local Education Agency" or "LEA") and ▇▇▇▇▇▇'▇ ISD ] Database Solutions, Inc DBA: Embrace® (the “Local Education Agency” or “LEA”) and [ ] (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: ▇▇▇▇▇ ▇▇▇▇▇▇ Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:NORTH EAST ISD

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Alameda Unified School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Alameda Unified School District, located at ▇▇▇▇ ▇▇▇▇▇▇▇▇▇▇ ISD ] ▇▇ ▇▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇(the “Local Education Agency” or “LEA”) and [ ] youmebee Ltd, located at The Gate, Keppoch Street, United Kingdom Cardiff, AK CF243JW (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Poway Unified School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Poway Unified School District, located at ▇▇▇▇▇ ▇▇▇▇▇▇ ISD ] ▇▇ ▇▇▇▇▇▇▇ ▇▇▇ ▇▇▇▇▇, ▇▇ ▇▇▇▇▇(the “Local Education Agency” or “LEA”) and [ ] ▇▇▇▇ ▇▇▇▇▇▇ LLC, located at ▇▇ ▇▇▇▇ ▇▇. #▇ ▇▇▇▇▇▇▇▇▇▇, ▇▇▇▇▇▇▇▇▇▇▇▇▇ ▇▇▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇▇ (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ ISD ] between: , located at (the “Local Education Agency” or “LEA”) and [ ] , located at (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Lodi Unified School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Lodi Unified School District, located at ▇▇▇▇ ▇ ▇▇▇▇ ▇▇ ▇▇▇▇ ▇▇ ▇▇▇▇▇ ▇▇▇▇, ▇▇ ▇▇▇▇▇▇ ISD ] (the “Local Education Agency” or “LEA”) and [ ] Clickteam, located at PO Box 965 Fairview, OR 97230 (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEAMansfield ISD ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ [Mansfield ISD ] (the “Local Education Agency” or “LEA”) and [ [Cadenza Strategy Group ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Chico USD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Chico USD, located at ▇▇▇▇ ▇ ▇▇▇▇▇▇▇ ISD ] ▇▇▇▇▇▇ ▇▇▇▇▇, ▇▇ ▇▇▇▇▇(the “Local Education Agency” or “LEA”) and [ ] Peakay Inc., located at ▇▇▇▇ ▇▇▇▇▇▇▇ ▇▇▇▇▇ ▇▇▇▇ #▇▇▇ ▇▇▇ ▇▇▇▇, ▇▇▇▇▇▇▇▇▇▇ ▇▇▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇▇ (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Twin Rivers and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) ✔ Other framework information - Please specify:Instrument Zeptive uses a Real Time Operating System (RTOS) based on the Linux kernel. Zeptive’s RTOS is designed to be more light-weight and less feature heavy than the full Linux solution. This enables Zeptive to only load the tools that are needed for our application and reduces the opportunity of susceptibility from unused tools. To build the Linux kernel Zeptive uses the Arduino framework built for ESP32 hardware. Cloud and Phone app Zeptive relies on a third-party company called Blynk to provide our phone application and web console functionality. Below are the security protocols in place that protect our devices and data transmissions. Cloud Security ▇▇▇▇▇.▇▇▇▇▇ has multiple layers of security: • Every message sent through Blynk is encrypted and secure (unless you're using hardware that doesn't support TLS) • Granular permissions allow you to manage who and how can see your devices and their data • Every user should have a valid email address. Blynk offers a built-in verification process • Server system design doesn't allow any other user than allowed by you to view the devices within your organization's hierarchy • Each device has its own unique OAuth token and Product ID. A combination of both these fields grants access to the device only for your organization • Constant monitoring allows us to react quickly to any possible incidents Blynk mostly relies on industry standards - transport layer security protocol, known as TLS. Blynk server by default tries to use the latest available protocol TLSv1.3 (or TLSv1.2 in case the TLSv1.3 version is not supported). Lower versions of TLS protocols TLSv1 and TLSv1.1 are not supported as they are considered being not secure. The server will automatically close connections with not supported TLS versions. Blynk uses 443 port (or 9443 if 443 is not available) for TLS connections and 80 port (or 8080 if 80 is not available) for plain connections (in case your hardware doesn't support it). We highly recommend using hardware that supports TLS. When we are talking about the security of Blynk cloud, we take into account these Blynk Products and components: • Blynk.Edgent that runs on the device • Blynk.Console and ▇▇▇▇▇.▇▇▇ for iOS and Android • ▇▇▇▇▇.▇▇▇▇▇ (or private servers for white- label solutions) Blynk.Edgent (hardware library) By default, Blynk.Edgent library tries to use TLS (v1.2) connection between the hardware and server. This is true for popular hardware like ESP32, ESP8266, NodeMCU, MKR 1000, etc. However, some boards don't support TLS, in that case, a plain (non-encrypted) connection is used. You can check that in the serial console output of your board. A typical TLS connection port would be 443. For the plain connections, port 80 is used. Default authentication for the hardware is OAuth secured token, it looks like this xw7ITVneg1DifRRQuPGcA7fJvV8-FAVl and represents 24 bytes in base 64 encoding. The token could be changed with the re-provision flow. Blynk.Apps for iOS and Android Blynk uses secured web sockets (TLSv1.3 in case your browser supports it, TLSv1.2 otherwise) for communication and basic authentication (email/password). for Blynk.Console and mobile apps Passwords are encrypted on the client side before transferring to the cloud server and are never stored or transferred in plain format. Only encrypted password hash is stored and used on the server. After 5 failed login attempts from the same IP - the IP is not allowed to log in for the next 10 minutes. ▇▇▇▇▇.▇▇▇▇▇ • All data transferred between the cloud and the database is always encrypted • The database is fully isolated within the private network • The database doesn't have access to the internet and can be accessed from the private network only • The database itself is not encrypted. Encryption is available for white- label solution as a paid add-on Certificates Blynk uses Let's Encrypt certificates for TLS connections. Certificates are renewed every 2 months. Ports Blynk doesn't require any non- standard ports. • 443 port is used for TLS connections (9443 if 443 is not available) • 80 port is used for plain connections (8080 if 80 is not available) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Twin Rivers, located at ▇▇▇▇ ▇▇▇▇▇▇ ISD ] (the ▇▇▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇▇▇, CA 95652(the “Local Education Agency” or “LEA”) and [ ] Zeptive, Inc, located at ▇▇▇ ▇▇▇▇▇▇▇▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇ ▇▇▇ ▇▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇▇ Minor Outlying Islands (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Rocklin USD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) ✔ Other framework information - Please specify: Encryption in transit and at rest/ RBAC/ Data Back-ups/ Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Rocklin USD, located at ▇▇▇▇ ▇▇▇▇▇▇ ISD ] (the ▇▇▇▇▇▇▇ ▇▇▇▇▇ Rocklin, CA 95677(the “Local Education Agency” or “LEA”) and [ ] Twinkl Ltd., located at ▇▇▇▇▇ ▇▇▇▇▇▇▇▇, ▇▇▇ ▇▇▇▇▇▇▇▇▇ ▇▇▇▇ ▇▇▇▇▇▇▇▇▇, ▇▇ ▇▇▇ ▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇▇▇ (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ ISD Prosper Independent School District ] (the “Local Education Agency” or “LEA”) and [ [Nutri-Link Technologies, Inc. ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ QuaverEd, Inc. ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Sylvan Union School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Sylvan Union School District, located at ▇▇▇ ▇▇▇▇▇▇ ISD ] ▇▇▇▇▇▇ ▇▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇(the “Local Education Agency” or “LEA”) and [ ] SOAR Learning, Inc., located at ▇▇ ▇▇▇ ▇▇▇ ▇▇▇▇ ▇▇▇▇▇, ▇▇▇▇▇▇▇▇ ▇▇▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇▇ (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] La Habra City School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: La Habra City School District, located at ▇▇▇ ▇. ▇▇▇▇▇▇ ISD ] ▇▇. ▇▇ ▇▇▇▇▇, ▇▇ ▇▇▇▇▇(the “Local Education Agency” or “LEA”) and [ ] Little Monkey Apps, located at ▇▇▇ ▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇▇▇, ▇▇▇▇▇▇▇▇ ▇▇▇▇ Australia (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Woodland Joint USD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Woodland Joint USD, located at ▇▇▇ ▇▇▇ ▇▇▇▇▇▇ ISD ] ▇▇▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇(the “Local Education Agency” or “LEA”) and [ ] Gradecam Inc, located at ▇▇▇▇ ▇▇▇▇▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇▇ (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems ▇▇▇▇▇▇▇ (ISO 27000 ▇▇▇ ▇▇▇▇▇ series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ ISD ] ����� ������ �������� ��� (the “Local Education Agency” or “LEA”) and [ ] Everyday Speech LLC (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Carlinville CUSD #1 and the Provider. ▇▇▇▇▇▇'▇ Database Solutions, Inc. DBA: Embrace® **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) X National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR͂ FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-Carlinville CUSD #1(the "Local Education Agency" or "LEA") and ▇▇▇▇▇▇'▇ ISD ] Database Solutions, Inc DBA: Embrace® (the “Local Education Agency” or “LEA”) and [ ] (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ ISD [Cypress-Fairbanks ISD] (the “Local Education Agency” or “LEA”) and [ Multi-Health Systems, Inc] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ Frisco ISD ] (the “Local Education Agency” or “LEA”) and [ Human Restoration Project ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Desert Sands Unified School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) ✔ Other framework information - Please specify:Yabla will protect the security and integrity of the data with reasonable administrative, technical, operational, and physical safeguards and practices. Physical and logical access controls, identity and access management, encryption for data-at-rest and data-in-motion, intrusion detection and prevention, vulnerability scanning/patching, disaster recovery solution, malicious software detection, and network segmentation. Data In Motion: Our "data in motion" is encrypted and protected by SSL (Secure Sockets Layer), TLS (Transport Layer Security), and HTTPS (Hypertext Transfer Protocol). These are network transfer protocols that encrypt and secures the transfer of data between our server and the clients. Data at Rest / Data In Use: Stored in MariaDB database, and is encrypted by OpenSSL and Advanced Encryption Standard (AES) with 256 bits encryption keys. The physical location of our server is Linode hosted in Newark, NJ. Data at Rest: We also have backups on AWS which are already encrypted with SSE-S3 (Server Side Encryption S3). Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇between: Desert Sands Unified School District, located at ▇▇▇▇▇ ISD ] (the ▇▇▇▇ ▇▇▇▇▇ ▇▇. La Quinta, CA 92253(the “Local Education Agency” or “LEA”) and [ ] Yabla, Inc., located at ▇▇▇ ▇▇▇▇▇▇▇▇ ▇▇▇. Ste. ▇▇▇ ▇▇▇▇▇ ▇▇▇▇, ▇▇ ▇▇▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇▇ (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ Infobase Holdings, Inc ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Prosper Independent School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ ISD ] (the “Local Education Agency” or “LEA”) and [ ASB Classroom LLC ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) X National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 X International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ Formative ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] ▇▇▇▇▇▇ Elementary SD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: ▇▇▇▇▇▇ ISD ] Elementary SD, located at ▇▇▇▇▇ ▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇(the “Local Education Agency” or “LEA”) and [ ] Kokotots Inc., located at ▇▇ ▇▇▇▇▇▇▇▇ ▇▇▇▇ ▇▇▇▇▇▇▇, ▇▇ ▇▇▇ ▇▇▇ ▇▇▇▇▇▇ (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Lodi Unified School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Lodi Unified School District, located at ▇▇▇▇ ▇ ▇▇▇▇ ▇▇ ▇▇▇▇ ▇▇ ▇▇▇▇▇ ▇▇▇▇, ▇▇ ▇▇▇▇▇▇ ISD ] (the “Local Education Agency” or “LEA”) and [ ] Blue Bridge LLC, located at ▇▇▇ ▇▇▇▇▇▇▇▇▇▇ ▇▇. ▇▇▇▇▇▇ ▇▇▇▇▇, ▇▇ ▇▇▇▇▇ (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. [ School or LEA ] This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ ISD ] (the “Local Education Agency” or “LEA”) and [ ] Artsonia LLC (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Lafayette District Schools, Mayo, Florida BY: Date: Printed Name: ▇▇▇▇ ▇▇▇▇▇▇ Title/Position: Network Manager Standard Data Privacy Agreement between Lafayette District Page | 18 of 25 Schools, Mayo, Florida and Banzai Inc. . SCHOOL DISTRICT NAME: LAFAYETTE DISTRICT SCHOOLS, MAYO, FLORIDA DESIGNATED REPRESENTATIVE OF LEA: Name: Title: ▇▇▇▇ ▇▇▇▇▇▇ Network Administrator Address: ▇▇▇ ▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇ ▇▇▇▇, ▇▇ ▇▇▇▇▇ Telephone Number: ▇▇▇-▇▇▇-▇▇▇▇ Standard Data Privacy Agreement between Lafayette District Schools, Mayo, Florida and . Banzai Inc. Email: ▇▇▇▇▇▇▇@▇▇▇▇▇▇▇▇.▇▇▇ Page | 19 of 25 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Standard Data Privacy Agreement between Lafayette District Schools, Mayo, Florida and . Banzai Inc. Page | 20 of 25 Standard Data Privacy Agreement between Lafayette District Schools, Mayo, Florida and . Banzai Inc. [The State Supplement is an optional set of terms that will be generated on an as-needed basis in collaboration between the national SDPC legal working group and the State Consortia. The scope of these State Supplements will be to address any state specific data privacy statutes and their requirements to the extent that they require terms in addition to or different from the National Standard Clauses. The State Supplements will be written in a manner such that they will not be edited/updated by individual parties and will be posted on the SDPC website to provide the authoritative version of the terms. Any changes by LEAs or Providers will be made in amendment form in an Exhibit (Exhibit “G”, Supplemental SDPC State Terms for Texas (H” in this proposed structure).] Page | 21 of 25 THIS EXHIBIT “Supplemental State Terms”), H” effective simultaneously with the attached Student Data Date Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ ISD ] Lafayette District Schools, Mayo, Florida, (the “Local Education Agency” or “LEA”) and [ ] Banzai Inc. , (the “Provider”), ) is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ Midway ISD ] (the “Local Education Agency” or “LEA”) and [ Catapult K12 ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ ISD ] (the “Local Education Agency” or “LEA”) and [ Motivating Systems, LLC ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Provo City School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 X International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This The State Supplement is an optional set of terms that will be generated on an as-needed basis in collaboration between the national SDPC legal working group and the State Consortia. The scope of these State Supplements will be to address any state specific data privacy statutes and their requirements to the extent that they require terms in addition to or different from the National Standard Clauses. The State Supplements will be written in a manner such that they will not be edited/updated by individual parties and will be posted on the SDPC website to provide the authoritative version of the terms. Any changes by LEAs or Providers will be made in amendment form in an Exhibit (Exhibit “G”H” in this proposed structure). ▇▇▇ and Provider agree to the following additional terms and modifications: This is a free text field that the parties can use to add or modify terms in or to the DPA. If there are no additional or modified terms, Supplemental SDPC this field should read “None.” The Early Intervention Software Program (EISP), established by the Utah State Terms Legislature and administered by the Utah State Board of Education (USBE), provides Utah’s Local Education Agencies (LEAs) with the opportunity to select adaptive computer-based literacy software programs. The goal of this program is to increase literacy outcomes for Texas kindergarten through grade 3 students. In an effort to support the EISP, the provider agrees to perform the requirements of this exhibit for applicable grade K-3 student users of Lexia Core5, that are placed and confirmed by the purchasing LEA as orders funded through the EISP. For the avoidance of doubt, the terms of this Exhibit H shall only apply only to orders of the Lexia Core5 product licenses that the LEA confirms to Provider in writing to be orders utilizing the funding available under the EISP. As part of the EISP, and as more fully described below, certain data relating to use by students in select grades of designated provider Lexia Core5 products for all LEAs and orders funded through the EISP is to be provided by the provider to a third-party evaluator determined and engaged by USBE (the “Supplemental State TermsEISP Evaluator”), effective simultaneously with and Provider is hereby authorized and instructed by the attached Student Data Privacy Agreement (“DPA”) USBE and LEA to deliver applicable data to the designated EISP Evaluator according to the schedule and secure file transfer process as determined and/or authorized by the USBE for EISP Evaluator and between [ Lubbock-▇▇▇Provider, and to perform the actions, under and as provided in this Exhibit H. Provider and ▇▇▇ ISD ] acknowledge and agree that USBE will have sole authority and discretion as to the selection and designation of the EISP Evaluator and the terms and obligations applicable to Provider under this Exhibit H, and USBE may change the EISP Evaluator, change or terminate Provider’s data sharing and other commitments hereunder, or otherwise modify provider’s obligations under the EISP Program and/or this Exhibit H, at any time upon prior written notice to and subject to the mutual agreement of the Provider. Provider and ▇▇▇ further acknowledge and agree that, notwithstanding the Provider actions and commitments hereunder, (i) the “Local Education Agency” or “LEA”ultimate responsibility for the determination of which subscriptions and student user information is subject to EISP program funding and the associated program reporting is always the responsibility of the purchasing LEA (and not Provider); and (ii) without limiting (i) above, the default assumption that USBE and [ ] the LEA intends Provider to operate under is that any and all K-3 Lexia Core5 subscriptions purchased by any LEA (the “Provider”and/or any Utah district and/or school, including Utah private and charter schools), is incorporated whether rostered or managed manually or via Clever or other third-party integration system utilized by the LEA or school and supported by Provider, are to be presumed by Provider to be in-scope as EISP Program funded and subject to EISP program reporting to the EISP Evaluator under the reporting parameters, unless and until the purchasing LEA or other purchasing entity (or the USBE or its EISP Evaluator) affirmatively conveys otherwise to Provider in writing. Unless otherwise instructed by USBE and/or EISP Evaluator agreed by Provider in writing, prior to the date at the end of each school year determined and agreed by the EISP Evaluator and Provider that Provider actually shares the EISP program reporting data to the EISP Evaluator, Provider will send a written notification to all identified account administrators in Provider’s systems for all LEAs and/or other Utah school and district entities that purchased the software during the then-current year, informing them that, unless Provider receives written instructions from the applicable purchasing LEA or school or district account administrator within a prescribed period, Provider will include and share information in reporting to the EISP Evaluator of Core5 student users in grades (K-3) for which Provider has SSID information, together with all applicable in-scope EISP program reporting data from other LEAs, according to the same schedule and process and data format as determined and agreed by the USBE and/or the EISP Evaluator, and Provider, for all such data transfers. Provider’s obligations under this Exhibit H shall continue during the term of all applicable LEA subscription orders subject to this Exhibit H, and until the earlier of written notification by the USBE and/or the EISP Evaluator to Provider of termination of the EISP program or of Provider’s obligations under this Exhibit H. For clarity, in the attached DPA event of any conflict or inconsistency between Provider’s terms with, instructions or authorizations received from, the LEA and/or any school, and amends those herein or received by Provider from the DPA (USBE or the EISP Evaluator, with respect to this DPA, Exhibit H or the subject matter hereof, ▇▇▇ and all supplemental terms Provider agree that any terms, authorizations and/or instructions received by Provider from the EISP Evaluator and/or the USBE shall control. Provider is authorized and conditions instructed by the USBE and policies applicable ▇▇▇ to comply with instructions as may be communicated directly to the DPAProvider by the designated EISP Evaluator from time to time. Current external data standards that Provider will support include, but are not limited to: a. Work with schools to ensure the student data contains the correct State Student IDs (SSIDs) b. Preparing and submitting in-scope data for mid-year data review c. Make corrections in response to mid-year data review d. Notify evaluator/USBE of any changes in the participation status of schools who purchased licenses for the software at the beginning of the year. e. Comply with evaluator data requests, including providing all requested data in the requested format. Note: requested data includes student IDs, grade, District/school name, and program usage information (e.g. time spent in minutes for each week of program use, total weeks of use and minutes of use, etc.) as follows:among other variables. f. Review data for accuracy, completeness (e.g. all participants/LEAs included), and check for compliance to evaluator instructions prior to submissions of final data at end of year. g. Submit final data by deadlines specified by the evaluator/USBE using secure transfer method. h. Communicate and staffing changes and/or challenges involving the data requests early to the evaluator.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Modesto City Schools and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) ✔ Other framework information - Please specify: SOC 2 Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Modesto City Schools, located at ▇▇▇ ▇▇▇▇▇▇ ISD ] ▇▇▇▇▇▇ ▇▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇(the “Local Education Agency” or “LEA”) and [ ] Playbook Music Inc., located at ▇▇▇ ▇▇▇ ▇▇▇▇▇▇ ▇▇▇ ▇▇▇ ▇▇▇ ▇▇▇▇, ▇▇ ▇▇▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇▇ Minor Outlying Islands (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] North ▇▇▇▇▇ School District 200 and the Provider. ▇▇▇▇▇▇'▇ Database Solutions, Inc. DBA: Embrace® **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) X National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems ▇▇▇▇▇▇▇ (ISO 27000 ▇▇▇ ▇▇▇▇▇ series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR͂ FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-North ▇▇▇▇▇ School District 200(the "Local Education Agency" or "LEA") and ▇▇▇▇▇▇'▇ ISD ] Database Solutions, Inc DBA: Embrace® (the “Local Education Agency” or “LEA”) and [ ] (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Rocklin USD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Rocklin USD, located at ▇▇▇▇ ▇▇▇▇▇▇ ISD ] (the ▇▇▇▇▇▇▇ ▇▇▇▇▇ Rocklin, CA 95677(the “Local Education Agency” or “LEA”) and [ ] FlexiSCHED, located at ▇▇▇ ▇▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇▇ Portage, WI 53901 United States (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ Master District ] and the ProviderOmega Labs Inc dba Boom Learning. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: Last Updated 2021-03-15 – New Illinois Exhibit G IL-NDPA v 1.0a Page 17 of 23 The Education Security and Privacy Exchange (“"Edspex”") works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“"Cybersecurity Frameworks”") that may be utilized by Provider Provider. Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 Technology □ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Technology Improving Critical Infrastructure Cybersecurity □ (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — - Security techniques — □□ - Information security management systems ▇▇▇▇▇▇▇ (ISO 27000 ▇▇▇ ▇▇▇▇▇ series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) □ Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Cybersecurity Maturity Model Certification Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here Last Updated 2021-03-15 - New Illinois Exhibit G IL-NDPA Version 1.0a Page 18 of 22 EXHIBIT "G" - Supplemental SDPC State Terms for Illinois This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-▇▇▇▇▇▇ ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:between

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ Grayslake CHSD 12 ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems ▇▇▇▇▇▇▇ (ISO 27000 ▇▇▇ ▇▇▇▇▇ series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ ISD ] Grayslake CHSD 127 (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:and

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: 11/17/2023 Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) ✔ Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ aRndiv[erside Assessments, ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] LEA and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) x National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, 1190353v1 Supplemental SDPC State Terms for Texas (“Supplemental [State] Version [The State Terms”), effective simultaneously with Supplement is an optional set of terms that will be generated on an as-needed basis in collaboration between the attached Student Data Privacy Agreement (“DPA”) by national SDPC legal working group and between [ Lubbock-▇▇▇▇▇▇ ISD ] (the “Local Education Agency” or “LEA”) State Consortia. The scope of these State Supplements will be to address any state specific data privacy statutes and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable their requirements to the DPA) as follows:extent that they require terms in addition to or different from the National Standard Clauses. The State Supplements will be written in a manner such that they will not be edited/updated by individual parties and will be posted on the SDPC website to provide the authoritative version of the terms. Any changes by LEAs or Providers will be made in amendment form in an Exhibit (Exhibit “H” in this proposed structure).

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] La Habra City School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: La Habra City School District, located at ▇▇▇ ▇. ▇▇▇▇▇▇ ISD ] ▇▇. ▇▇ ▇▇▇▇▇, ▇▇ ▇▇▇▇▇(the “Local Education Agency” or “LEA”) and [ ] HAVOC LLC, located at ▇▇▇▇ ▇▇▇▇ ▇▇▇▇▇ ▇▇ ▇▇▇▇▇ ▇▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇▇ (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Cambridge Public Schools and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5PROVIDER. ** Subscribing LEA: (School District Name): BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 x International Standards Organization (ISO) Organization** Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This **Please see the following Attachment to Exhibit “G”F” for an explanation of Provider’s current practices. Attachment to Exhibit “F” Provider is actively working towards certification with ISO 27001 because Provider takes data privacy and security seriously. In the meantime, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with Provider has detailed below the attached Student Data Privacy Agreement (“DPA”) by security standards it currently follows. 1. All of Provider’s employees receive data privacy and between [ Lubbock-▇▇▇▇▇▇ ISD ] (protection training upon hire and at least once annually. 2. Provider only grants system access to its authorized personnel and strictly limits such access only to such customer data that is required to fulfill the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:personnel’s job function.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Lodi Unified School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) ✔ Other framework information - Please specify:We employ proprietary encryption algorithms to protect the limited, non-PII application usage data transmitted from the running application to our anti-piracy and usage tracking server.Once received, the data is stored in an unencrypted state on a server which is secured behind firewalls and located in a secure co-location facility. Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Lodi Unified School District, located at 13▇▇ ▇ ▇▇▇▇ ▇▇ ▇▇▇▇ ▇▇ ▇▇▇▇▇ ▇▇▇▇, ▇▇ ▇▇▇▇▇▇ ISD ] (the ▇he “Local Education Agency” or “LEA”) and [ ] Ashlar-Vellum, located at 96▇▇ ▇▇▇▇▇ ▇▇▇▇▇ ▇▇▇▇▇ ▇▇▇▇▇ ▇▇▇▇-▇▇▇▇ ▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇ (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: 09-06-2023 Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ SCUTA ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider▇▇▇▇▇ ▇. ▇▇▇▇▇▇▇▇▇ HS D125. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** [Insert Name of Subscribing LEA] BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider Provider. Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 X International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. EXHIBIT "G" - Supplemental SDPC (Student Data Privacy Consortium) State Terms for Illinois Version IL-NDPAv1.0a (Revised March 15, 2021) This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-▇▇▇▇▇ ▇. ▇▇▇▇▇▇▇▇▇ ISD ] HS Dist. 125 (the “"Local Education AgencyAgency ▇▇▇▇▇ ▇. ▇▇▇▇▇▇▇▇▇ HS ” or “"LEA”") and [ ] Grammarly, Inc. (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] ▇▇▇▇▇▇▇▇ District 70 and the Provider. ▇▇▇▇▇▇'▇ Database Solutions, Inc. DBA: Embrace® **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) X National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems ▇▇▇▇▇▇▇ (ISO 27000 ▇▇▇ ▇▇▇▇▇ series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR͂ FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-▇▇▇▇▇▇▇▇ ISD ] (the “District 70(the "Local Education Agency” " or “"LEA”") and [ ] ▇▇▇▇▇▇'▇ Database Solutions, Inc DBA: Embrace® (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) ✔ Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ Certiport, a business of ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Sacramento City USD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Sacramento City USD, located at ▇▇▇▇ ▇▇▇▇ ▇▇▇▇▇▇ ISD ] ▇▇▇▇▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇(the “Local Education Agency” or “LEA”) and [ ] The Language Gym Limited, located at ▇▇ ▇ ▇▇/▇ ▇▇▇▇▇▇ ▇▇ ▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇ ▇▇▇▇, ▇▇▇▇▇▇ ▇▇▇ 999077 Hong Kong (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Wasco Union Elementary SD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Wasco Union Elementary SD, located at ▇▇▇▇ ▇▇▇ ▇▇▇▇▇▇ ISD ] ▇▇▇▇▇, ▇▇ ▇▇▇▇▇(the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:or

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA▇▇▇▇▇ Independent S] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇[▇▇▇▇▇ ISD Independent Sc ] (the “Local Education Agency” or “LEA”) and [ Securly ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] ( ▇▇▇▇▇▇▇ School District) and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: BY: _ Date: 09/18/2023 Printed Name: ▇▇▇▇▇ ▇▇▇▇▇▇▇▇ Educational Technology Direc tor SCHOOL DISTRICT NAME: ▇▇▇▇▇▇▇ School District DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 X International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This The State Supplement is an optional set of terms that will be generated on an as-needed basis in collaboration between the national SDPC legal working group and the State Consortia. The scope of these State Supplements will be to address any state specific data privacy statutes and their requirements to the extent that they require terms in addition to or different from the National Standard Clauses. The State Supplements will be written in a manner such that they will not be edited/updated by individual parties and will be posted on the SDPC website to provide the authoritative version of the terms. Any changes by LEAs or Providers will be made in amendment form in an Exhibit (Exhibit “G”H” in this proposed structure). ▇▇▇ and Provider agree to the following additional terms and modifications: This is a free text field that the parties can use to add or modify terms in or to the DPA. If there are no additional or modified terms, Supplemental SDPC this field should read “None.” The Early Intervention Software Program (EISP), established by the Utah State Terms Legislature and administered by the Utah State Board of Education (USBE), provides Utah’s Local Education Agencies (LEAs) with the opportunity to select adaptive computer-based literacy software programs. The goal of this program is to increase literacy outcomes for Texas kindergarten through grade 3 students. In an effort to support the EISP, the provider agrees to perform the requirements of this exhibit for applicable grade K-3 student users of Lexia Core5, that are placed and confirmed by the purchasing LEA as orders funded through the EISP. For the avoidance of doubt, the terms of this Exhibit H shall only apply only to orders of the Lexia Core5 product licenses that the LEA confirms to Provider in writing to be orders utilizing the funding available under the EISP. As part of the EISP, and as more fully described below, certain data relating to use by students in select grades of designated provider Lexia Core5 products for all LEAs and orders funded through the EISP is to be provided by the provider to a third-party evaluator determined and engaged by USBE (the “Supplemental State TermsEISP Evaluator”), effective simultaneously and Provider is hereby authorized and instructed by the USBE and LEA to deliver applicable data to the designated EISP Evaluator according to the schedule and secure file transfer process as determined and/or authorized by the USBE for EISP Evaluator and Provider, and to perform the actions, under and as provided in this Exhibit H. Provider and ▇▇▇ acknowledge and agree that USBE will have sole authority and discretion as to the selection and designation of the EISP Evaluator and the terms and obligations applicable to Provider under this Exhibit H, and USBE may change the EISP Evaluator, change or terminate Provider’s data sharing and other commitments hereunder, or otherwise modify provider’s obligations under the EISP Program and/or this Exhibit H, at any time upon prior written notice to and subject to the mutual agreement of the Provider. Provider and ▇▇▇ further acknowledge and agree that, notwithstanding the Provider actions and commitments hereunder, (i) the ultimate responsibility for the determination of which subscriptions and student user information is subject to EISP program funding and the associated program reporting is always the responsibility of the purchasing LEA (and not Provider); and (ii) without limiting (i) above, the default assumption that USBE and the LEA intends Provider to operate under is that any and all K-3 Lexia Core5 subscriptions purchased by any LEA (and/or any Utah district and/or school, including Utah private and charter schools), whether rostered or managed manually or via Clever or other third-party integration system utilized by the LEA or school and supported by Provider, are to be presumed by Provider to be in-scope as EISP Program funded and subject to EISP program reporting to the EISP Evaluator under the reporting parameters, unless and until the purchasing LEA or other purchasing entity (or the USBE or its EISP Evaluator) affirmatively conveys otherwise to Provider in writing. Unless otherwise instructed by USBE and/or EISP Evaluator agreed by Provider in writing, prior to the date at the end of each school year determined and agreed by the EISP Evaluator and Provider that Provider actually shares the EISP program reporting data to the EISP Evaluator, Provider will send a written notification to all identified account administrators in Provider’s systems for all LEAs and/or other Utah school and district entities that purchased the software during the then-current year, informing them that, unless Provider receives written instructions from the applicable purchasing LEA or school or district account administrator within a prescribed period, Provider will include and share information in reporting to the EISP Evaluator of Core5 student users in grades (K-3) for which Provider has SSID information, together with all applicable in-scope EISP program reporting data from other LEAs, according to the attached same schedule and process and data format as determined and agreed by the USBE and/or the EISP Evaluator, and Provider, for all such data transfers. Provider’s obligations under this Exhibit H shall continue during the term of all applicable LEA subscription orders subject to this Exhibit H, and until the earlier of written notification by the USBE and/or the EISP Evaluator to Provider of termination of the EISP program or of Provider’s obligations under this Exhibit H. For clarity, in the event of any conflict or inconsistency between Provider’s terms with, instructions or authorizations received from, the LEA and/or any school, and those herein or received by Provider from the USBE or the EISP Evaluator, with respect to this DPA, Exhibit H or the subject matter hereof, ▇▇▇ and Provider agree that any terms, authorizations and/or instructions received by Provider from the EISP Evaluator and/or the USBE shall control. Provider is authorized and instructed by the USBE and ▇▇▇ to comply with instructions as may be communicated directly to the Provider by the designated EISP Evaluator from time to time. Current external data standards that Provider will support include, but are not limited to: a. Work with schools to ensure the student data contains the correct State Student Data Privacy Agreement IDs (“DPA”SSIDs) b. Preparing and submitting in-scope data for mid-year data review c. Make corrections in response to mid-year data review d. Notify evaluator/USBE of any changes in the participation status of schools who purchased licenses for the software at the beginning of the year. e. Comply with evaluator data requests, including providing all requested data in the requested format. Note: requested data includes student IDs, grade, District/school name, and program usage information (e.g. time spent in minutes for each week of program use, total weeks of use and minutes of use, etc.) among other variables. f. Review data for accuracy, completeness (e.g. all participants/LEAs included), and check for compliance to evaluator instructions prior to submissions of final data at end of year. g. Submit final data by deadlines specified by the evaluator/USBE using secure transfer method. h. Communicate and between [ Lubbock-staffing changes and/or challenges involving the data requests early to the evaluator. The Lexia products gather various information, some of which includes personally identifiable information, based on the nature of the product interaction. See Table 1 below. Some personal information is provided in required fields that are necessary to enable product provisioning and functionality. The Lexia products include additional functionalities that enable the school designated administrator, at his/her option, to select and input additional specified information fields, in order to enable the school to review academic progress across selected student demographics. The school administrator determines whether these additional optional fields are selected and used or left hidden and unfilled. Information Collected for Operation Required/Automatic or Optional* General Purpose of Collection Student First and Last Name Required Required to support product functionality Student Username Required Required to support product functionality Student Password Required Required to support product functionality Grade Required Required to support product functionality School ID Required Required to support product functionality Instructional Language Required Required to support product functionality Student Middle Initial, Suffix Optional* *If selected by School Administrator Student DOB Optional* *If selected by School Administrator Student Gender Optional* *If selected by School Administrator Student Race Demographics Optional* *If selected by School Administrator Student Program Eligibility Optional* *If selected by School Administrator Free/Reduced Lunch Eligibility Optional* *If selected by School Administrator Economic Disadvantage Optional* *If selected by School Administrator ELL (English Language Learner) Optional* *If selected by School Administrator Title 1 Funds Eligibility Optional* *If selected by School Administrator IDEA Eligibility Optional* *If selected by School Administrator Teacher First and Last Name Optional* *If selected by School Administrator Teacher Email Required Required to support product functionality Teacher Password Required Required to support product functionality School Leader/Admin First and Last Name Required Required to support product functionality School Leader/Admin Role Required Required to support product functionality School Leader/Admin Email Address Required Required to support product functionality School Leader /Admin Password Required Required to support product functionality School Leader /Admin Phone Number Optional Required to support product functionality School Name Required Required to support product functionality School Address Required Required to support product functionality IP Address Automatic Required to support product functionality Date/Time of Requests Automatic Required to support product functionality Browser User Agent Automatic Required to support product functionality Browser Session Identifier Automatic Required to support product functionality Http Endpoint and Query Parameters Automatic Required to support product functionality Lexia Internal user_id or student_id Automatic Required to support product functionality Student API Calls Automatic Required to support product functionality Quote #: Q-560717-1 Prepared By: ▇▇▇▇▇ ▇▇▇▇▇▇▇ ISD ] Created Date: 8/22/2023 Email: ▇▇▇▇▇.▇▇▇▇▇▇▇@▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇ Quote To: ▇▇▇▇▇▇ ▇▇▇▇ ▇▇▇▇▇▇▇ School District 285 E 450 N Delta, UT 84624 US Bill To: Drake ▇▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇ School District 285 E 450 N Delta, UT 84624 US 8/1/2023 7/31/2024 2 Lexia Core5 Reading Unlimited School Subscription Renewal - Delta North and Fillmore Elementary Schools. $10,500.00 $21,000.00 8/1/2023 7/31/2024 145 Lexia Core5 Reading Student Subscription Renewal - Delta South Elementary $44.00 $6,380.00 Fax or email Purchase Orders with quote number Q-560717-1 to the following: Attn: ▇▇▇▇▇ ▇▇▇▇▇▇▇ Email: ▇▇▇▇▇.▇▇▇▇▇▇▇@▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇▇ Fax: ▇▇▇-▇▇▇-▇▇▇▇ Total Price $27,380.00 **Prices included herein are exclusive of all applicable taxes, including sales tax, VAT or other duties or levies imposed by any federal, state or local authority, which are the responsibility of Customer. Any taxes shown are estimates for informational purposes only. Customer will provide documentation in support of tax exempt status upon request. Pricing is valid 60 days. Lexia will invoice the total price set forth above upon Customer’s acceptance. Payment is due net 30 days of invoice. TERM This quote serves as an Order Agreement and becomes effective upon its acceptance by both parties. The Product/Services purchased pursuant to this Agreement will begin on or about the start date set forth above and continue in effect for the Product/Service Term set forth above (the “Local Education Agency” or “LEA”) and [ ] (the “ProviderSubscription Period”). Unless otherwise set forth herein, is incorporated all Product licenses shall have the same start and end dates, all Products are deemed delivered upon provisioning of license availability, and all Services must be used within the Subscription Period; unused Product licenses or Services are not eligible for refund or credit. Onsite training fulfilled with virtual training equivalency as needed. Virtual training equivalency = four (4) live online sessions for each onsite training day session. Without prejudice to its other rights, Lexia may suspend delivery of the Product/Services in the attached DPA and amends event that Customer fails to make any payment when due. ORDER PROCESS To submit an order, please fax this quote along with the DPA applicable Purchase Order to: (and all supplemental terms and conditions and policies applicable ▇▇▇) ▇▇▇-▇▇▇▇, or send by email to the DPA) as follows:your sales representative's email address listed above.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ ISD ] (the “Local Education Agency” or “LEA”) and [ LabEx Tech Co., Ltd. ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Santa ▇▇▇▇▇▇ Malibu USD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Santa ▇▇▇▇▇▇ ISD ] Malibu USD, located at ▇▇▇▇ ▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇ ▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇(the “Local Education Agency” or “LEA”) and [ ] ▇▇▇▇▇▇ Productions, located at ▇▇▇ ▇. ▇▇▇ ▇▇▇ ▇▇▇ #▇▇▇▇ ▇▇▇ ▇▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇▇ (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ ISD Prosper Independent School District ] (the “Local Education Agency” or “LEA”) and [ Byrdseed, LLC ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and Valley View School District 365U the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) X National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 X National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) X Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. EXHIBIT "G" - Supplemental SDPC (Student Data Privacy Consortium) State Terms for Illinois This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-▇▇▇▇▇▇ ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:between

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ Mansfield ISD ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ Mansfield ISD ] (the “Local Education Agency” or “LEA”) and [ Grace Media LLC ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Woodland Joint USD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Woodland Joint USD, located at ▇▇▇ ▇▇▇ ▇▇▇▇▇▇ ISD ] ▇▇▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇(the “Local Education Agency” or “LEA”) and [ ] ▇▇▇▇▇ ▇▇▇▇▇▇▇▇, located at ▇▇ ▇▇▇ ▇▇▇▇ ▇▇▇▇▇▇▇▇▇▇, ▇▇▇▇▇▇▇▇▇▇ ▇▇▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇▇ (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] South Holland School District 150 and the Provider. ▇▇▇▇▇▇'▇ Database Solutions, Inc. DBA: Embrace® **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) X National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems ▇▇▇▇▇▇▇ (ISO 27000 ▇▇▇ ▇▇▇▇▇ series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR͂ FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-South Holland School District 150(the "Local Education Agency" or "LEA") and ▇▇▇▇▇▇'▇ ISD ] Database Solutions, Inc DBA: Embrace® (the “Local Education Agency” or “LEA”) and [ ] (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Date: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ EBSCO Publishing, Inc. ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Desert Sands Unified School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇between: Desert Sands Unified School District, located at ▇▇▇▇▇ ISD ] (the ▇▇▇▇ ▇▇▇▇▇ ▇▇. La Quinta, CA 92253(the “Local Education Agency” or “LEA”) and [ ] 2HAC Studio, located at ▇▇ ▇▇ ▇▇▇▇ ▇▇▇▇▇ ▇▇ Noi, ▇▇▇▇▇▇ ▇▇▇▇ 10000 Vietnam (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ ISD ] School District 140 (the “Local Education Agency” or “LEA”) and [ ] Everyday Speech LLC (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Lodi Unified School District and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Lodi Unified School District, located at ▇▇▇▇ ▇ ▇▇▇▇ ▇▇ ▇▇▇▇ ▇▇ ▇▇▇▇▇ ▇▇▇▇, ▇▇ ▇▇▇▇▇▇ ISD ] (the “Local Education Agency” or “LEA”) and [ ] SmartSchool Systems, located at ▇▇▇▇ ▇▇▇▇▇▇▇▇▇ ▇▇▇▇▇ ▇▇▇▇▇ ▇▇▇ ▇▇▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇▇ (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) ✔ Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ BrainPOP LLC ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ I ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 X International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This The State Supplement is an optional set of terms that will be generated on an as-needed basis in collaboration between the national SDPC legal working group and the State Consortia. The scope of these State Supplements will be to address any state specific data privacy statutes and their requirements to the extent that they require terms in addition to or different from the National Standard Clauses. The State Supplements will be written in a manner such that they will not be edited/updated by individual parties and will be posted on the SDPC website to provide the authoritative version of the terms. Any changes by LEAs or Providers will be made in amendment form in an Exhibit (Exhibit “G”H” in this proposed structure). Version USBE 3rd Party Evaluator ▇▇▇ and Provider agree to the following additional terms and modifications: This is a free text field that the parties can use to add or modify terms in or to the DPA. If there are no additional or modified terms, Supplemental SDPC this field should read “None.” The Early Intervention Software Program (EISP), established by the Utah State Terms Legislature and administered by the Utah State Board of Education (USBE), provides Utah’s Local Education Agencies (LEAs) with the opportunity to select adaptive computer-based literacy software programs. The goal of this program is to increase literacy outcomes for Texas kindergarten through grade 3 students. In an effort to support the EISP, the provider agrees to perform the requirements of this exhibit for applicable grade K-3 student users of Lexia Core5, that are placed and confirmed by the purchasing LEA as orders funded through the EISP. For the avoidance of doubt, the terms of this Exhibit H shall only apply only to orders of the Lexia Core5 product licenses that the LEA confirms to Provider in writing to be orders utilizing the funding available under the EISP. As part of the EISP, and as more fully described below, certain data relating to use by students in select grades of designated provider Lexia Core5 products for all LEAs and orders funded through the EISP is to be provided by the provider to a third-party evaluator determined and engaged by USBE (the “Supplemental State TermsEISP Evaluator”), effective simultaneously with and Provider is hereby authorized and instructed by the attached Student Data Privacy Agreement (“DPA”) USBE and LEA to deliver applicable data to the designated EISP Evaluator according to the schedule and secure file transfer process as determined and/or authorized by the USBE for EISP Evaluator and between [ Lubbock-▇▇▇Provider, and to perform the actions, under and as provided in this Exhibit H. Provider and LEA acknowledge and agree that USBE will have sole authority and discretion as to the selection and designation of the EISP Evaluator and the terms and obligations applicable to Provider under this Exhibit H, and USBE may change the EISP Evaluator, change or terminate Provider’s data sharing and other commitments hereunder, or otherwise modify provider’s obligations under the EISP Program and/or this Exhibit H, at any time upon prior written notice to and subject to the mutual agreement of the Provider. Provider and ▇▇▇ ISD ] further acknowledge and agree that, notwithstanding the Provider actions and commitments hereunder, (i) the “Local Education Agency” or “LEA”ultimate responsibility for the determination of which subscriptions and student user information is subject to EISP program funding and the associated program reporting is always the responsibility of the purchasing LEA (and not Provider); and (ii) without limiting (i) above, the default assumption that USBE and [ ] the LEA intends Provider to operate under is that any and all K-3 Lexia Core5 subscriptions purchased by any LEA (the “Provider”and/or any Utah district and/or school, including Utah private and charter schools), is incorporated whether rostered or managed manually or via Clever or other third-party integration system utilized by the LEA or school and supported by Provider, are to be presumed by Provider to be in-scope as EISP Program funded and subject to EISP program reporting to the EISP Evaluator under the reporting parameters, unless and until the purchasing LEA or other purchasing entity (or the USBE or its EISP Evaluator) affirmatively conveys otherwise to Provider in writing. Unless otherwise instructed by USBE and/or EISP Evaluator agreed by Provider in writing, prior to the date at the end of each school year determined and agreed by the EISP Evaluator and Provider that Provider actually shares the EISP program reporting data to the EISP Evaluator, Provider will send a written notification to all identified account administrators in Provider’s systems for all LEAs and/or other Utah school and district entities that purchased the software during the then-current year, informing them that, unless Provider receives written instructions from the applicable purchasing LEA or school or district account administrator within a prescribed period, Provider will include and share information in reporting to the EISP Evaluator of Core5 student users in grades (K-3) for which Provider has SSID information, together with all applicable in-scope EISP program reporting data from other LEAs, according to the same schedule and process and data format as determined and agreed by the USBE and/or the EISP Evaluator, and Provider, for all such data transfers. Provider’s obligations under this Exhibit H shall continue during the term of all applicable LEA subscription orders subject to this Exhibit H, and until the earlier of written notification by the USBE and/or the EISP Evaluator to Provider of termination of the EISP program or of Provider’s obligations under this Exhibit H. For clarity, in the attached DPA event of any conflict or inconsistency between Provider’s terms with, instructions or authorizations received from, the LEA and/or any school, and amends those herein or received by Provider from the DPA (USBE or the EISP Evaluator, with respect to this DPA, Exhibit H or the subject matter hereof, ▇▇▇ and all supplemental terms Provider agree that any terms, authorizations and/or instructions received by Provider from the EISP Evaluator and/or the USBE shall control. Provider is authorized and conditions instructed by the USBE and policies applicable ▇▇▇ to comply with instructions as may be communicated directly to the DPAProvider by the designated EISP Evaluator from time to time. Current external data standards that Provider will support include, but are not limited to: a. Work with schools to ensure the student data contains the correct State Student IDs (SSIDs) b. Preparing and submitting in-scope data for mid-year data review c. Make corrections in response to mid-year data review d. Notify evaluator/USBE of any changes in the participation status of schools who purchased licenses for the software at the beginning of the year. e. Comply with evaluator data requests, including providing all requested data in the requested format. Note: requested data includes student IDs, grade, District/school name, and program usage information (e.g. time spent in minutes for each week of program use, total weeks of use and minutes of use, etc.) as follows:among other variables. f. Review data for accuracy, completeness (e.g. all participants/LEAs included), and check for compliance to evaluator instructions prior to submissions of final data at end of year. g. Submit final data by deadlines specified by the evaluator/USBE using secure transfer method. h. Communicate and staffing changes and/or challenges involving the data requests early to the evaluator.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ Aledo ISD ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: ▇▇▇▇▇▇▇▇ ▇▇▇▇ (Nov 1, 2023 09:17 CDT) BY: ▇▇▇▇▇▇▇▇ ▇▇▇▇ Date: Nov 1, 2023 Printed Name: ▇▇▇▇▇▇▇▇ ▇▇▇▇ Title/Position: Software Application Integration Admin SCHOOL DISTRICT NAME: Aledo ISD DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) ✔ Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ Aledo ISD ] (the “Local Education Agency” or “LEA”) and [ Progress Learning ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ ISD Prosper Independent School District ] (the “Local Education Agency” or “LEA”) and [ [Curipod AS ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] San Dieguito Union High SD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: San Dieguito Union High SD, located at ▇▇▇ ▇▇▇▇▇▇▇▇▇ ISD ] (the ▇▇▇▇. Encinitas, CA 92024(the “Local Education Agency” or “LEA”) and [ ] Rack Performance Inc, located at ▇▇ ▇▇▇ ▇▇▇▇▇ ▇▇▇▇▇▇▇▇ ▇▇▇▇, ▇▇ ▇▇▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇▇ (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ ▇▇▇▇▇▇ ▇▇▇▇▇▇▇ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ ISD ] (the “Local Education Agency” or “LEA”) and [ Vivi LLC ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Pekin Public Schools District 108 and the Provider. ▇▇▇▇▇▇'▇ Database Solutions, Inc. DBA: Embrace® **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) X National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR͂ FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-Pekin Public Schools District 108(the "Local Education Agency" or "LEA") and ▇▇▇▇▇▇'▇ ISD ] Database Solutions, Inc DBA: Embrace® (the “Local Education Agency” or “LEA”) and [ ] (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ EqualLevel Inc. ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques — Information security management systems ▇▇▇▇▇▇▇ (ISO 27000 ▇▇▇ ▇▇▇▇▇ series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ Midway ISD ] (the “Local Education Agency” or “LEA”) and [ Stukent, Inc. ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ DroneBlocks, LLC ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) ✔ Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ ISD Independent School District ] (the “Local Education Agency” or “LEA”) and [ Skyward, Inc. ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name03-07-2022 : Title/PositionT ▇▇▇▇▇▇▇▇ ▇▇▇▇▇▇▇▇▇▇ Name ▇▇▇▇/Position: SCHOOL DISTRICT NAME: Pleasantdale 107 DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: ▇▇▇▇▇▇▇▇ ▇▇▇ Asst. Superintendent ▇▇▇▇ ▇ ▇▇▇▇ ▇▇ ▇▇▇▇ Ridge, IL 60527 ▇▇▇-▇▇▇-▇▇▇▇ ▇▇▇▇@▇▇▇▇.▇▇▇ The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems ▇▇▇▇▇▇▇ (ISO 27000 ▇▇▇ ▇▇▇▇▇ series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. EXHIBIT "G" - Supplemental SDPC (Student Data Privacy Consortium) State Terms for Illinois This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-▇▇▇▇▇▇ ISD ] (the “Local Education Agency” or “LEA”) and [ ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:between

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ Upper Arlington City Schools ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) x National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 x International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) x Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This [The State Supplement is an optional set of terms that will be generated on an as-needed basis in collaboration between the national SDPC legal working group and the State Consortia. The scope of these State Supplements will be to address any state specific data privacy statutes and their requirements to the extent that they require terms in addition to or different from the National Standard Clauses. The State Supplements will be written in a manner such that they will not be edited/updated by individual parties and will be posted on the SDPC website to provide the authoritative version of the terms. Any changes by LEAs or Providers will be made in amendment form in an Exhibit (Exhibit “G”H” in this proposed structure).] ▇▇▇ and Provider agree to the following additional terms and modifications: This is a free text field that the parties can use to add or modify terms in or to the DPA. If there are no additional or modified terms, Supplemental SDPC State Terms for Texas (this field should read “Supplemental State Terms”), effective simultaneously with None.” Summary of Contracts This document contains the attached Student following contracts. Title ID Data Privacy Services Agreement (“DPA”Upper Arlington City School District and Hazel) by and between [ Lubbock-b649723a-290d-467c-a686-acb4e7c56e0f Contracts signed by: Date / Time: Dec 20, 2024 at 7:43 PM EST IP Address: 68.5.95.224 User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0 0.0 Safari/537.36 Signer ID: 5b0ad935-45a8-4eb1-93e0-0154422ba7e6 Email: ▇▇▇@▇▇▇▇▇.▇▇ ▇▇▇ ▇▇▇▇▇▇▇ ISD ] Date / Time: Jan 3, 2025 at 10:06 AM EST IP Address: 24.214.169.105 User Agent: Mozilla/5.0 (the “Local Education Agency” or “LEA”Macintosh; Intel Mac OS X 10_15_7) and [ ] AppleWebKit/537.36 (the “Provider”)KHTML, is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPAlike Gecko) as follows:Chrome/130.0 0.0 Safari/537.36 Signer ID: 44fdf535-9312-4e05-aac0-76a405ad7ecf Email: ▇▇▇▇▇@▇▇▇▇▇▇▇▇▇.▇▇▇

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Sierra Sands USD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) ✔ Other framework information - Please specify:NVDA does not collect any personally identifying information. NVDA does not need an internet connection for usage. Secure Environments When working in a secure environment, IT administrators may wish to have even more control over software options. System administrators may wish to configure NVDA to restrict unauthorized system access. By default, NVDA allows the installation of custom add-ons, which can execute arbitrary code, including when NVDA is elevated to administrator privileges. It is also possible, by default, for users to execute arbitrary code through the NVDA Python Console. This feature is generally used by add-on authors and NVDA code contributors when testing and is not usually required in corporate environments. Secure Mode prevents users from modifying their NVDA configuration including installing new add-ons, and otherwise limits unauthorized system access such as through the NVDA Python Console. In NVDA 2023.2 and later, NVDA can also be set to always start in secure mode with the ‘forceSecureMode’ system wide parameter. In such environments, preventing NVDA from accessing the internet, disabling logging and using Secure Mode are all ways of meeting the requirements of secure environments. Secure Mode should have minimal effect on use of NVDA, once NVDA has been configured. Open-Source software NVDA is open-source. This means that the source code is available for anyone to view. This is beneficial as it enables people outside the core developers to comment on bugs and offer suggestions for improvement. The final, compiled product contains only code which was either written, or directly checked and approved, by NV Access. Provided you download from ▇▇▇▇▇://▇▇▇.▇▇▇▇▇▇▇▇.▇▇▇/ (the Official Site), you can be sure that you are downloading an official version of NVDA which is unaltered and free from malicious software. You can also verify this by checking the digital signature in the “Digital signature” tab of the file properties. If you would like to verify the checksum of the file you have downloaded, we provide the SHA256 sum of each release on its release announcement page. NVDA source code review and approval process includes: Revision/Version control in GIT Substantial testing is undertaken before code updates are released and incorporated into official source code Release packages are digitally signed for verification NVDA contributors agree to adhere to the NVDA development guide, and the code review by NV Access verifies that the code adheres to this guide While anyone could potentially download the NVDA source code and edit it, only NV Access can upload files to the Official Site. There is no more inherent risk with downloading NVDA from the Official Site than there is downloading a closed source program from its official site. We work closely with partners including Microsoft, Google and Adobe, and they work with us in the knowledge of NVDA being open-source. Microsoft uses Open-Source software themselves, including various components built into Windows itself. Microsoft also have a page on Open-Source Security which starts off with a section on the benefits of open-source. Similarly, Google Open-Source is a Google initiative “Bringing all the value of open-source to Google and all the resources of Google to open-source”. The US Government runs ▇▇▇▇.▇▇▇, a website documenting US government open-source initiatives. US Government policy specifies that “Agencies must open-source at least 20% of all new custom code created after August 2016.”. Similarly, The UK Government policy states: “Releasing government code under Open-Source licenses increases transparency, collaboration and encourages good practices. The UK government made a commitment to making code open-source by default at the Open Government Partnership Summit in Paris 2016.” The Australian government also has a policy to “Make all new source code open by default”. NV Access Security Protocols NV Access has Organisational IT Risk Management Policies and Procedures in place. These policies set out who can access the server, we have change management procedures around source code management controls in GIT, there is a review process in place for changes made. Only NV Access staff can approve changes to NVDA source code, and it requires more than one person and a review to make changes. All server infrastructure is regularly backed up, both onsite and to a remote backup facility. So, there are a number of redundancies built in. The following processes and systems are in place to prevent unauthorised access: Network Security and Intrusion Detection; all systems require certificate based access Systems are regularly monitored and audited for security issues and patched appropriately All Staff run antivirus software on all computers and complete regular software updates Staff do not store any personally identifiable information on their computers Additionally, staff utilise password management encryption, and, where available, two-factor authentication for third party services Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Sierra Sands USD, located at ▇▇▇ ▇. ▇▇▇▇▇▇▇ ISD ] ▇▇▇▇▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇(the “Local Education Agency” or “LEA”) and [ ] NV Access Ltd, located at ▇▇ ▇▇▇ ▇▇▇▇ ▇▇ ▇▇▇▇▇ ▇▇▇▇▇, ▇▇▇ ▇▇▇▇ ▇▇▇▇▇▇▇▇▇ (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between North East ISD and the [Insert Name of Originating LEA] and the Provider]. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: ▇▇▇▇▇ ▇▇▇▇▇▇ Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ NORTH EAST ISD ] (the “Local Education Agency” or “LEA”) and [ ▇▇▇▇▇ Scientific, Inc ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ Aledo ISD ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: 11/4/2024 Software Application Integration Administrator Printed Name: ▇▇▇▇▇▇▇▇ ▇▇▇▇ Title/Position: SCHOOL DISTRICT NAME: Aledo ISD DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ Aledo ISD ] (the “Local Education Agency” or “LEA”) and [ UBTECH Education ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:follows:‌

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] ▇▇▇▇ CCSD 30-C and the Provider. Streamer **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) x National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 xxx National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 xxx International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. EXHIBIT "G" - Supplemental SDPC (Student Data Privacy Consortium) State Terms for Illinois This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-▇▇▇▇▇▇ ISD ] CCSD 30-C (the “"Local Education Agency” or “"LEA”") and [ ] Streamer (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA[ Mansfield ISD ] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) ✔ National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 ✔ National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) ✔ Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ Mansfield ISD ] (the “Local Education Agency” or “LEA”) and [ Technology Industry Ass] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Elk Grove USD and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) ✔ Other framework information - Please specify: SOC 2 Type II Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Elk Grove USD, located at ▇▇▇▇ ▇▇▇ ▇▇▇▇▇-▇▇▇▇▇▇ ISD ] ▇▇▇▇ ▇▇▇ ▇▇▇▇▇, ▇▇ ▇▇▇▇▇(the “Local Education Agency” or “LEA”) and [ ] LifeScience Therapy LLC, located at ▇▇▇▇ ▇▇▇▇▇▇ ▇▇. ▇▇▇▇▇▇▇▇▇, ▇▇ ▇▇▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇▇ (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** Subscribing LEA: BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: Email: The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — Security techniques — Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworks. This Exhibit “G”, Supplemental SDPC State Terms for Texas (“Supplemental State Terms”), effective simultaneously with the attached Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-▇▇▇▇▇▇ ISD [Deer Park Independen] (the “Local Education Agency” or “LEA”) and [ KickUp Inc. ] (the “Provider”), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEA] Monterey ▇▇▇ and the Provider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: SCHOOL DISTRICT NAMESchool District Name: DESIGNATED REPRESENTATIVE OF Designated Representative of LEA: Name: Title: Address: , Telephone Number: Email: Adequate Cybersecurity Frameworks 2/24/2020 The Education Security and Privacy Exchange (“Edspex”) works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“Cybersecurity Frameworks”) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 ✔ International Standards Organization (ISO) Information technology — Security techniques techniques— Information security management systems (ISO 27000 series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Other framework information - Please specify: Please visit ▇▇▇▇://▇▇▇.▇▇▇▇▇▇.▇▇▇ ▇/ for further details about the noted frameworks. *Cybersecurity Principles used to choose the Cybersecurity Frameworks are located here. This Exhibit “G”, Supplemental Amendment for SDPC State Terms for Texas California (“Supplemental State TermsAmendment”), effective simultaneously with ) is entered into on the attached date of full execution (the “Effective Date”) and is incorporated into and made a part of the Student Data Privacy Agreement (“DPA”) by and between [ Lubbock-between: Monterey ▇▇▇, located at ▇▇▇ ▇▇▇▇▇▇ ISD ] (the ▇▇▇▇▇▇ Salinas, CA 93901(the “Local Education Agency” or “LEA”) and [ ] WaveAccess USA Inc., located at ▇▇▇▇▇ ▇▇▇▇ ▇▇▇ ▇▇▇▇▇, ▇▇▇▇▇ ▇▇▇ ▇▇▇ ▇▇▇▇▇, ▇▇▇▇▇▇ ▇▇▇▇▇ ▇▇▇▇▇▇ ▇▇▇▇▇▇ (the “Provider”), is incorporated . All capitalized terms not otherwise defined herein shall have the meaning set forth in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows:.

Subscribing LEA. A Subscribing LEA, by signing a separate Service Agreement with Provider, and by its signature below, accepts the General Offer of Privacy Terms. The Subscribing LEA and the Provider shall therefore be bound by the same terms of this DPA for the term of the DPA between the [Insert Name of Originating LEArby School District 1L] and the ProviderPro vider. **PRIOR TO ITS EFFECTIVENESS, SUBSCRIBING ▇▇▇ LEA MUST DELIVER NOTICE OF ACCEPTANCE TO PROVIDER PURSUANT TO ARTICLE VII, SECTION 5. ** BY: Date: Printed Name: Title/Position: _ SCHOOL DISTRICT NAME: DESIGNATED REPRESENTATIVE OF LEA: Name: Title: Address: Telephone Number: EmailEm ail: The Education Security and Privacy Exchange (“" Edspex”") works in partnership with the Student Data Privacy Consortium and industry leaders to maintain a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems chosen based on a set of guiding cybersecurity principles* (“"Cybersecurity Frameworks”Fram eworks" ) that may be utilized by Provider . Cybersecurity Frameworks MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S) National Institute of Standards and Technology (NIST) NIST Cybersecurity Framework Version 1.1 National Institute of Standards and Technology (NIST) NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171 International Standards Organization (ISO) Information technology — - Security techniques — - Information security management systems ▇▇▇▇▇▇▇ (ISO 27000 ▇▇▇ ▇▇▇▇▇ series) Secure Controls Framework Council, LLC Security Controls Framework (SCF) Center for Internet Security (CIS) CIS Critical Security Controls (CSC, CIS Top 20) Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR) Cybersecurity Frameworks □ Please visit ▇▇▇▇://htt p:// ▇▇▇.▇▇▇▇▇▇.▇▇▇ for further details about the noted frameworksframe works. This Exhibit “G”, Supplemental SDPC State Terms for Texas Illinois (“"Supplemental State Terms”"), effective simultaneously with the attached Student Data Privacy Agreement (“"DPA”") by and between [ Lubbock-▇▇▇▇▇▇ ISD ] SchoolDistrict 140 (the “"Local Education Agency” " or “"LEA”") and [ ] Carnegie Learning (the “"Provider”"), is incorporated in the attached DPA and amends the DPA (and all supplemental terms and conditions and policies applicable to the DPA) as follows: