CENTEGIX Data Privacy & Security Terms
These Privacy and Security Terms (these “Terms”) are entered into by and between 34ED, LLC dba CENTEGIX (“CENTEGIX”) and the customer or other counterparty that executed the agreement into which these Terms are incorporated (“Customer”) (each, a “Party” and collectively, the “Parties”). These Terms are incorporated into and made part of such agreement governing CENTEGIX’s provision of products and/or services to Customer (the “Agreement”). If there is any inconsistency between these Terms and the Agreement, these Terms shall control solely with respect to the subject matter of these Terms.
1. Definitions.
a. “CENTEGIX Personnel” means all persons or entities furnished or engaged by CENTEGIX to assist in performing the Services (as defined herein), including officers, employees, representatives, agents of CENTEGIX, CENTEGIX’s affiliates, subcontractors, subprocessors, and other service providers.
b. “COPPA” means the Children’s Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506, and its implementing regulations.
c. “Customer Confidential Information” means (i) any information concerning Customer (regardless of whether such information is specifically identified as “confidential” that is furnished to CENTEGIX or CENTEGIX Personnel by or on behalf of Customer or its representatives or agents before, on or after the date hereof, (ii) Protected Data, and (iii) any analyses, summaries, notes, compilations, studies, emails, electronic files or other materials prepared by CENTEGIX or CENTEGIX Personnel that contain or otherwise reflect such information or Protected Data. The term “Customer Confidential Information” does not include information that is or becomes generally available to the public other than as a result of a disclosure by CENTEGIX or CENTEGIX Personnel in violation of the Agreements or these Terms.
d. “De-identified Information” means Protected Data from which all direct and indirect identifiers have been permanently and irrevocably removed or obscured, and with respect to which reasonable administrative, technical, and contractual measures are implemented such that the information cannot reasonably be used to identify, and is not reasonably linkable to, a particular individual, household, or device, even when taking into account other reasonably available information, or as defined by applicable Law.
e. “Disclose” means to permit access to or the release, transfer, or other communication by any means, including oral, written, or electronic means, to any person or entity except the person or entity identified as the person or entity that provided or created the record, or as defined by applicable Law.
f. “FERPA” means the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, and its implementing regulations.
g. “Law” means any and all current and future foreign or U.S. federal, state or local statute, law (including common law), ordinance, rule, regulation, injunction, treaty, restriction, approval, directive, binding statutory guidance, regulatory code of practice, permit, or order, or term or condition of any of the foregoing, or any other binding action or other requirement of any governmental authority, including but not limited to COPPA and FERPA.
h. “Protected Data” means any information that can, directly or indirectly, reasonably identify an individual and is protected by Law that CENTEGIX collects, receives, maintains, generates, uses, Discloses, processes, or has access to in connection with providing the Services, including but not limited to personally identifiable information, education records, student records, student-generated content, information relating to a student or parent, personal information of children, FERPA Data, and any other personal information regulated by Law. Protected Data is not De-identified Information.
i. “Security Incident” means the occurrence of any act or omission that directly or indirectly leads to the compromise of confidentiality, integrity, and/or availability of Protected Data. A “Security Incident” includes, but is not limited to, for example: a physical trespass on a secure facility in which Protected Data is maintained; intrusion or hacking into CENTEGIX’s or CENTEGIX Personnel’s networks, systems, or premises on which Protected Data is maintained; or any circumstance pursuant to which applicable Law requires notification of such incident to be given to affected parties or other activity in response to such circumstance.
j. “Services” means providing the Customer with any CENTEGIX safety and security solutions, including, but not limited to, Visitor Management, Safety BluePrint, CrisisAlert, Dismissal, Parent Messenger, Hall Pass, Catapult EMS, WeTip, or Reunification.
k. “Customer Indemnitees” means the Customer and its officers, directors, employees and agents.
l. ”FERPA Data” means any education records or other information protected by FERPA.
m. ”School Purpose” means a purpose that customarily takes place at the direction of a school, district, or other educational agency or institution or that aids in the administration of school activities, and for which CENTEGIX has a legitimate educational interest in Protected Data as determined and authorized by Customer.
2. Protected Data License.
The Parties agree that all rights, including intellectual property rights, in Protected Data shall remain the exclusive property of Customer or its applicable data subjects, as between the Parties. Customer retains full control of all Protected Data, including any student data, submitted to, collected by, or accessible through the Services. CENTEGIX has a limited, nonexclusive license to use Protected Data solely as necessary to perform the Services for Customer, as permitted by these Terms, as required by applicable Law, or otherwise with the express written consent of Customer. Customer shall not provide any Protected Data that is not reasonably necessary to perform the Services by CENTEGIX.
3. Standard of Care; Confidentiality.
CENTEGIX will maintain the confidentiality of Customer Confidential Information using the same degree of care that CENTEGIX employs in maintaining CENTEGIX’s own proprietary and confidential information of a like nature but in no event using less than a reasonable degree of care. CENTEGIX is responsible for any authorized or unauthorized collection, storage, disclosure, disposal, and use of, and access to, Customer Confidential Information by CENTEGIX Personnel to the extent caused by CENTEGIX or CENTEGIX Personnel. CENTEGIX will, and will ensure that CENTEGIX Personnel, implement and maintain all commercially-reasonable administrative, physical, and technical safeguards, as well as any additional requirements set forth in these Terms or otherwise agreed upon in writing by the Parties, designed to prevent any unauthorized collection, storage, disclosure, disposal, and use of, and access to, Customer Confidential Information.
4. Restrictions on CENTEGIX’s Receipt, Use, and Disclosure of Customer Confidential Information.
a. CENTEGIX will access, collect, and otherwise process Protected Data only to the extent necessary to perform the Services for Customer, for a School Purpose or as permitted by applicable Law, to comply with applicable Law, or as otherwise expressly authorized in writing by Customer. CENTEGIX shall limit its collection of Protected Data to the minimum amount reasonably necessary to perform the Services.
b. CENTEGIX will not disclose Customer Confidential Information to any other person or entity without the prior written consent of Customer, except: (i) to CENTEGIX Personnel, but only to the extent necessary to perform the Services and on the condition that the Confidential Information shall be used only for the purposes for which the disclosure was made; (ii) as permitted under Sections 4(d), 4(e), or 4(f); or (iii) in connection with the sale of all of the shares of CENTEGIX to a third party, the sale of all or substantially all of the assets of CENTEGIX to a third party, or the merger of CENTEGIX with a third party, but only if such acquirer or successor agrees in writing to be subject to and bound by these Terms..
c. CENTEGIX shall maintain the confidentiality of Customer Confidential Information and shall treat it in accordance with these Terms and applicable Law. Without limiting the foregoing, CENTEGIX shall not sell, rent, trade, or otherwise monetize Protected Data; shall not use Protected Data for targeted advertising; shall not create advertising profiles or other profiles of students, parents, or end users except as necessary to provide the Services for a School Purpose; and shall not use Protected Data for any commercial purpose other than providing and improving the Services in a manner permitted by these Terms and applicable Law.
d. Emergency Response Disclosures. Notwithstanding anything to the contrary in these Terms, Customer authorizes CENTEGIX to disclose Protected Data and Customer Confidential Information, including alert, incident, location, map, facility, responder, and related operational data, to emergency response, law enforcement, public safety, 911, emergency communications center, public safety answering point, and similar governmental or quasi-governmental entities, and to their respective software, dispatch, communications, mapping, video, or other technology providers, in each case to the extent reasonably necessary to facilitate, support, coordinate, or document an emergency, safety, security, or incident response.
e. Customer-Enabled Third-Party Integrations. Customer authorizes CENTEGIX to disclose Protected Data and Customer Confidential Information to third-party systems, services, applications, platforms, vendors, or providers designated, enabled, configured, requested, or approved by Customer, including providers of intercom, paging, mass notification, audio enhancement, door access, door lock, video, visitor management, emergency communications, and related safety or security systems, in each case to the extent reasonably necessary to provide, support, maintain, or enable the Services or the applicable integration.
f. Responsibility for Third Parties. CENTEGIX is not responsible for the acts, omissions, systems, services, applications, platforms, security practices, privacy practices, availability, performance, or use of data by any third-party provider, system, service, application, or platform that is not under CENTEGIX’s control, including any Customer-designated, Customer-enabled, or emergency response third party. Customer is responsible for obtaining and maintaining all rights, consents, authorizations, configurations, and instructions necessary for CENTEGIX to disclose information to such third parties as contemplated by these Terms
5. FERPA.
To the extent CENTEGIX receives, maintains, or otherwise processes FERPA Data, CENTEGIX acknowledges that it is receiving such FERPA Data only to provide the Services to Customer and for a permitted purpose under applicable Law, including School Purpose. As applicable, CENTEGIX shall be deemed a “school official” with a “legitimate educational interest” in such FERPA Data only to the extent permitted by FERPA and as authorized by Customer. CENTEGIX shall use FERPA Data only for the purposes authorized by Customer, shall not Disclose FERPA Data except as permitted by these Terms and applicable Law, and shall not use FERPA Data for any purpose other than the specific purposes for which the FERPA Data was disclosed to CENTEGIX.
6. Additional Privacy Requirements.
a. Customer has the right to request in writing that CENTEGIX Disclose Protected Data to a third party on its behalf, including pursuant to a judicial order or lawfully-issued subpoena, to the extent permitted by applicable Law. CENTEGIX shall also reasonably cooperate with Customer’s documented requests relating to, but not limited to, access to, correction of, deletion of, revoking of consent, or export of Protected Data, to the extent Customer is entitled or required to honor such requests under applicable Law. To the extent CENTEGIX receives any requests directly from any individual as to Protected Data, CENTEGIX shall notify Customer promptly of such request and provide reasonable assistance as set forth in these Terms.
b. CENTEGIX will use reasonable methods to identify and authenticate the identity of any person to whom CENTEGIX Discloses Protected Data pursuant to and as permitted by these Terms, including CENTEGIX Personnel. CENTEGIX shall provide reasonable assistance to Customer in responding to requests from individuals, schools, regulators, or other authorized persons relating to Protected Data, to the extent required by applicable Law.
c. COPPA. To the extent Protected Data includes personal information from a child under thirteen (13) years of age, CENTEGIX shall collect, use, maintain, and Disclose such information only as necessary to provide the Services for a School Purpose and as authorized by Customer. As between the Parties, Customer shall be responsible for providing any notices and obtaining any consents required by applicable Law for CENTEGIX to provide the Services to schools and students, and CENTEGIX shall provide information about its data practices reasonably requested by Customer to support such notices or consents, and reasonably assist in responding to requests to exercise any rights granted by COPPA.
d. Customer Control of Student Data. As between the Parties, Customer shall direct and control CENTEGIX’s processing of student data made available to CENTEGIX in connection with the Services. CENTEGIX shall process such student data only on behalf of and pursuant to Customer’s documented instructions, these Terms, and applicable Law.
7. Required Disclosure.
Nothing in these Terms shall restrict use, disclosure, or retention of Customer Confidential Information to the extent required by applicable Law, an order of a court of competent jurisdiction, law enforcement or administrative agency, or a subpoena, or as reasonably necessary for CENTEGIX to establish, exercise, or defend legal claims related to these Terms. In the event CENTEGIX is required to Disclose any Customer Confidential Information, CENTEGIX will, unless prohibited by applicable Law, promptly notify Customer prior to such disclosure so that Customer has a reasonable opportunity to seek a protective order or other legal or equitable remedies that may be available to protect the confidentiality of such Customer Confidential Information. CENTEGIX will Disclose only the minimum portion of Customer Confidential Information legally required to be disclosed.
8. Information Security Program.
CENTEGIX will have in place a comprehensive information security program that is based on industry best practices and that is in compliance with applicable Law. In accordance with such information security programs, CENTEGIX will implement and maintain reasonable administrative, physical, and technical safeguards appropriate to the nature of the Protected Data and designed to secure Protected Data from unauthorized access, disclosure, destruction, modification, and use.
9. Minimum Privacy and Security Requirements.
At a minimum, CENTEGIX will: (a) have a written information security policy, incident response plan, and publicly-available privacy policy; (b) conduct, at least annually, enterprise-wide risk assessments and internal and external penetration testing; (c) implement patches for security vulnerabilities on all systems and applications relevant to the Services within a commercially-reasonable timeframe following availability of a patch; (d) collect and maintain the minimum amount of Protected Data required to perform the Services; (e) use commercially-reasonable methods to limit access to Protected Data to only those Personnel having a legitimate business interest in the Protected Data; (f) implement authentication and access controls with multi-factor authentication for remote administration; (g) implement appropriate personnel security and integrity procedures and practices, including, but not limited to, conducting background checks consistent with applicable Law; and (h) provide information security training to CENTEGIX Personnel at least once per year.
10. Minimum Software Requirements.
Security features for any software used to perform the Services shall, at a minimum: (a) support externalized authentication (e.g., federation via Security Assertion Markup Language (SAML) or Active Directory Federation Services (ADFS)) or have configurable password parameters (e.g., length, history, complexity, expiration); (b) have multi-factor authentication capabilities or be compatible with industry-accepted multi-factor authentication tools; (c) allow access to product authentication logs and to logs indicating changes to user accounts that include detail of the account leveraged to make the change and retain such logs for as long as possible, but in no instance for less than 90 days after the log was last updated.
11. Restrictions on International Storage or Processing.
CENTEGIX shall ensure that all Protected Data is stored and processed in the United States. At no time shall Protected Data be transferred to, stored, or processed in any country other than the United States.
12. Information Security Questionnaire.
Upon Customer’s written request not more than once each year, to confirm compliance with these Terms and applicable Law, CENTEGIX will promptly complete, and certify the accuracy of its responses to, a written information security questionnaire provided by Customer, or by a third party on behalf of Customer, regarding CENTEGIX’s data privacy and security practices and CENTEGIX’s use and handling of Protected Data within thirty (30) days of receipt of the information security questionnaire. The Customer shall treat the information provided in the information security questionnaire as CENTEGIX’s confidential information.
13. Audits.
Customer has the right once each year upon forty-five (45) days written notice to CENTEGIX to conduct audits, or to have a third party conduct audits on its behalf, of CENTEGIX’s systems and physical and electronic facilities that are used in connection with the Services, and to obtain copies of the policies and procedures relevant to CENTEGIX’s handling of Protected Data for the purpose of auditing and confirming CENTEGIX’s compliance with these Terms.
14. Security Incident Procedures.
In the event of a Security Incident, CENTEGIX shall notify Customer as soon as practicable, but no later than forty-eight (48) hours after CENTEGIX becomes aware of the Security Incident. CENTEGIX will, at its own expense, take immediate steps to contain and remediate the Security Incident to prevent any further Security Incident and to maintain and preserve all documents, records, and other data related to any Security Incident. CENTEGIX will fully cooperate with Customer with respect to any Security Incident, including, but not limited to the following: (a) assisting with any inquiry, investigation, litigation, notice, or regulatory response arising out of or related to the Security Incident; and (b) making available all relevant records, logs, files, data reporting, and other materials required to comply with applicable Law, or as otherwise reasonably requested by Customer.
15. Return or Disposal of Customer Confidential Information
Within fourteen (14) calendar days of receipt of Customer’s request or within thirty (30) calendar days of the expiration or termination of these Terms or the Agreement for any reason, CENTEGIX will, and will instruct all CENTEGIX Personnel to, promptly return to Customer all Customer Confidential Information in its possession or the possession of such Personnel or securely delete, destroy, remove, or dispose of all such copies, except to the extent retention is required by applicable Law or reasonably necessary to maintain media for a limited period in the ordinary course, provided that any retained Customer Confidential Information shall remain subject to these Terms. Upon request, CENTEGIX will promptly certify in writing to Customer that all such Customer Confidential Information has been returned, deleted, destroyed, or rendered unreadable.
15 (a). De-identified Information.
CENTEGIX may create and use De-identified Information derived from Protected Data solely for lawful purposes such as research, analytics, service improvement, security, product development, only as permitted by applicable Law, provided that such De-identified Information does not identify Customer, any student, parent, household, or other individual, and provided further that CENTEGIX: (a) will not attempt to re-identify De-identified Information; (b) will maintain reasonable administrative, technical, and contractual safeguards designed to prevent re-identification and inadvertent disclosure; (c) will not transfer, Disclose, or make De-identified Information available to any third party unless the third party is contractually prohibited from attempting to re-identify the information and from further Disclosing it except subject to the same restrictions; and (d) will not use De-identified Information to target advertising to, or otherwise profile, any student, parent, household, or other individual.
15 (b). Subprocessors.
CENTEGIX may engage subprocessors to assist in providing the Services, provided that CENTEGIX remains responsible for the acts and omissions of its subprocessors in connection with the Services. CENTEGIX shall impose written obligations on each subprocessor that are no less protective of Protected Data than those set forth in these Terms and shall, upon Customer’s written request, provide Customer with information identifying the categories or identities of subprocessors then authorized to process Protected Data, except to the extent prohibited by applicable Law or confidentiality obligations reasonably imposed by third parties.
16. Term.
These Terms shall remain in effect until amended or terminated in a writing by the Parties expressly referencing these Terms.
17. Indemnification.
Each Party will, at its expense, defend, indemnify, and hold harmless the other Party, its Affiliates, and their respective officers, directors, employees, and agents from and against any third-party claim, suit, damage, loss, liability, cost, or expense, including reasonable attorney’s fees and costs, to the extent arising out of such Party’s failure to comply with the provisions set forth in these Terms.
18. Procedures for Claims.
Indemnitee agrees to give Indemnitor prompt written notice of any Claim for which Indemnitee seeks indemnification, provided however, any failure by Indemnitee to timely provide such notice will not relieve Indemnitor of its indemnification obligations except to the extent Indemnitor can demonstrate actual prejudice as a result of such failure. Within thirty (30) days after receiving Indemnitee’s notice of a Claim, but no later than ten (10) days before the date on which any formal response to the Claim is due, Indemnitor will notify Indemnitee in writing acknowledging its indemnification obligation and assuming control of the defense and settlement of the Claim. If Indemnitor delivers a timely notice to Indemnitee, Indemnitor shall have sole control over the defense and settlement of the Claim. Indemnitee shall cooperate with Indemnitor in the defense of the Claim. Indemnitee will have the right to participate with Indemnitor in the defense or appeal of any Claim, at Indemnitee’s option and at Indemnitee’s own expense (such expense not being indemnified by Indemnitor), but Indemnitor will have sole control and authority with respect to any such defense, compromise, settlement, appeal, or similar action, provided that Indemnitor obtains Indemnitee’s prior written consent to any settlement that requires Indemnitee to make any admission of fault or pay any amounts in connection with such settlement. If Indemnitor does not deliver a timely Notice of Election or does not conduct the defense of a Claim after delivering a timely Notice of Election, Indemnitee may defend and/or settle the Claim in such manner as it may deem appropriate, at the cost and expense of Indemnitor, including payment of any settlement, judgment or award and the costs of defending or settling the Claim. Indemnitor will promptly reimburse the Indemnitee upon demand for all Losses suffered or incurred as a result of or in connection with the applicable Claim
19. Insurance.
CENTEGIX will maintain in full force and effect: (a) Breach insurance, with coverage limits of not less than One Million Dollars ($1,000,000) per occurrence and Two Million dollars ($2,000,000) general aggregate for any data breach.
20. Mediation.
In the event of any dispute, claim, question, or disagreement between the Parties arising from or relating to these Terms or the breach thereof, the Parties shall use their best efforts to resolve the dispute, claim, question, or disagreement. To this end, the Parties shall consult and negotiate with each other in good faith and, recognizing their mutual interests, attempt to reach a just and equitable resolution satisfactory to both Parties. In the event the Parties cannot resolve the dispute, the Parties agree to attempt to resolve any dispute, claim or controversy arising out of or relating to these Terms by mediation, which shall be conducted under the then-current mediation procedures of the CPR Institute for Conflict Prevention & Resolution or any other procedure upon which the Parties agree to in writing. The Parties further agree that their respective good faith participation in mediation is a condition precedent to pursuing any other available legal or equitable remedy, including litigation, arbitration, or other dispute resolution procedures, except in such cases where immediate preliminary equitable relief is needed.
21. Governing Law.
These Terms shall be enforced and interpreted in accordance with the laws of the State of Georgia, without regard to any conflict of law principles. Any lawsuit or other action between the Parties based on a claim arising from these Terms shall be brought in a court or other forum of competent jurisdiction within Fulton County, Georgia.