LightLeapAI^® Data Sharing Agreement — Terms (United States)

These DSA Terms, together with the DSA Schedule executed by the Customer, form the Data Sharing Agreement ("DSA") between N2N Services, Inc. ("N2N") and the Customer. Capitalized terms not defined here have the meanings given in the MSA.

1. Purpose and Structure

1.1 Purpose. FERPA (20 U.S.C. § 1232g; 34 C.F.R. Part 99) allows an institution to disclose personally identifiable information from education records without consent to a contractor it designates as a school official with a legitimate educational interest, where the contractor performs an institutional function, is under the institution's direct control regarding the records, and complies with FERPA's limits on use and redisclosure. The DSA sets the terms under which the Customer discloses Shared Student Data to N2N on that basis.

1.2 Structure and Precedence. The DSA Schedule records the Customer's selections: authorized use cases, Tier 2 and Tier 4 activations, Downstream Recipients, write-back entries, the BAA activation, retention period, and contacts. On matters concerning Customer Data, the DSA controls over the MSA, as provided in MSA §1.2. Where the DSA Schedule and these DSA Terms conflict, the DSA Schedule controls only for the selection it records.

1.3 Use Without an MSA. If the Customer contracts on its own terms rather than the MSA, MSA Sections 7 (Confidentiality), 9 (Limitation of Liability), 10 (Indemnification), and 12 (General) are incorporated into the DSA by reference unless the Customer's agreement with N2N addresses the same subject.

2. Definitions

"Customer-Configured Data" has the meaning given in Section 5.4.

"Downstream Recipient" means a system, platform, or third party, identified in the DSA Schedule, to which N2N transmits Shared Student Data or outputs at the Customer's direction as part of the contracted service. A Downstream Recipient is not a Subprocessor.

"Hold" means a flag, status, stop, or similar indicator placed on a student or applicant record in the Customer's SIS or CRM that restricts or pauses further processing of that record, whatever the target system calls it (for example, a registration hold, an application status, or a review flag).

"Privacy Officer" means the Customer official designated in the DSA Schedule to authorize data activations.

"Security Incident" means an actual or reasonably suspected unauthorized acquisition, access, use, disclosure, alteration, or destruction of Customer Data in N2N's or its Subprocessors' custody.

"Shared Student Data" means personally identifiable information from education records, and other student data, that the Customer discloses to N2N in the categories authorized under Appendix 1 and the DSA Schedule, including data derived from that information that identifies an individual.

"Subprocessor" means a third party that processes Customer Data on N2N's behalf to provide the Services.

3. FERPA School Official and Direct Control

3.1 Designation. The Customer designates N2N as a school official with a legitimate educational interest in the Shared Student Data, under 34 C.F.R. §§ 99.31(a)(1)(i)(B) and 99.33(a), for the authorized use cases in the DSA Schedule.

3.2 Direct Control. N2N processes Shared Student Data only on the Customer's behalf, under its direction, and for the authorized use cases. N2N will not re-disclose Shared Student Data except to Subprocessors under Section 7, to Downstream Recipients under Section 8, as the Customer directs in writing, or as required by law.

3.3 Legal Process. If N2N receives a subpoena, court order, or other legal demand for Customer Data, then to the extent the law permits, N2N will (a) notify the Customer promptly and before disclosing; (b) take the Customer's direction on how to respond; and (c) cooperate with the Customer's efforts to obtain a protective order. N2N will not voluntarily disclose Customer Data to law enforcement without valid legal process. The Customer is responsible for any FERPA notice owed to affected students.

3.4 Personnel. N2N will limit access to Shared Student Data to personnel with a documented need, using role-based access controls. It will train those personnel on FERPA and data protection at least annually, and will keep training records for three (3) years and provide them within ten (10) business days after request.

3.5 Personnel Location.

(a) Implementation. N2N will perform implementation, configuration, data migration, and integration work using only personnel located in the United States.

(b) Support. N2N's support personnel, including personnel located outside the United States, may access the Customer's account and Customer Data to provide support, subject to these conditions: (i) access is limited to what is necessary to resolve the specific support request; (ii) it is restricted by role-based access controls and multi-factor authentication; (iii) it is logged, and the logs are available to the Customer under Section 11; (iv) Customer Data may not be bulk exported or downloaded to local devices; (v) personnel are bound by the confidentiality and training requirements of Section 3.4; and (vi) Customer Data remains hosted in the hosting region identified in the Order Form.

(c) Disclosure. The countries from which support personnel may access Customer Data are listed on the Subprocessor List at lightleap.ai/legal/subprocessors/. N2N will give thirty (30) days' notice before adding a country, using the same process as a new Subprocessor under Section 7.2.

(d) Federal Tax Information. Notwithstanding (b), Federal Tax Information as defined in IRS Publication 1075, including FTI received through the FUTURE Act Direct Data Exchange, will be accessed only by personnel located in the United States who meet the Publication 1075 requirements applicable to N2N.

4. Permitted Use and AI Training

4.1 Authorized Use. N2N will use Shared Student Data only for the use cases selected in the DSA Schedule, through the Services identified there.

4.2 Minimization. N2N will request and use only the minimum Shared Student Data reasonably necessary for the authorized use cases. If data N2N previously requested is no longer needed, N2N will notify the Customer and return or destroy it under Section 13.

4.3 AI Training Prohibition. N2N will not use Shared Student Data, or any de-identified, anonymized, pseudonymized, or aggregated derivative of it, to train, fine-tune, benchmark, or improve any model, algorithm, or system. The only exception is improvement within the Customer's own instance, and only if the Customer has opted in on the DSA Schedule, as provided in MSA §6.3. N2N will not permit any Subprocessor to use Shared Student Data for training.

4.4 No Secondary Use. N2N will not use Shared Student Data for marketing, for benchmarking against other customers, to create student profiles beyond what the authorized use case requires, or for any other purpose not authorized in the DSA Schedule.

4.5 Retention. N2N will retain Shared Student Data only as long as the authorized use case requires, and no longer than the retention period in the DSA Schedule. If none is stated, the retention period is twelve (12) months from receipt. Customer-Configured Data in Meridian is retained for the Subscription Term, subject to the Customer's own retention and deletion settings, and then handled under Section 13.

5. Data Categories

5.1 Tiers. Appendix 1 classifies data elements into four tiers. Tier 1 is authorized for every engagement. Tier 2 is conditional: an element is authorized either automatically, when its associated use case is selected in the DSA Schedule, or by the Privacy Officer's written authorization, as Appendix 1 specifies for that element. Tier 3 is excluded. Tier 4 is module-specific and is activated by the related use case.

5.2 Excluded Data. No authorization, addendum, or amendment may permit the sharing of PCI DSS cardholder data. Other Tier 3 categories may be shared only under a separate written addendum approved by both parties' legal counsel.

5.3 Customer Responsibilities. The Customer is responsible for (a) ensuring it may lawfully disclose the Shared Student Data; (b) determining which data is directory information under its FERPA policy; (c) keeping its contacts in the DSA Schedule current; and (d) not submitting data beyond what is authorized.

5.4 Customer-Configured Data. Meridian lets the Customer define its own data objects and fields. Data the Customer configures Meridian to collect or store ("Customer-Configured Data") is authorized under the DSA, subject to these conditions: (a) Tier 3 exclusions still apply, and the Customer will not configure Meridian to collect PCI DSS cardholder data under any circumstances; (b) the Customer will not configure Meridian to collect other Tier 3 data unless the parties have signed the addendum required by Section 5.2; (c) before configuring Meridian to collect any Tier 2 element, the Customer will obtain its Privacy Officer's authorization; and (d) the Customer is responsible for classifying Customer-Configured Data and for identifying any education records under FERPA. The data categories the Customer anticipates storing are recorded in the DSA Schedule for reference. Configuring a category not listed there does not breach the DSA.

6. Security

6.1 Program. N2N will protect Customer Data under the Security Exhibit, using administrative, technical, and physical safeguards consistent with the NIST Cybersecurity Framework and NIST SP 800-171, including encryption in transit and at rest and multi-factor authentication for all systems that access Customer Data.

6.2 GLBA. If Shared Student Data includes financial aid or other Title IV data, N2N will comply with the GLBA Safeguards Rule (16 C.F.R. Part 314), including maintaining a qualified individual, a written risk assessment, a tested incident response plan, and notice to the Federal Trade Commission as required by 16 C.F.R. § 314.4(j).

7. Subprocessors

7.1 List. N2N maintains its current Subprocessor List at lightleap.ai/legal/subprocessors/. The list identifies each Subprocessor, its function, and its processing location. For identity verification Subprocessors, it also shows current NIST IAL2 certification status (the "IAL2 Compliance Matrix"), updated at least quarterly.

7.2 Changes. N2N will notify the Customer's administrative contact at least thirty (30) days before engaging a new Subprocessor that will access Customer Data. Customers may also subscribe to change notices on the Subprocessor List. The Customer may object on reasonable data protection grounds within fifteen (15) days after notice, and the parties will work in good faith to resolve the objection. If they cannot, the Customer may terminate the affected module and receive a refund of prepaid fees for the remainder of the Subscription Term.

7.3 Obligations. N2N will bind each Subprocessor to data protection obligations at least as protective as the DSA and remains responsible for its Subprocessors' performance.

7.4 Identity Verification. N2N will use only identity verification Subprocessors that hold current NIST IAL2 (or higher) certification under the Kantara Initiative Trust Mark program or an equivalent third-party assessment against NIST SP 800-63, with annual attestation. N2N will require each such Subprocessor to notify it within fifteen (15) days after any material change in certification, and will relay that notice to the Customer promptly. Certificates are available on request.

8. Downstream Recipients

N2N will transmit Shared Student Data or outputs only to the Downstream Recipients listed in the DSA Schedule. N2N will give at least thirty (30) days' notice before adding or materially changing a Downstream Recipient, and the change takes effect only when the Customer approves the updated DSA Schedule.

9. System Write-Back

9.1 Activation. This Section applies only to write-back entries recorded in the DSA Schedule.

9.2 Scope. N2N will write only the data elements, to the target systems, recorded for each entry. Any change requires an updated DSA Schedule entry signed by both parties.

9.3 Review. Unless an entry designates write-back as automated, no record will be written without per-record approval by the Customer's designated reviewer. Bulk write-back without the review mechanism recorded for the entry is prohibited.

9.4 System of Record. The Customer's system of record controls in any conflict with an N2N output. Where the Customer designates a Meridian tenant as a system of record, N2N hosts it on the Customer's behalf; the Customer retains authority over its content and is responsible for the accuracy of data it enters or approves there. N2N does not warrant that write-back outputs are accurate or complete.

9.5 Logging and Errors. N2N will log every write-back attempt, successful or not, with timestamps and record identifiers, and will provide logs within five (5) business days after request. N2N will notify the Customer of write errors, duplicates, or anomalous outputs within the time stated in the entry, and will not re-attempt a failed write without the Customer's direction.

9.6 Revocation. The Customer may revoke write-back authorization for any entry at any time by notice. N2N will stop that write-back immediately and confirm in writing within one (1) business day.

10. Security Incidents

10.1 Notice. N2N will notify the Customer's security contact by email and telephone within seventy-two (72) hours after determining that a Security Incident has occurred or is reasonably suspected. N2N will not delay notice to complete its investigation.

10.2 Content. The notice will include, as then known: (a) the nature of the incident; (b) the categories and approximate number of individuals and records affected; (c) the dates of the incident and of its discovery; (d) containment and mitigation steps taken; and (e) recommended steps for the Customer. N2N will provide updates as information develops, and a written root cause analysis when its investigation concludes.

10.3 Cooperation. The Customer decides whether notification to individuals, regulators, or law enforcement is required, and makes those notifications. N2N will cooperate, including by providing forensic documentation. Costs are addressed in MSA §9.7 (Breach Response Costs). N2N will make any notifications it is independently required to make by law, including under the GLBA Safeguards Rule.

10.4 Customer Cooperation. The Customer will cooperate in good faith with any joint investigation, including by providing logs and access records reasonably needed to determine the source and scope of the incident.

10.5 Confidentiality. Information exchanged about a Security Incident is Confidential Information under the MSA, subject to legal disclosure obligations.

11. Assessments and Audit

11.1 Reports. On request, N2N will provide its current SOC 2 Type II report, TX-RAMP certification, and other independent assessments, subject to MSA §7.

11.2 Audit. If those reports do not reasonably answer the Customer's compliance questions, the Customer may audit N2N's compliance with the DSA, directly or through a qualified auditor bound by confidentiality, on thirty (30) business days' notice (fifteen (15) business days after a Security Incident). Absent a Security Incident, audits are limited to once per calendar year. They will take place during business hours, will not unreasonably disrupt operations, and will not extend to other customers' data or systems. Each party bears its own costs.

12. Non-Compliance

N2N will notify the Customer within seventy-two (72) hours after discovering any non-compliance with the DSA or FERPA, and will provide a written remediation plan within ten (10) business days. Failing to do either is a material breach.

13. Return and Destruction

13.1 Export. For thirty (30) days after an Order Form ends, N2N will make Customer Data available for export in a commonly used, machine-readable format and will cooperate with reasonable transition requests.

13.2 Destruction. Within forty-five (45) days after an Order Form ends (or, at the Customer's written request specifying the method, within thirty (30) days after the request), N2N will destroy all Customer Data, including copies held by Subprocessors and copies in backups, using methods meeting NIST SP 800-88 at the Purge level or higher.

13.3 Certificate. Within ten (10) business days after destruction is complete, N2N will provide a certificate stating (a) the completion date; (b) the data destroyed; (c) the method used; (d) the certifying individual; and (e) any data not destroyed, why it could not be destroyed, and when it will be.

13.4 Infeasibility. If destruction of specific data is infeasible, or N2N is legally required to retain it, N2N will tell the Customer why, continue to protect that data under the DSA, and use it only for the purpose that prevents destruction.

14. Term and Termination

14.1 Term. The DSA runs concurrently with the Customer's Order Forms and ends when the last one ends. Sections 3.3, 4.3, 10, 13, and 14 survive until N2N has completed destruction.

14.2 Termination by Customer. The Customer may terminate the DSA for convenience on thirty (30) days' notice, with the effect described in MSA §5.5. The Customer may terminate the DSA and the affected Order Forms immediately by notice after a confirmed Security Incident caused by N2N's breach, or after a material violation of FERPA or the GLBA by N2N that cannot be remedied without harm to students.

15. Health Information

The Business Associate Addendum at lightleap.ai/legal/baa/ applies only after the Customer activates it in the DSA Schedule for a health services deployment. The Customer may substitute the current HHS model business associate agreement, which N2N will sign on request.

16. Canada

For a Customer in Canada, the Canada Schedule modifies these DSA Terms. It replaces the FERPA designation in Section 3 with the applicable provincial and federal privacy requirements.

17. Relationship to the MSA

The MSA governs liability, indemnification, insurance, notices, assignment, governing law, and other general terms. The DSA does not repeat them.

Appendix 1 — Data Element Tiers

Tier 1 — Standard (authorized for all engagements)

Tier 2 — Conditional

Tier 3 — Excluded

• PCI DSS cardholder data (absolute exclusion).
• Biometric identifiers other than the Tier 2 facial photograph, such as retinal scans, voiceprints, fingerprints, and genetic data.
• Medical and health insurance information, except under an activated BAA.
• Sexual orientation, gender identity, and religious or philosophical beliefs, beyond what appears in standard enrollment records where required by law.
• Employee personally identifiable information.
• Any element not listed in Tier 1 or in an activated Tier 2 or Tier 4 row.

Tier 4 — Module-Specific

Revision history