Lumist Logo

Data Processing Addendum (DPA)

Effective Date: January 13, 2025

Between: Lumist, Inc. ("Vendor") AND: [School District/Organization Name] ("District")

This Data Processing Addendum ("DPA") is incorporated into and forms part of the Service Agreement or Terms of Service (the "Agreement") between Lumist and the District.

1. Definitions

  • "Student Data" means any information (in any format) that is directly related to an identifiable current or former student that is maintained by the School District or by Lumist as part of the provision of the Services. This includes "Education Records" as defined by FERPA.

  • "De-Identified Data" means data from which all personally identifiable information, including direct and indirect identifiers, has been removed or obscured, such that the remaining information does not reasonably identify an individual.

  • "Services" means the Lumist AI-powered SAT preparation platform and related services provided pursuant to the Agreement.

  • "FERPA" means the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, and its implementing regulations at 34 C.F.R. Part 99.

  • "COPPA" means the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506, and its implementing regulations.

2. FERPA Compliance & School Official Status

2.1 School Official Status. Lumist acknowledges that for the purposes of the Family Educational Rights and Privacy Act (FERPA), it is acting as a "School Official" with "legitimate educational interests" in the Student Data, as defined in 34 CFR § 99.31(a)(1)(i)(B).

2.2 Limitations on Use. Lumist agrees to use Student Data solely for the purpose of providing the Services defined in the Agreement. Lumist shall not use Student Data for any purpose other than to perform the Services.

2.3 Compliance. Lumist shall:

  • Maintain appropriate security safeguards for Education Records
  • Not re-disclose Education Records without institutional authorization
  • Comply with institutional directions regarding Student Data management

3. Prohibitions on Data Mining & Marketing

3.1 No Targeted Advertising. Notwithstanding any provision in Lumist's Privacy Policy to the contrary, Lumist is strictly prohibited from using Student Data to engage in behavioral targeting of advertisements to students.

3.2 No Profile Building. Lumist shall not create a profile of a student for any purpose other than providing the educational services (e.g., adaptive learning paths and score predictions) or as authorized by the District.

3.3 Marketing Restriction. Lumist shall not sell, rent, or lease Student Data to any third party.

3.4 Non-Educational Products. Lumist shall not use Student Data to market or advertise non-educational products or services to students.

4. Data Ownership

4.1 District Ownership. The District continues to own all right, title, and interest in and to all Student Data. Student Data is and shall remain the exclusive property of the District.

4.2 Supremacy Clause. To the extent that Lumist's Terms of Service grant Lumist a "perpetual, irrevocable license" to User Content, this DPA supersedes that clause. Regarding Student Data, Lumist's rights are limited to a non-exclusive, revocable license used strictly to provide the Service to the District during the term of the Agreement.

4.3 No License Beyond Service. Upon termination or expiration of the Agreement, all licenses to Student Data granted to Lumist shall immediately terminate.

5. Artificial Intelligence & Data Usage

5.1 AI Training. Lumist warrants that it does not use personally identifiable Student Data to train its general, public-facing artificial intelligence models.

5.2 De-Identification. The District acknowledges that Lumist may use De-Identified Data for product improvement and research purposes, provided that Lumist agrees not to attempt to re-identify such data.

5.3 Adaptive Learning. Lumist may use Student Data to power personalized adaptive learning features (such as adaptive question difficulty, Lumist Score predictions, and Redemption Bounties) solely for the benefit of the individual student.

6. Data Security

6.1 Security Controls. Lumist agrees to employ administrative, physical, and technical safeguards consistent with industry standards (e.g., NIST Cybersecurity Framework) to secure Student Data from unauthorized access, disclosure, and use, including:

  • Encryption in transit using TLS 1.2 or higher
  • Encryption at rest using AES-256 or equivalent
  • Role-based access controls limiting data access to authorized personnel
  • Regular security assessments and vulnerability testing
  • Incident response procedures

6.2 Encryption. Student Data shall be encrypted in transit (using TLS 1.2 or higher) and at rest (using AES-256 or equivalent).

6.3 Access Controls. Lumist shall limit access to Student Data to employees and sub-processors who have a legitimate need to access such data to perform the Services.

6.4 Employee Training. Lumist shall train employees who handle Student Data on applicable data privacy and security requirements.

7. Data Breach Notification

7.1 Notification Timeline. In the event of an unauthorized release, disclosure, or acquisition of Student Data ("Security Incident"), Lumist shall notify the designated District contact within forty-eight (48) hours of confirmation of the breach, or within a shorter timeframe as required by applicable state law.

7.2 Content of Notice. The notice shall include:

  • The nature of the breach and the types of data affected
  • The estimated number of students affected
  • Steps taken to mitigate the incident
  • Recommended steps for the District to protect affected students

7.3 Cooperation. Lumist shall cooperate with the District to investigate the Security Incident and provide all information necessary for the District to fulfill its own notification obligations.

8. Data Deletion

8.1 Termination. Upon termination or expiration of the Agreement, Lumist shall delete or transfer to the District all Student Data within sixty (60) days, unless a student or parent has established a separate, personal consumer account with Lumist.

8.2 Right to be Forgotten. The District may request the deletion of specific student records at any time through Lumist's administrative dashboard or by contacting contact@lumist.ai.

8.3 Verification. Upon request, Lumist shall provide the District with written certification that Student Data has been deleted or transferred.

9. Sub-Processors

9.1 Approved Vendors. The District acknowledges that Lumist utilizes third-party sub-processors to provide the Service, including:

  • Supabase — database and authentication services
  • Vercel — hosting and content delivery
  • Stripe — payment processing
  • Google Cloud AI — AI and machine learning features

9.2 Sub-Processor Obligations. Lumist shall enter into written agreements with all sub-processors imposing data protection obligations substantially similar to those in this DPA.

9.3 Notification of Changes. Lumist shall notify the District of any material changes to sub-processors at least thirty (30) days in advance.

10. Audit Rights

10.1 District Audit Rights. The District shall have the right, upon reasonable advance written notice (at least 30 days), to audit Lumist's compliance with this DPA, no more than once per calendar year.

10.2 Cooperation. Lumist shall cooperate in good faith with any such audit and shall provide the District with access to relevant records and personnel.

11. COPPA Compliance

11.1 Users Under 13. For students under the age of 13 accessing the Service through the District, Lumist and the District agree that:

  • The District is responsible for obtaining verifiable parental consent as required by COPPA
  • The District acts as the agent of parents for consent purposes under the school official exception to COPPA
  • Lumist shall not collect additional personal information from students under 13 beyond what is necessary to provide the Services

12. Limitations of Liability

12.1 Mutual Limitation. Each party's liability to the other under this DPA shall be subject to the limitations of liability set forth in the Agreement.

12.2 No Limitation for Breach. Notwithstanding the foregoing, the limitations of liability shall not apply to breaches of the data security obligations in Section 6 or the data breach notification obligations in Section 7.

13. Governing Law

This DPA shall be governed by and construed in accordance with the laws of the State of Florida, without regard to conflict of law principles.

14. Contact Information

For questions about this DPA or to exercise rights under this DPA:

Email: contact@lumist.ai

Mailing Address: Lumist, Inc. 15501 Bruce B Downs Blvd, Tampa, FL 33647

IN WITNESS WHEREOF

The parties have executed this Data Processing Addendum as of the date first above written.

Lumist, Inc.[School District Name]
Signature______________________________________________________
Name______________________________________________________
Title______________________________________________________
Date______________________________________________________

© 2026 Lumist, Inc. · 15501 Bruce B Downs Blvd, Tampa, FL 33647

Data Processing Addendum — Lumist