Data Processing Addendum (template)

This is the standard template Habitus offers to districts. The binding version is the countersigned PDF stored with your district record. District administrators can request the latest signed copy from support.

1. Roles

The district is the data controller / educational agency. Habitus is the service provider / school official under FERPA and processes data only on the district's documented instructions.

2. Scope of processing

• Categories of data: student records, guardian contacts, staff directory, behavior and attendance records, parent communications, safety event records.
• Purpose: providing the Habitus platform features the district has enabled.
• Duration: for the term of the subscription plus a 30-day return/deletion window.

3. Security commitments

• TLS for data in transit; encryption at rest at the database layer.
• Row-level security tenant isolation; per-district audit log for sensitive actions.
• Role-based access controls; least-privilege access for Habitus personnel.
• Push, SMS, and email subscriptions are opt-in per user.

4. Subprocessors

Habitus maintains a list of subprocessors used for hosting, email, SMS, and payments. Any new subprocessor handling student data is announced to district administrators at least 30 days before it is used.

5. Sub-incident response

Habitus will notify district administrators without undue delay (target: within 72 hours) of any confirmed security incident affecting district data, and will cooperate with the district's response.

6. Audits

Habitus will provide reasonable information to demonstrate compliance, including SOC 2 reports when available. Districts may request additional information at reasonable intervals.

7. Return and deletion

On termination, the district has 30 days to export data from the platform. Habitus will then delete or return remaining data, except where retention is legally required.

8. FERPA acknowledgment

Habitus acts as a school official under 34 CFR 99.31(a)(1)(i)(B), has a legitimate educational interest in the data accessed, is under the direct control of the district with respect to the use and maintenance of education records, and is subject to the re-disclosure and re-use requirements in 34 CFR 99.33(a).

Template version: 2026.06.30. Districts may negotiate amendments before signature.