# Backpack Education — Data Processing Agreement

Backpack Education — version 2026.1 — September 21, 2026

This Data Processing Agreement describes how Gigahertz Company LLC ("Provider") handles a district's student data in delivering Backpack Education. It is offered on the terms of the Illinois Student Data Privacy Agreement (NDPA Standard Version 1.0, Illinois form) and is available to any [District] as the general offer of privacy terms under that agreement. A signed Order Form and executed NDPA control for a specific district; this document states the substance Provider commits to in either case.

## Description of services

A curated video learning service for kindergarten through fifth grade. Teachers assemble collections from a catalog [District] has approved; students watch on classroom devices; guardians may view what their own child watched. The service is delivered to students on district-managed devices and to staff and guardians through a web browser.

## Schedule of data

| Category | Elements collected | Purpose |
| --- | --- | --- |
| Student identifiers | Roster identifier, first name, last initial, grade, school, and section enrollments | for sign-in on the classroom device and matching a student to their teacher's collection. |
| Guardian contact | Name and email address where the roster supplies one, and relationship | for the family notice, the optional weekly digest, and the guardian view of their own child. |
| Staff identity | Name, email, role, school, and section assignments | for single sign-on, console access, and approval routing. |
| Usage | Video identifier, section, start and end time, and device session identifier | for a teacher's view of what a student watched, and aggregate reporting to the school and district. |
| Not collected | Date of birth, Home address, Photographs of any student, Free-text student input, Search queries, Location data, Biometric data, Disciplinary or special-education records, Assessment scores | — |

## Directive for disposition of data

Student data is disposed of at the earliest of: the district's written direction; 60 days after a student's roster record becomes inactive; or 90 days after the end of the term unless the district elects a shorter period. Usage records older than the district's configured retention period (default one school year) are purged nightly. Disposition is by deletion from primary storage and expiry of encrypted backups within 30 days thereafter. Provider issues a certificate of deletion signed by an officer.

## General offer of privacy terms

Provider offers the same privacy protections found in an executed Illinois Student Data Privacy Agreement to any other Illinois local education agency that accepts this general offer, for the duration of the originating agreement. The offer expires three years from the originating agreement's effective date or upon its termination, whichever is earlier, and does not apply to a subscribing district's Order Form pricing or services.

## Illinois-specific terms (105 ILCS 85)

1. **Breach notice.** Provider notifies the district of a breach of covered information no later than 30 calendar days after determining a breach occurred, and provides the information the district needs to meet its own notice obligations to parents.
2. **Subcontractors.** Provider maintains a public list of subcontractors that receive covered information (see the Subprocessor List) and gives the district 30 days' notice of any change.
3. **Posting.** Provider acknowledges a district's obligation to post this agreement and the schedule of data on the district's website and consents to that posting.
4. **Targeted advertising, profiling, sale.** Prohibited. Provider does not engage in targeted advertising on the service or elsewhere based on covered information, does not build a profile of a student except in furtherance of K–12 purposes, and does not sell, rent, or trade covered information.
5. **Parental rights.** Provider supports a district in fulfilling a parent's request to inspect, review, correct, or delete their child's covered information within the district's statutory period, through the export and correction tools in the district console.

## Data Steward

Each district designates a Data Steward as its single point of contact for privacy, security, and data handling matters under this agreement, and the person Provider notifies first in any incident. The Data Steward approves or declines subprocessor changes, directs data disposition and export requests, configures the district's retention period, and reviews Provider's quarterly isolation test report.