Student Data Addendum

1. Scope and precedence

This Addendum applies to all Student Data — personal data concerning a student enrolled at the School — that is entered into, uploaded to, or processed through the Services.

In case of conflict between this Addendum and the Terms of Service, the Privacy Policy, or the DPA, this Addendum prevails with respect to Student Data.

2. Roles of the parties

The School is the data controller of Student Data and is responsible for:

• Obtaining verifiable parental or guardian consent before creating a student account or entering a student's personal data into the Services.
• Providing required notices to parents and guardians — including what Student Data is collected, why, and for how long it is retained.
• Responding to parental access, correction, or deletion requests, with assistance from AlonyoCloud as described in Section 7.
• Ensuring its own use of the Services complies with COPPA, GDPR-K, and any local education data protection laws.

3. Parental consent — the school's role as agent

Under COPPA (US), GDPR-K (EU/UK), and equivalent laws, a student under 13 (US) or under 16 (EU/UK) generally cannot consent to the processing of their personal data. Consent must come from a parent or guardian.

The School is responsible for obtaining this consent before creating student accounts or entering Student Data into the Services. The School may do so through its own enrollment process (for example, a signed consent form, a click-through at registration, or a documented consent workflow).

AlonyoCloud provides Schools with model consent language they may use or adapt: their own enrollment process.

4. Permitted uses of student data

AlonyoCloud uses Student Data only to provide the Services the School has enabled. Specifically:

• Storing, retrieving, and displaying student records to authorized School users and parents/guardians the School has permitted.
• Recording attendance, grades, and academic progress.
• Managing fee records and invoices.
• Sending transactional communications (absence notifications, grade reports, fee reminders) that the School triggers.
• Maintaining backups for disaster recovery.
• Protecting the security and integrity of the Services.

5. Prohibited uses of student data

AlonyoCloud shall never:

• Serve behavioral advertising to students.
• Use Student Data for advertising, marketing, or commercial profiling.
• Sell, rent, or trade Student Data to any third party.
• Share Student Data with data brokers.
• Train AI models on identifiable Student Data. (De-identified, aggregate insights may be used to improve the product only with the School's written permission.)
• Use Student Data to build profiles that could follow students beyond their time at the School.
• Disclose Student Data in response to a government or law enforcement request unless required by valid legal process — in which case we notify the School to the extent legally permitted.

6. Data minimization for students

AlonyoCloud collects the minimum Student Data necessary to provide the Services. Where possible, we use aggregated, de-identified data for analytics and product improvement.

The School controls which fields are required vs. optional when configuring student records. Fields marked as optional in the School's configuration can be left blank.

7. Parental and student rights

Parents and guardians have the right to:

• Access — review the Student Data held about their child.
• Correction — ask the School to correct inaccurate data.
• Deletion — ask the School to delete their child's data, subject to legal retention requirements.
• Refusal — refuse further collection or use of their child's data (which may result in the child being unable to use parts of the Services).

8. AI and automated processing

AlonyoCloud is developing AI-powered features (planned for 2027). Our commitments for any AI feature involving Student Data are:

• No AI model is trained on identifiable Student Data.
• Where AI features generate insights (for example, early-warning flags for at-risk students), the output is presented as a suggestion only — the teacher or administrator makes the final decision.
• AI features are opt-in per School. They are disabled by default.
• Before any AI feature is enabled for a School, we will update this Addendum, notify the School, and (where required by law) obtain fresh consent.
• Any automated decision that would have a legal or similarly significant effect on a student is not permitted under this Addendum without explicit written agreement.

9. Retention and deletion of student data

Student Data is retained for the term of the School's subscription, plus 30 days after termination to allow export. After that, it is permanently deleted unless retention is required by law.

The School may request earlier deletion at any time through the Services dashboard or by emailing [email protected].

10. Security of student data

Student Data is protected by the same technical and organizational measures described in Annex 2 of the DPA — including encryption in transit, encryption at rest for sensitive data, access controls, and multi-factor authentication for production access.

Given the sensitivity of student data, AlonyoCloud applies the following additional controls:

• Access to Student Data by AlonyoCloud personnel is limited to those with a documented business need (e.g. support cases involving the specific school).
• All internal access is logged.
• Data is never used for testing or development without being de-identified first.

11. Breach notification

In the event of a personal data breach affecting Student Data, AlonyoCloud shall notify the School within 48 hours of becoming aware of the breach, as described in Section 9 of the DPA.

Where the breach is likely to result in a high risk to students' rights and freedoms, the School is responsible for notifying parents and guardians and the relevant Supervisory Authority. AlonyoCloud will cooperate fully to support the School's notification obligations.

12. State-specific provisions (US)

For Schools subject to specific US state student data privacy laws, the following additional commitments apply:

• California (SOPIPA / California Student Data Privacy Act) — AlonyoCloud does not use Student Data for targeted advertising, does not build student profiles for non-educational purposes, and does not sell Student Data.
• New York (Education Law §2-d) — AlonyoCloud complies with the Parents' Bill of Rights and will execute a supplemental NY-specific data privacy agreement on request.
• Illinois (SOPPA) — AlonyoCloud executes a written SOPPA-compliant agreement with each Illinois School before processing Student Data.
• Other states (Colorado, Connecticut, Virginia, etc.) — AlonyoCloud will execute state-specific addenda as required by the School's state law. Contact [email protected].

13. International provisions

For Schools subject to GDPR-K (EU/UK), the following additional commitments apply:

• Age-appropriate design — where the Services are used by students under 18, AlonyoCloud applies the UK Age Appropriate Design Code principles and the EU GDPR-K rules to the extent they apply to processor activities.
• Data protection impact assessments — AlonyoCloud will provide reasonable assistance to the School in conducting any DPIA that involves Student Data.
• Specific safeguards — for students under 13 (COPPA) or under 16 (GDPR-K), Student Data is processed only for the educational purposes described in Section 4.

14. Term and termination

This Addendum enters into force when the School accepts the Terms of Service and remains in effect for as long as AlonyoCloud processes Student Data on behalf of the School.

Sections 9 (Retention and deletion), 10 (Security), and 11 (Breach notification) survive termination to the extent necessary to give them effect.

15. Order of precedence

In the event of a conflict between this Addendum and any other agreement between the parties — including the Terms, Privacy Policy, or DPA — this Addendum prevails with respect to Student Data.

16. Contact

For Student Data questions:

• Privacy: [email protected]
• Legal: [email protected]
• Mail: Kampala, Uganda (full address to be published upon completion of registration)