Effective Date: April 15, 2026
This Data Processing Agreement ("DPA") is entered into between Kalvi Software, Inc. (d/b/a EdisonOS), a C-Corporation registered in Delaware, USA ("Processor" or "EdisonOS"), and the customer identified by their EdisonOS account ("Controller" or "Customer").
This DPA supplements the EdisonOS Terms of Use (edisonos.com/terms-of-use) and Privacy Policy (edisonos.com/privacy-policy). It governs the processing of Student Personally Identifiable Information ("Student PII") and any other personal data provided by the Customer to EdisonOS in connection with the platform services.
2.1 Customer as Controller
The Customer determines the purposes and means of processing personal data. The Customer is responsible for ensuring lawful collection and sharing of personal data with EdisonOS, including obtaining necessary consents and authorizations (e.g., parental consent under COPPA).
2.2 EdisonOS as Processor
EdisonOS processes personal data solely on behalf of and as instructed by the Customer, for the purpose of providing the platform services described in the Terms of Use. EdisonOS does not determine the purposes of processing and will not use personal data for any purpose beyond service delivery.
2.3 School Official Designation
Where the Customer is a School or educational agency, EdisonOS operates as a "School Official" with a "legitimate educational interest" as defined under FERPA. EdisonOS processes Student PII under the direction and control of the School solely for the educational purposes specified in the service agreement.
3.1 Categories of data processed
3.2 Purpose of Processing
3.3 Data not collected
EdisonOS does not collect Social Security Numbers, biometric data, medical/health records, financial data, or geolocation beyond city-level IP inference. See Privacy Policy Section B3.2 for the complete exclusion list.
EdisonOS implements and maintains the following technical and organizational security measures:
EdisonOS engages the following sub-processors to deliver platform services. Each sub-processor is bound by contractual obligations providing equivalent data protection.
5.1 Changes to sub-processors
EdisonOS will notify the Customer at least 15 days before engaging a new sub-processor that will process Student PII. If the Customer objects, they may terminate the agreement by providing written notice within the 15-day period.
5.2 TeachEdison Solutions Pvt Ltd
TeachEdison Solutions Pvt Ltd (India) provides platform engineering and technical support under a separate DPA with Kalvi Software, Inc. TeachEdison personnel may access application systems and Student Data solely for development and support purposes. TeachEdison does not independently control Student PII and is contractually required to comply with FERPA, COPPA, and applicable US state student privacy laws.
6.1 Post-termination
Upon termination or expiration of the agreement, EdisonOS will retain Customer and Student data for 60 days to allow export. After 60 days, all personal data will be securely deleted from production systems. Backup copies will be overwritten within the 30-day backup rotation cycle. The Customer may request earlier deletion by emailing privacy@edisonos.com.
6.2 De-identified data
EdisonOS may retain de-identified, aggregated data (from which no individual student can be identified) for product improvement purposes. De-identification is performed in accordance with FERPA's de-identification standard.
7.1 Notification timeline
In the event of a confirmed Data Breach involving Student PII, EdisonOS will:
7.2 Ongoing Communication
EdisonOS will provide regular updates as the investigation progresses and a final incident report within 30 days of resolution, including root cause analysis and remediation steps.
7.3 Cooperation
EdisonOS will cooperate fully with the Customer's investigation and provide complete transparency regarding the incident and all remediation steps. EdisonOS will not notify parents or students directly unless instructed to do so by the Customer or required by law.
8.1 Access and audit
The Customer may request access to or copies of all personal data processed by EdisonOS on their behalf. EdisonOS will respond to such requests within 30 calendar days. The Customer may also conduct or commission an audit of EdisonOS's data processing practices with 30 days' written notice, at the Customer's expense.
8.2 Data export
The Customer may export student data at any time through the platform's built-in export tools. Exported data is provided in standard formats (CSV, PDF).
8.3 Parental Rights
Parents or eligible students may exercise their rights under FERPA (access, correction, deletion) through the Customer (the School or Business User). The Customer is responsible for facilitating these requests. EdisonOS will cooperate with the Customer to fulfill such requests within 30 days.
EdisonOS will not:
This DPA is governed by the laws of the State of Delaware, USA. Disputes shall be subject to the exclusive jurisdiction of the courts in New Castle County, Delaware.
This DPA remains in effect for the duration of the Customer's use of EdisonOS. Obligations relating to data deletion (Section 6), breach notification (Section 7), and prohibited uses (Section 9) survive termination.
For DPA-related inquiries, data access requests, or to report a security concern:
.png)
.webp)
