New York Addendum to the Student Data Privacy Agreement

This New York Addendum supplements the Student Data Privacy Agreement ("DPA") between Evrica Technologies Inc. (the "Provider") and a New York educational agency ("EA"). The EA is the data controller; the Provider acts as a third-party contractor as defined in 8 NYCRR Part 121.

Part A — Parents' Bill of Rights for Data Privacy and Security

1. A student's personally identifiable information ("PII") cannot be sold or released for any commercial or marketing purposes by the EA or any third-party contractor.
2. Parents have the right to inspect and review the complete contents of their child's education record stored or maintained by the Provider on behalf of the EA.
3. State and federal laws, including the Family Educational Rights and Privacy Act ("FERPA") and § 2-d, protect the confidentiality of students' PII, and safeguards associated with industry standards and best practices (including encryption and access controls) are in place when data is stored or transferred.
4. A complete list of all student data elements collected by NYSED is available at www.nysed.gov/data-privacy-security/student-data-inventory.
5. Parents have the right to file complaints about possible breaches of student data with the EA, the New York State Education Department, or both. Complaints to NYSED may be submitted to privacy@nysed.gov or to the Chief Privacy Officer, NY State Education Department, 89 Washington Avenue, Albany, NY 12234.
6. Where a contract with a third-party contractor expires or is terminated, all student PII will be returned to the EA or securely destroyed in accordance with NIST SP 800-88 Rev. 1.

Part B — Supplemental Information (8 NYCRR § 121.3)

For each contract under which the Provider receives PII from the EA, the following Supplemental Information is provided:

1. Exclusive purposes for which the data will be used

Student PII shared with the Provider will be used exclusively to (a) deliver individualized tutoring, learning-style adaptation, and social-emotional check-ins via the Oscar application; (b) generate progress reports for the student, parents, teachers, and EA; (c) maintain and improve the Services for the benefit of the EA; and (d) comply with the EA's safety and mandated-reporting workflows.

2. How the Provider will ensure that subcontractors abide by data protection and security requirements

The Provider contractually binds every subprocessor (listed at /legal/subprocessors) to the same data-protection and security obligations the Provider owes to the EA under this DPA, including limitations on use, encryption requirements, breach notification, and audit cooperation. The Provider performs annual reviews of each subprocessor's security posture.

3. When the contract expires and what happens to PII upon expiration

Upon expiration or termination of the contract, all student PII will be returned to the EA in a usable electronic format or, at the EA's election, destroyed in accordance with NIST SP 800-88 Rev. 1 within forty-five (45) days. The Provider will deliver a written certificate of destruction signed by an authorized officer.

4. How a parent, eligible student, teacher, or principal may challenge the accuracy of PII

A parent, eligible student, teacher, or principal who believes any PII held by the Provider is inaccurate may submit a written request to the EA. The EA will forward the request to the Provider, which will investigate and respond within thirty (30) days. Corrections will be made promptly upon a determination by the EA that they are warranted.

5. Where PII will be stored, and the security protections in place

PII is stored on infrastructure located within the continental United States, operated by the subprocessors listed in Exhibit D. Security controls are described in detail in the Security and Data Protection Plan and align to the NIST Cybersecurity Framework v1.1. They include, at minimum: AES-256 encryption at rest, TLS 1.2+ encryption in transit, role-based access controls, multi-factor authentication for administrative access, continuous logging and monitoring, annual third-party security review, and incident response procedures aligned to NIST SP 800-61.

6. How PII will be protected using encryption while in motion and at rest

All PII is encrypted in transit using TLS 1.2 or higher and at rest using AES-256 or equivalent. Backups are encrypted using AES-256 and key material is managed through a hardware-backed key-management service.

Part C — Data Breach Notification

In the event of any unauthorized release, disclosure, or acquisition of PII, the Provider will notify the EA without unreasonable delay, and in any event within seventy-two (72) hours of discovery, and will cooperate with the EA in any required notification to the NYSED Chief Privacy Officer and affected parents and eligible students. Notification will include: the nature and scope of the incident; the categories of data and number of individuals affected; mitigation taken and planned; and a contact for further information.

Part D — Mandated Reporter Cooperation

The Provider's safety system will notify a designated school official ("Designated Recipient") at the EA in the event Oscar detects content reasonably indicating suspected child abuse, neglect, self-harm, or risk to the safety of the student or another person. The EA will identify the Designated Recipient and the notification channel in writing prior to the start of Services. Nothing in this Addendum relieves the EA, its employees, or any other party of obligations under New York Social Services Law § 413 and related mandated-reporter statutes.

Part E — Training

The Provider certifies that all officers and employees with access to PII have received annual training on the federal and New York State laws governing the confidentiality of such data, consistent with 8 NYCRR § 121.7.

Part F — Standards Alignment

Oscar is aligned to the New York State Next Generation Learning Standards (Math and ELA), the NYS Bilingual Common Core Initiative, the NGSS, and supports for English Language Learners aligned to NYSESLAT. See the full Standards Alignment Statement.

Part G — Signatures

Provider: Evrica Technologies Inc.
By: Anna M. Sarkisyan, Chief Executive Officer
Date: May 29, 2026

Educational Agency: __________________________
By: __________________________
Title: __________________________
Date: __________________________