Data Processing Addendum

1. Roles

For personal data processed through the platform, the School is the data controller and Jettova, Inc. is the data processor, acting only on the School's documented instructions (this Addendum and the School Services Agreement being such instructions).

Where the platform is used with U.S. K-12 students, Jettova acts as a "school official" performing an institutional service under the School's direction, and will not use covered student data for its own purposes.

2. Categories of data & data subjects

• Organizers and families (adults): name, email, phone, and coordination facts (chaperone yes/no, permission-form returned, payment status).
• Payments: amounts, currency, and processor references (Stripe ids). NO card numbers are processed or stored by Jettova (see §5).
• Uploaded permission forms (optional feature): the document the family uploads and an AI "looks-signed" flag.
• Student emergency/medical data (optional, separately gated feature): student name, emergency contact, allergies/medications/conditions/dietary, and an e-signed consent record. Made available only where the parties agree the applicable education-privacy terms; entered by the guardian, need-to-know access, retention-limited.

3. Purpose & processing

Jettova processes the above solely to provide trip coordination and, where enabled, payment facilitation and travel, as described in the Agreement. Jettova will not sell personal data and will not use student data for advertising or to build a profile unrelated to the trip.

4. Sub-processors

The School authorizes the sub-processors below. Jettova imposes data-protection terms on each that are no less protective than this Addendum, and will give the School a reasonable opportunity to object to a new sub-processor.

5. Security measures

• Encryption in transit (TLS) and at rest (managed database/storage encryption).
• PCI SAQ-A: card data is entered only into the processor's hosted fields and never touches Jettova's servers, logs, or database.
• Deny-all row-level security on payment and student records; access only via least-privilege server APIs with role checks.
• Payment webhooks are cryptographically signature-verified before any state change.
• Private storage for uploaded forms, served only via short-lived signed URLs to authorized staff.
• Access to student emergency/medical data is need-to-know: the trip's organizers, the guardian to their own record; not families to peers, not read-only oversight.

6. Data-subject rights & assistance

Jettova will assist the School in responding to access, correction, and deletion requests, and in meeting its obligations under FERPA, COPPA, applicable state student-privacy laws (e.g. SOPIPA), and other applicable law.

7. Breach notification

Jettova will notify the School without undue delay after becoming aware of a personal-data breach affecting the School's data, with the information the School reasonably needs to meet its own notification obligations.

8. Retention & deletion

Coordination data is retained for the life of the trip room and pruned on its expiry. Student emergency/medical data is deleted on a scheduled basis shortly after the trip ends (retention window per the Agreement). Payment records are retained as needed for financial/audit purposes. On termination, Jettova will delete or return School personal data at the School's choice, save where retention is legally required.

9. International transfers

All processing is performed in the United States by Jettova and its sub-processors. Jettova does not transfer School personal data outside the United States, except that a sub-processor identified in Section 4 may process limited data in another region, in which case Jettova imposes contractual data-protection terms no less protective than this Addendum. Where a transfer of personal data requires a specific lawful transfer mechanism under applicable law, the parties will cooperate in good faith to put an appropriate mechanism and safeguards in place.

10. Audit & assistance

On the School's reasonable written request, and no more than once per year absent a breach or a legal or regulatory requirement, Jettova will make available the information reasonably necessary to demonstrate compliance with this Addendum, which may include Jettova's then-current security documentation and a summary of relevant assessments. Jettova will provide reasonable assistance to the School with data-protection impact assessments and consultations with supervisory authorities where applicable.

11. Order of precedence & general

This Addendum forms part of and is incorporated into the School Services Agreement. In the event of a conflict between this Addendum and the Agreement regarding the processing of personal data, this Addendum controls. This Addendum is governed by the same law as the Agreement. Terms not defined here have the meaning given in the Agreement or in applicable data-protection law. This Addendum survives termination of the Agreement for as long as Jettova processes School personal data.