School Data Use Agreement

1. Parties and Term

LegalCub, the career office service of BigLaw Bear ("LegalCub"), and the law school whose Owner accepts this agreement in LegalCub ("School"). One year from acceptance, renewing yearly. There is no fee. Either party may end it on 30 days' written notice.

2. School Official Designation

The School designates LegalCub a school official with a legitimate educational interest under 34 CFR 99.31(a)(1)(i)(B). LegalCub:

• performs an institutional service the School would otherwise use employees for: career services management;
• is under the School's direct control for how it uses and keeps School records;
• uses School records only to run the service for the School, under the School's instructions;
• does not redisclose them except as the School directs or the law requires (99.33(a)).

3. Permitted Use

LegalCub uses identifiable School records only to provide the career office service to the School's staff and students, under the School's instructions, and for no other purpose. It does not disclose them to any firm, employer or other school, except as the School directs for a student who has asked for it, such as an on-campus interview bid or a resume book the student joins.

Nothing in this agreement gives LegalCub a right to use identifiable School records for its own purposes. Section 17 covers aggregated and de-identified information.

4. Student Data the Student Controls

Students choose, item by item, what they share with the office. Every item is off until the student turns it on. A student can stop sharing at any time. When what is shared changes, earlier consent stops counting until the student agrees again. The School will not ask LegalCub to give it data a student has not shared.

The School uses what students share only to advise them, to run its career services and for its own reporting, including the employment outcomes it reports to the ABA and NALP. The School does not redisclose it except as FERPA and other applicable law allow.

5. School Authority and Representations

School represents and warrants that:

• it has the authority to enter into this agreement and to disclose School records to LegalCub for the service;
• to the extent it relies on 34 CFR 99.31(a)(1)(i)(B), it has determined that the service is an institutional service or function for which it would otherwise use employees;
• its FERPA annual notification specifies criteria for school officials and legitimate educational interests that are consistent with the disclosure;
• it has obtained any consent or other authorization the law requires for a disclosure not otherwise permitted without consent;
• the records it supplies are reasonably necessary for the service and do not include any category this agreement excludes;
• the people who upload records are authorized to act for the School.

6. Upload Certification and Invites

Each roster or records upload requires a staff member to certify that they are authorized to upload on the School's behalf, that the School has determined it has a lawful basis to provide the records for the authorized career services purposes, that the upload follows the School's policies and this agreement, and that it includes nothing beyond what those purposes need. LegalCub stores the certification, the person, the School and the time with the upload. A certification does not stand in for an accepted agreement or for any condition the law requires.

The School decides the lawful basis, accuracy and retention period of the records it uploads. LegalCub remains responsible for its own obligations here. LegalCub sends roster invites only when School staff press Invite. Uploading a roster sends nothing.

7. Security

Same controls as the firm Data Processing Agreement:

• AES-256 at rest;
• TLS 1.2 or newer, with HSTS;
• row-level security and service-role-only school tables;
• staff two-factor, which an Owner can require;
• SAML SSO;
• an audit log the School cannot edit;
• storage in the United States.

8. Security Incidents

LegalCub tells the School without undue delay, and within 72 hours where the law does not require sooner, after confirming unauthorized access to or disclosure of School records that compromises their confidentiality or security (a "Security Incident"). It gives the School the information it reasonably has about what happened, which categories of records are affected, and how it is containing and fixing it, and it cooperates with the School's investigation and its notice duties under state law (Indiana: IC 24-4.9).

Unless the law requires otherwise, the School controls notice to its students and regulators about School records, after reasonable consultation with LegalCub. Unsuccessful attempts that do not compromise School records are not Security Incidents.

9. Service Providers and Sub-Processors

The School authorizes LegalCub to engage and replace service providers it reasonably needs to host, secure, maintain, support and deliver the service, including for hosting, database, email, file storage, backup, monitoring and analytics. LegalCub binds each one by written confidentiality, security and purpose limits suited to what it processes, and stays responsible to the School for its own obligations. No sub-processor receives a right to use School records for its own purposes.

LegalCub keeps a list of the categories of sub-processors that touch School records in the IT packet (/security/schools) and gives the School written notice of a material change before the change takes effect. Notice does not require the School's consent; a School that objects may end this agreement under Section 1.

10. Student Requests

LegalCub routes FERPA access and amendment requests about School records to the School within 5 business days and helps the School answer them. A student's own BigLaw Bear account stays the student's to export or delete.

11. School-Controlled Records and Account Independence

School records are separate from any account a student keeps on BigLaw Bear. A student deleting or ending their own account is not, by itself, an instruction from the School to delete or change School records. LegalCub will not use a School record to recreate a deleted account, restore a student's choices, or show the student to any firm or employer.

LegalCub keeps, corrects, returns, deletes or de-identifies School records as the School documents its instructions. LegalCub may decline or pause an instruction to the extent the law requires and tells the School if it does, unless the law forbids it. It carries out the School's deletion or de-identification instructions within the time the parties agree, subject to documented technical limits, legal holds and backup schedules.

12. Retention, Return and Deletion

• Counselor notes follow the School's retention setting.
• When the agreement ends, the School can request Export Everything for 30 days, in a commonly usable format the service supports. LegalCub need not build custom exports or keep data beyond the periods stated here. LegalCub then deletes School records from its active systems on a documented schedule. Copies in backups are deleted or overwritten as the backups rotate, on the retention schedule LegalCub documents in the IT packet, unless the law requires LegalCub to keep them. LegalCub confirms deletion in writing on request.
• Until deletion, retained records stay under this agreement's confidentiality, security and use limits and are not restored to active use except for disaster recovery, security or legal compliance.
• If a student deletes their BigLaw Bear account, their roster rows stay under Section 11 until the School removes them or the agreement ends.

13. AI and Automated Features

LegalCub may use automated processing, including artificial intelligence, in providing the service. When it runs on identifiable School records, it runs only to provide the service to the School under the School's instructions and Section 3, and School staff make the decisions about students. LegalCub tells the School in the IT packet about a material new feature that processes School records, and the School may turn it off or end this agreement under Section 1.

14. Audit

Once a year, on 30 days' notice, the School may review LegalCub's security practices by questionnaire. LegalCub keeps the IT packet (/security/schools) current.

15. Accessibility

LegalCub builds to WCAG 2.2 AA and fixes reported barriers. There is no third-party audit or VPAT yet.

16. Liability, Law and Conflicts

Except for liability the law does not allow to be limited, each party's total liability under this agreement is capped at $25,000. Neither party is liable for indirect, incidental, special, consequential, exemplary or punitive damages, except where the law forbids the exclusion. The School is responsible for its own unauthorized disclosures and unlawful instructions. LegalCub is responsible for breaches of its own obligations. Neither party indemnifies the other unless a signed addendum says so.

The School's state law governs this agreement. The firm Data Processing Agreement does not apply to School records. If the School and LegalCub have also agreed a data processing agreement or security addendum, that document and this one apply together, this agreement controls for School records where they directly conflict, and the School's own data security addendum controls where it conflicts with this agreement unless a signed writing says otherwise. Nothing in either document, on its own, authorizes a disclosure of education records that FERPA does not allow.

17. Aggregated and De-Identified Information

LegalCub may create and use aggregated or de-identified information derived from the service for analytics, benchmarking, service improvement, security, research and product development, if it does not reasonably identify a student and its creation and use follow the law. Aggregation rule: groups under 10 are withheld, larger counts are rounded to 5, and no student is named. The data must not identify, and cannot reasonably be used to identify, a student. LegalCub may use it to run, secure, maintain and improve the service and to study recruiting trends. It appears in benchmarks shown to other schools only if the School opts in, and it never names the School unless the School agrees. LegalCub will not intentionally re-identify it, or combine it with other data to identify a student, unless the School authorizes it or the law requires it. Any other use must follow the law and this agreement. LegalCub may also measure how School staff use the service, such as sign-ins and features used, to run, secure and improve it.

18. Assignment

LegalCub may assign this agreement to a successor in a merger, acquisition, or sale of all or substantially all of the assets of the LegalCub service, if the successor agrees in writing to be bound by these terms. LegalCub gives the School written notice of the assignment. The School may then end this agreement under Section 1.