Weorda ← Back to Home

Data Processing Addendum

Effective Date: October 5, 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service ("Agreement") between YPA Group Inc., doing business as WeOrda ("Processor" or "WeOrda"), and the customer that has accepted the Agreement ("Controller" or "Customer"). This DPA applies to WeOrda's processing of personal data on behalf of Customer.

By accepting the Agreement, Customer accepts this DPA. In the event of any conflict between the Agreement and this DPA with respect to data processing, this DPA controls.

1. Definitions

Capitalized terms not defined in this DPA have the meanings given in the Agreement.

2. Roles of the Parties

2.1 With respect to Personal Data processed in connection with the Service, Controller is the data controller and Processor is the data processor.

2.2 Processor processes Personal Data only on Controller's documented instructions, as set forth in the Agreement, this DPA, and any other written instructions provided by Controller and accepted by Processor.

2.3 Processor does not determine the purposes or means of processing Personal Data and acquires no ownership rights in Personal Data.

2.4 Where Controller is, or acts on behalf of, an educational agency or institution subject to FERPA, the FERPA Terms in Exhibit A apply to Education Records and prevail over any conflicting term of this DPA with respect to those records. Where Controller is a New York educational agency (or acts on its behalf), the New York Education Law § 2-d Rider in Exhibit B also applies.

3. Nature and Purpose of Processing

3.1 Processor processes Personal Data solely to provide the Service to Controller, including:

3.2 Processor does not provide emergency response services, safety supervision, or regulatory compliance services.

3.3 The duration of processing is the term of the Agreement, plus any post-termination retention period set forth in Section 11 of this DPA.

4. Categories of Personal Data and Data Subjects

4.1 The categories of Personal Data processed depend on Controller's use of the Service. Categories may include:

4.2 Categories of Data Subjects include Controller's employees, contractors, and the individuals served by Controller's operations (such as students), and their authorized representatives.

4.3 Student information listed in Section 4.1 (including pickup and drop-off addresses and rider needs) is processed as Education Records under Exhibit A (FERPA Terms) where it comes from or concerns an educational agency or institution. Controller will limit rider-needs entries to what the crew needs to transport the student safely and will not record diagnoses, medications, or other health information the crew does not need. Controller may upload any operational data it needs to run its service (Section 4.1). Only the following categories will NOT be processed unless separately agreed in writing:

4.4 Controller will not upload any category listed in Section 4.3 unless the parties have executed a separate written addendum or Order Form covering that category. Controller is responsible for ensuring that excluded categories are not uploaded to the Service. If Processor becomes aware that Controller has uploaded an excluded category without such written agreement, Processor may, without liability and at its discretion, refuse to process, quarantine, or securely delete that data, and will notify Controller. Where any permitted category constitutes Education Records, Exhibit A applies.

5. Data Ownership

5.1 All Personal Data provided by Controller remains the sole property of Controller. Processor acquires no ownership rights in Personal Data.

5.2 Processor will not sell, lease, rent, or otherwise monetize Personal Data.

5.3 Processor will not use Personal Data to train artificial intelligence models for external customers without Controller's prior written consent.

5.4 Processor uses automated document-extraction technology, which may include machine-learning models operated within Processor's cloud infrastructure, to read driver license, medical examiner's certificate, and fuel receipt images uploaded by workers and to populate the corresponding fields. Extracted values are presented to the submitting worker for confirmation or correction before use. Processor does not use uploaded documents or extracted values to train such models, and no decision producing legal or similarly significant effects on a worker is made solely by automated means.

6. Data Minimization

6.1 Processor will process only the minimum Personal Data necessary to provide the Service.

6.2 Controller is responsible for ensuring that only necessary Personal Data is uploaded to the Service. Controller acknowledges that uploading data not necessary for the Service may increase risk and should be avoided.

7. Security Measures

7.1 Processor implements reasonable administrative, technical, and organizational safeguards to protect Personal Data, including:

7.2 Access to Personal Data is limited to authorized personnel who have a need to access such data to provide the Service.

7.3 Processor does not guarantee uninterrupted connectivity, availability, or real-time delivery of communications. No security system is impenetrable.

8. Subprocessors

8.1 Controller authorizes Processor to engage Subprocessors to provide infrastructure and supporting services. As of the effective date of this DPA, Processor uses the following Subprocessors:

A current list of Subprocessors is maintained at weorda.com/subprocessors.

8.2 Processor will provide thirty (30) days' written notice (which may be by email or notice in the operator dashboard) before engaging a new material Subprocessor.

8.3 Controller may object to a new Subprocessor by emailing privacy@weorda.com within the notice period. If Processor cannot reasonably accommodate Controller's objection, Controller may terminate the affected portion of the Service.

8.4 Processor remains responsible for the acts and omissions of its Subprocessors to the same extent Processor would be responsible if it performed the services directly.

8.5 Where a Subprocessor processes Education Records (as defined in Exhibit A), Processor will bind that Subprocessor in writing to terms materially equivalent to Exhibit A, including the use limitation and the prohibition on redisclosure without authorization (34 CFR 99.33(a)).

9. Confidentiality

9.1 Processor ensures that personnel authorized to process Personal Data are bound by confidentiality obligations.

9.2 Confidentiality obligations survive termination of employment and engagement.

10. Security Incident Notification

10.1 In the event Processor becomes aware of a Security Incident affecting Controller's Personal Data, Processor will notify Controller without undue delay and, where feasible, no later than seventy-two (72) hours after becoming aware. Where a state student-privacy law applicable to Controller requires faster notice (for example, New York Education Law § 2-d, see Exhibit B), the shorter deadline applies.

10.2 The notification will include, to the extent known at the time of notification:

10.3 Processor will provide Controller with reasonable assistance in fulfilling Controller's obligation to notify affected individuals and regulators, where required by law.

10.4 Controller is responsible for determining whether notification to Data Subjects or regulators is required under applicable law and for delivering any such notices, unless Processor is required by law to make such notifications directly.

11. Data Retention and Deletion

11.1 Processor will retain Personal Data only as long as necessary to provide the Service or as required by law.

11.2 Upon termination of the Agreement, Processor will, upon Controller's written request:

within thirty (30) days of the request, unless retention is required by law.

11.3 Upon completion of deletion, Processor will provide written confirmation upon Controller's request.

11.4 Backups containing Personal Data may be retained for up to ninety (90) days in encrypted backup systems and are deleted in the ordinary course of backup rotation.

11.5 Documents uploaded by workers. Driver license and medical examiner's certificate images, together with the extracted details, form part of Controller's driver qualification file. During the term of the Agreement they are retained while the worker remains assigned to Controller's organization and for three (3) years thereafter, the period 49 CFR 391.51 requires for driver qualification records, unless Controller instructs earlier deletion or a longer retention is required by law, and are then deleted. Upon termination of the Agreement they are returned or deleted with Controller's other Personal Data under Section 11.2, whatever part of that period remains; Processor does not hold the driver qualification file for Controller after termination, and Controller remains responsible for keeping it for the period the law requires. An image that the worker rejects as wrongly read, or that is not confirmed within thirty (30) days of upload, is deleted. Access to medical examiner's certificates within the Service is limited to Controller's administrator users. Fuel receipt images and extracted details are Controller's financial records: they are retained for the term of the Agreement, included in any return of Personal Data under Section 11.2, and deleted with Controller's other Personal Data. Processor does not retain fuel receipts on Controller's behalf after deletion, and Controller remains responsible for its own tax and audit record-keeping obligations.

12. Data Subject Rights

12.1 Where Data Subjects exercise rights under applicable law (such as rights to access, correct, delete, port, or restrict processing), Controller is responsible for responding to such requests.

12.2 Processor will reasonably assist Controller in responding to Data Subject requests, taking into account the nature of the processing. Assistance may include providing technical means to access, export, correct, or delete Personal Data.

12.3 If Processor receives a request directly from a Data Subject regarding Controller's Personal Data, Processor will promptly forward the request to Controller and will not respond directly except to confirm receipt and direct the Data Subject to Controller.

13. Controller Responsibilities and Representations

13.1 Controller represents, warrants, and covenants that:

13.2 Processor is not responsible for the legality of Controller's data collection practices.

14. International Data Transfers

14.1 Personal Data is processed and stored on servers located in the United States.

14.2 If Controller provides Personal Data of individuals located outside the United States, Controller is responsible for ensuring that the transfer of such data to Processor in the United States complies with applicable law, including any cross-border transfer requirements.

14.3 If transfer of Personal Data from the European Economic Area, United Kingdom, or Switzerland to the United States is required, the parties agree to enter into the Standard Contractual Clauses or other appropriate transfer mechanisms required by applicable law.

15. Audit Rights

15.1 Processor will make available to Controller information reasonably necessary to demonstrate compliance with this DPA, including responses to reasonable security and compliance questionnaires.

15.2 Upon Controller's written request and no more than once per calendar year (except as required following a confirmed Security Incident or as required by a regulator), Processor will provide Controller with reasonable cooperation in an audit conducted by Controller or a mutually agreed third-party auditor, subject to confidentiality and reasonable advance notice (at least thirty (30) days).

15.3 Audits will be conducted during normal business hours, will not unreasonably interfere with Processor's operations, and will be at Controller's expense.

15.4 Processor may, in lieu of supporting a direct audit, provide attestation reports (such as SOC 2 reports, when available) from independent auditors.

16. Limitation of Liability

16.1 Each party's liability under this DPA is subject to the limitation of liability set forth in the Agreement.

16.2 Nothing in this DPA limits a party's liability where prohibited by applicable law.

17. Governing Law

This DPA is governed by the law that governs the Agreement (the laws of the State of Delaware, unless a signed Order Form or public-sector addendum provides otherwise for Controller), except where applicable law requires otherwise.

18. Term and Termination

18.1 This DPA is effective as of the date Customer accepts the Agreement and remains in effect for the term of the Agreement, plus any post-termination period required for return or deletion of Personal Data.

18.2 Termination of the Agreement automatically terminates this DPA, except for provisions that by their nature survive termination.

19. Order of Precedence

In the event of a conflict between the Agreement and this DPA with respect to the processing of Personal Data, this DPA controls. As to Education Records, Exhibit A controls; as to New York student data, Exhibit B controls.

20. Contact Information

Questions or requests under this DPA should be directed to:

YPA Group Inc. (d/b/a WeOrda)

Privacy: privacy@weorda.com

Legal: legal@weorda.com

---

Exhibit A — FERPA Terms

These FERPA Terms supplement the DPA and apply only to Education Records that Controller (or the educational agency or institution it serves) makes available to Processor through the Service. If any term of the DPA or the Agreement conflicts with these FERPA Terms with respect to Education Records, these FERPA Terms control for those records.

A1. Definitions. "FERPA" means the Family Educational Rights and Privacy Act, 20 U.S.C. 1232g, and its regulations at 34 CFR Part 99. "Education Records," "Personally Identifiable Information," "Eligible Student," and "School Official" have the meanings given in 34 CFR Part 99. "Educational Agency or Institution" means the school, school district, or other entity subject to FERPA on whose behalf the Education Records are processed.

A2. School Official designation (34 CFR 99.31(a)(1)(i)(B)). Controller designates Processor as a School Official with a legitimate educational interest in the Education Records, for the purpose of performing the Service. Processor acknowledges that it:

(a) performs an institutional service or function for which the Educational Agency or Institution would otherwise use its own employees;

(b) is under the direct control of the Educational Agency or Institution with respect to the use and maintenance of the Education Records; and

(c) is subject to 34 CFR 99.33(a) governing the use and redisclosure of Personally Identifiable Information from Education Records.

Where Controller is not itself the Educational Agency or Institution (for example, a transportation contractor serving a school district), Controller represents that the Educational Agency or Institution has authorized Controller to engage Processor for this purpose and to direct the processing of Education Records under these FERPA Terms, and Controller is responsible for obtaining and maintaining that authorization. Processor may rely on this representation.

A3. Use limitation (34 CFR 99.33(a)(2)). Processor, and its officers, employees, and agents, will use the Education Records only for the purpose of providing the Service as directed by Controller, and for no other purpose. Processor will not use Education Records for advertising, to build or enrich any profile for a non-educational purpose, or to train artificial-intelligence models other than as strictly necessary to provide the Service to Controller.

A4. No redisclosure (built on 34 CFR 99.33(a)(1), with two contractual additions noted below). Operating within the school-official channel of 34 CFR 99.31(a)(1), in which Controller directs disclosures on behalf of the Educational Agency or Institution and its parents and Eligible Students, Processor will not disclose Education Records to any other party except: (i) as directed or authorized in writing by Controller; (ii) to Subprocessors bound under Section A8; or (iii) where Processor is legally compelled, in which case Processor will, unless legally prohibited, give Controller prior notice and a reasonable opportunity to respond and will direct the requesting party to Controller. Controller remains responsible for ensuring that any disclosure it authorizes complies with FERPA, including obtaining parent or Eligible-Student consent where 34 CFR 99.33(a)(1) requires it. Where Controller is not itself the Educational Agency or Institution, Controller's authorization under this Section is effective only to the extent the Educational Agency or Institution has authorized Controller to direct such disclosures.

A5. Direct control; access controls. Processor will process, retain, correct, and delete Education Records in accordance with Controller's documented instructions. Processor will maintain reasonable access controls so that personnel access only those Education Records necessary to provide the Service (supporting Controller's obligation under 34 CFR 99.31(a)(1)(ii)).

A6. Parental and Eligible-Student rights. Education Records remain under Controller's control for purposes of inspection, review, and amendment under 34 CFR 99.10 through 99.22. Processor will, without undue delay and within any timeframe Controller reasonably specifies to meet FERPA's 45-day requirement, provide Controller the technical means to access, export, correct, or delete Education Records so that Controller can respond to a parent or Eligible Student. Processor will not respond directly to such a request except to direct the requester to Controller.

A7. Return and destruction. Upon Controller's instruction or upon expiry or termination, Processor will return or securely destroy Education Records in accordance with DPA Section 11, and will not retain Education Records except as required by law. Any de-identified data derived from Education Records will meet the standard of 34 CFR 99.31(b) before any retention beyond the Service term.

A8. Subprocessors. Processor will bind any Subprocessor that processes Education Records to written terms materially equivalent to these FERPA Terms, including Sections A3 and A4, and remains responsible for such Subprocessors.

A9. Security and incident notice. Processor will protect Education Records under DPA Section 7 and will notify Controller of a Security Incident affecting Education Records under DPA Section 10, or sooner where a state student-privacy law applicable to Controller requires (see Exhibit B for New York).

A10. State student-privacy laws. Where Controller identifies that a state student-privacy law applies (for example, New York Education Law 2-d or SOPIPA), the parties will execute any additional rider that law requires, which is incorporated into these FERPA Terms when signed (see Exhibit B for New York).

A11. No beneficiary use; survival. Processor acquires no rights in Education Records. Sections A3, A4, A7, and A8 survive termination for so long as Processor retains any Education Records.

---

Exhibit B — New York Education Law § 2-d Rider

Applies only where Controller is, or acts on behalf of, a New York "educational agency" as defined in Education Law § 2-d(1) and discloses "student data" or "teacher or principal data" to Processor. To the extent of any conflict with the Agreement or DPA regarding such data, this Exhibit controls.

B1. Definitions. "Educational agency," "student data," "teacher or principal data," "personally identifiable information" (carrying the FERPA meaning), "breach," "unauthorized release," "third-party contractor," and "encryption" have the meanings in Education Law § 2-d and 8 NYCRR § 121.1. "Protected Data" means student data and/or teacher or principal data Processor receives under the Agreement.

B2. Contractor obligations (8 NYCRR § 121.9). Processor, as third-party contractor, will:

  1. adopt technologies, safeguards, and practices that align with the NIST Cybersecurity Framework;
  2. comply with the Educational Agency's data security and privacy policy, Education Law § 2-d, and 8 NYCRR Part 121;
  3. limit internal access to Protected Data to those who need it to provide the contracted services;
  4. not use Protected Data for any purpose not explicitly authorized in the Agreement;
  5. not disclose Protected Data without the prior written consent of the parent or eligible student, except (a) to a subprocessor bound under B4, or (b) where required by statute or court order with notice to the Educational Agency no later than the time of disclosure unless prohibited;
  6. maintain reasonable administrative, technical, and physical safeguards;
  7. use encryption to protect Protected Data in motion and at rest, meeting the standard in 8 NYCRR § 121.5;
  8. not sell Protected Data and not use or disclose it for any marketing or commercial purpose.

B3. Breach reporting (8 NYCRR § 121.10). Processor will notify the Educational Agency of any breach or unauthorized release of Protected Data in the most expedient way possible and without unreasonable delay, but no more than seven (7) calendar days after discovery, and will cooperate so the Educational Agency can meet its own notification deadlines (Chief Privacy Officer within 10 days; affected individuals within 60 days).

B4. Subprocessors. Processor will bind each subprocessor that processes Protected Data, by written contract, to obligations materially equivalent to this Exhibit, Education Law § 2-d, and Part 121.

B5. Return or destruction. On expiration, termination, or the Educational Agency's instruction, Processor will return and/or securely destroy Protected Data per DPA Section 11, with written certification on request.

B6. Parents Bill of Rights. Processor will comply with the Educational Agency's published Parents Bill of Rights for Data Privacy and Security (Education Law § 2-d(3)). The supplemental information Processor provides for the Educational Agency to append (8 NYCRR § 121.3(c)) is in the Schedule below.

Schedule to Exhibit B — Supplemental Information (8 NYCRR § 121.3(c))

  1. Exclusive purposes. Solely to provide the WeOrda Service: workflow management (check-in/out, boarding/attendance/ride status), route and schedule management including student pickup/drop-off locations, operator-initiated notifications to authorized parties, compliance and audit reporting, and technical operation, support, and security. No advertising, commercial use, sale, non-educational profiling, or AI-model training other than as strictly necessary to provide the Service.
  2. Subprocessor compliance. By written contract per B4. Current subprocessors: Google Cloud Platform, Firebase, Mapbox, Twilio, SendGrid, and Stripe, as listed in DPA Section 8.1 and at weorda.com/subprocessors.
  3. Contract duration / data at expiration. Term of the Agreement plus the return/deletion window in DPA Section 11; Protected Data returned and/or securely destroyed within 30 days of written request; encrypted backups age out within 90 days.
  4. Challenging accuracy. Requests are directed to the Educational Agency, which controls the records; WeOrda provides the technical means to access, correct, or delete so the Educational Agency can respond. Contact: privacy@weorda.com.
  5. Storage and protection. Stored on Google Cloud Platform in the United States; protections include role-based access control, MFA for administrative access, access logging and monitoring, need-to-know internal access, personnel confidentiality, and NIST CSF alignment.
  6. Encryption. In motion (TLS/HTTPS) and at rest, meeting 8 NYCRR § 121.5.

B7. Signature (for NY agencies requiring a signed agreement).

YPA Group Inc. d/b/a WeOrda: __________________________ Date: __________

Educational Agency: ____________________________________ Date: __________