Data Privacy and Security Guidelines

This Data Privacy and Security Guidelines ("DPSG" or "Security Guidelines") document sets forth the duties and obligations of McGraw Hill (defined below) with respect to Personally Identifiable Information (defined below). In the event of any inconsistencies between the DPSG and the Agreement (defined below), the parties agree that the DPSG will supersede and prevail. Capitalized terms not defined herein shall have the meaning ascribed to them in the Agreement.

  1. Definitions.

    1. "Agreement" means the Agreement between McGraw Hill LLC or its applicable subsidiary or affiliate ("McGraw Hill") and Subscriber to which these Security Guidelines are referenced and made a part thereof.

    2. "Applicable Laws" means federal, state and international privacy, data protection and information security-related laws, rules and regulations applicable to the Services and to Personally Identifiable Information.

    3. "End User Data" means the data provided to or collected by McGraw Hill in connection with McGraw Hill's obligations to provide the Services under the Agreement.

    4. "Personally Identifiable Information" or "PII" means information provided to McGraw Hill in connection with McGraw Hill's obligations to provide the Services under the Agreement that (i) could reasonably identify the individual to whom such information pertains, such as name, address and/or telephone number or (ii) can be used to authenticate that individual, such as passwords, unique identification numbers or answers to security questions or (iii) is protected under Applicable Laws. For the avoidance of doubt, PII does not include aggregate, anonymized data derived from an identified or identifiable individual.

    5. "Processing of PII" means any operation or set of operations which is performed upon PII, such as collection, recording, organization, storage, use, retrieval, transmission, erasure or destruction.

    6. "Third Party" means any entity (including, without limitation, any affiliate, subsidiary and parent of McGraw Hill) that is acting on behalf of, and is authorized by, McGraw Hill to receive and use PII in connection with McGraw Hill's obligations to provide the Services.

    7. "Security Incident" means the unlawful access to, acquisition of, disclosure of, loss, or use of PII.

    8. "Services" means any services and/or products provided by McGraw Hill in accordance with the Agreement.

  2. Confidentiality and Non-Use; Consents.

    1. McGraw Hill agrees that the PII is the Confidential Information of Subscriber and, unless authorized in writing by Subscriber or as otherwise specified in the Agreement or this DPSG, McGraw Hill shall not Process PII for any purpose other than as reasonably necessary to provide the Services, to exercise any rights granted to it under the Agreement, or as required by Applicable Laws.

    2. McGraw Hill shall maintain PII confidential, in accordance with the terms set forth in this Security Guidelines and Applicable Laws. McGraw Hill shall require all of its employees authorized by McGraw Hill to access PII and all Third Parties to comply with (i) limitations consistent with the foregoing, and (ii) all Applicable Laws.

    3. Subscriber represents and warrants that in connection with any PII provided directly by Subscriber to McGraw Hill, Subscriber shall be solely responsible for (i) notifying End Users that McGraw Hill will Process their PII in order to provide the Services and (ii) obtaining all consents and/or approvals required by Applicable Laws.

  3. Data Security.

    McGraw Hill shall use commercially reasonable administrative, technical and physical safeguards designed to protect the security, integrity, and confidentiality of PII. McGraw Hill's security measures include the following:

    1. Access to PII is restricted solely to McGraw Hill's staff who need such access to carry out the responsibilities of McGraw Hill under the Agreement.

    2. Access to computer applications and PII are managed through appropriate user ID/password procedures.

    3. Access to PII is restricted solely to Subscriber personnel based on the user role they are assigned in the system (provided, however, that it is the Subscriber's responsibility to ensure that user roles match the level of access allowed for personnel and that their personnel comply with Applicable Law in connection with use of such PII).

    4. Data is encrypted in transmission (including via web interface) at no less than 128-bit level encryption.

    5. McGraw Hill or an McGraw Hill authorized party performs a security scan of the application, computer systems and network housing PII using a commercially available security scanning system on a periodic basis.

  4. Data Security Breach.

    1. In the event of a Security Incident, McGraw Hill shall (i) investigate the Security Incident, identify the impact of the Security Incident and take commercially reasonable actions to mitigate the effects of any such Security Incident, (ii) timely provide any notifications to Subscriber or individuals affected by the Security Incident that McGraw Hill is required by law, subject to applicable confidentiality obligations and to the extent allowed and/or required by and not prohibited by Applicable Laws or law enforcement.

    2. Except to the extent prohibited by Applicable Laws or law enforcement, McGraw Hill shall, upon Subscriber's written request, provide Subscriber with a description of the Security Incident and the type of data that was the subject of the Security Incident.

  5. Security Questionnaire.

    Upon written request by Subscriber, which request shall be no more frequently than once per twelve (12) month period, McGraw Hill shall respond to security questionnaires provided by Subscriber, with regard to McGraw Hill's information security program applicable to the Services, provided that such information is available in the ordinary course of business for McGraw Hill and it is not subject to any restrictions pursuant to McGraw Hill's privacy or data protection or information security-related policies or standards. Disclosure of any such information shall not compromise McGraw Hill's confidentiality obligations and/or legal obligations or privileges. Additionally, in no event shall McGraw Hill be required to make any disclosures prohibited by Applicable Laws. All the information provided to Subscriber under this section shall be Confidential Information of McGraw Hill and shall be treated as such by the Subscriber.

  6. Security Audit.

    Upon written request by Subscriber, which request shall be no more frequently than once per twelve (12) month period, McGraw Hill's data security measures may be reviewed by Subscriber through an informal audit of policies and procedures or through an independent auditor's inspection of security methods used within McGraw Hill's infrastructure, storage, and other physical security, any such audit to be at Subscriber's sole expense and subject to a mutually agreeable confidentiality agreement and at mutually agreeable timing, or, alternatively, McGraw Hill may provide Subscriber with a copy of any third party audit that McGraw Hill may have commissioned.

  7. Records Retention and Disposal.

    1. McGraw Hill will use commercially reasonable efforts to retain End User Data in accordance with McGraw Hill's End User Data retention policies.

    2. McGraw Hill will use commercially reasonable efforts to regularly back up the Subscriber and End User Data and retain any such backup copies for a minimum of 12 months.