1040-00001 · Kessler & Montague LLP · Engagement Letter

data-protection-addendum.docx DOCUMENT M&A / Corporate

6 / 12 ← → ✕

DATA PROTECTION ADDENDUM

Exhibit A to Engagement Letter dated February 10, 2026

PARTIES:

This Data Protection Addendum (this "Addendum") is entered into as of February 10, 2026 (the "Effective Date"), by and between:

Calderwood & Harkness LLP, a Delaware limited liability partnership ("Firm" or "C&H"), with its principal office at 600 Market Street, Suite 4200, Philadelphia, PA 19106;

and

Wyndmere Education Trust, a Delaware nonprofit corporation ("Client" or "WET"), with its principal office at 1400 Brandywine Boulevard, Suite 300, Wilmington, DE 19801.

C&H and WET are each referred to herein individually as a "Party" and collectively as the "Parties."

REFERENCE: This Addendum is attached as Exhibit A to, and incorporated into and forms part of, the Engagement Letter between C&H and WET of even date (Matter No. 1040-00001; Client No. C-88214) (the "Engagement Letter"), pursuant to which C&H has been engaged to represent WET in employment-law advisory and litigation matters arising from WET's faculty restructuring plan, including the defense of an unfair labor practice charge before the Delaware Public Employment Relations Board, multi-state employment law compliance advisory work, and anticipated individual wrongful-termination claims.

This Addendum is entered into to satisfy the requirements of Section 14.3 of the Wyndmere Education Trust — Outside Counsel Guidelines & Billing Policies, v.4.2, effective July 1, 2025 ("WET OGG"), which mandates the execution of a Data Protection Addendum by all outside counsel prior to the receipt of any Protected Data (as defined herein) from WET or its affiliates.

Right-click to update Table of Contents

RECITALS

WHEREAS, C&H has been engaged by WET to provide legal services in connection with employment-law matters, including the defense of an unfair labor practice charge filed by the Veltrano Federation of Educators, Local 1147, before the Delaware Public Employment Relations Board (Case No. PERB-2026-ULP-0041), multi-state employment law compliance advisory work relating to WET's planned elimination of forty-seven (47) full-time teaching positions across the States of Delaware, Pennsylvania, and New Jersey, and anticipated individual wrongful-termination claims that may be asserted by affected faculty members;

WHEREAS, in the course of such representation, C&H may receive, access, process, or store student education records and other personally identifiable information ("PII") that is subject to the Family Educational Rights and Privacy Act ("FERPA"), 20 U.S.C. § 1232g, and its implementing regulations at 34 C.F.R. Part 99, as such records may be incidentally contained within employee personnel files, grievance records, disciplinary files, and related documentation;

WHEREAS, WET operates a network of twelve (12) public charter schools across the States of Delaware, Pennsylvania, and New Jersey, serving approximately 8,400 students in kindergarten through twelfth grade, and maintains student education records governed by FERPA in connection with the administration and operation of those schools;

WHEREAS, WET OGG v.4.2 requires all outside counsel retained by WET to comply with FERPA data handling standards and to execute a Data Protection Addendum prior to receiving any Protected Data, as a condition of engagement;

WHEREAS, C&H's Chief Information Security Officer, Patricia Hwang, has reviewed the data protection and information security requirements set forth in WET OGG v.4.2 and has confirmed that C&H's information security protocols, infrastructure, and policies meet or exceed the requirements set forth herein; and

WHEREAS, the Parties desire to set forth their respective obligations regarding the handling, storage, transmission, and destruction of Protected Data received by C&H in connection with the engagement, and to ensure that all such data is treated in accordance with applicable law and the standards established by this Addendum.

NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

ARTICLE 1: DEFINITIONS

For purposes of this Addendum, the following terms shall have the meanings set forth below. Capitalized terms used but not otherwise defined in this Addendum shall have the meanings ascribed to them in the Engagement Letter or the WET OGG, as applicable.

1.1 "Authorized Personnel" means those C&H attorneys, paralegals, and professional staff who have been assigned to Matter No. 1040-00001 and who have been granted access to Protected Data in accordance with Article 4 of this Addendum. As of the Effective Date, Authorized Personnel specifically includes the following engagement team members: Miriam Calloway (Responsible Partner), Joel Strauss (Billing Partner), Nadia Petrov (Lead Associate), and James Underwood (Working Associate). Any additional timekeepers, paralegals, or support staff may be added to the Authorized Personnel list only with the prior written approval of WET's General Counsel, Priya Anand-Desai, consistent with the staffing approval provisions of Section 6.2 of WET OGG v.4.2. The term "Authorized Personnel" shall not include any individual who is excluded from access under Section 4.3 of this Addendum.

1.2 "Breach" or "Security Incident" means any unauthorized access to, acquisition of, use of, or disclosure of Protected Data, whether accidental or intentional, including any event that compromises the confidentiality, integrity, or availability of Protected Data in C&H's possession or control. The term includes, without limitation, the loss or theft of devices or media containing Protected Data, unauthorized system intrusions, inadvertent disclosure to unauthorized recipients, and any other event that constitutes a breach of security under applicable federal or state data breach notification laws.

1.3 "Education Records" means records directly related to a student that are maintained by WET or by a party acting for WET, as defined under FERPA, 20 U.S.C. § 1232g(a)(4), and as further interpreted by the implementing regulations at 34 C.F.R. Part 99. The term excludes records that are excluded from the definition of "education records" under FERPA, including sole-possession records, law enforcement unit records, employment records (except as otherwise provided by FERPA), medical and treatment records, and alumni records.

1.4 "FERPA" means the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, as amended from time to time, together with its implementing regulations at 34 C.F.R. Part 99, and any guidance issued by the U.S. Department of Education's Family Policy Compliance Office (or its successor) with respect thereto.

1.5 "Personally Identifiable Information" or "PII" means information that, alone or in combination with other information, can be used to distinguish or trace the identity of a student, as defined in 34 C.F.R. § 99.3. PII includes, but is not limited to: (a) a student's name; (b) the name of a student's parent, guardian, or other family member; (c) the address of a student or the student's family; (d) a personal identifier such as a Social Security number, student identification number, or biometric record; (e) other indirect identifiers such as a student's date of birth, place of birth, or mother's maiden name; (f) other information that, alone or in combination, is linked or linkable to a specific student and that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; and (g) information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates.

1.6 "Protected Data" means, collectively, Education Records, PII, and any other confidential information provided by WET to C&H in connection with the engagement that contains or is derived from student records, employee personnel records containing student information, or other sensitive data categories identified in Section 14.1 of WET OGG v.4.2, including faculty evaluation records containing student performance data, grievance records referencing specific students, and disciplinary records involving student interactions.

1.7 "Receiving System" means any electronic system, device, application, platform, or medium used by C&H to receive, process, store, or transmit Protected Data, including C&H's document management system, email systems, litigation support databases, file servers, cloud storage platforms, portable computing devices, and removable media.

1.8 "WET OGG" means the Wyndmere Education Trust — Outside Counsel Guidelines & Billing Policies, v.4.2, effective July 1, 2025, as may be amended from time to time by WET with written notice to C&H.

1.9 "Engagement Letter" means the engagement letter between C&H and WET dated February 10, 2026, to which this Addendum is attached as Exhibit A, together with all schedules and exhibits thereto (other than this Addendum), as the same may be amended, supplemented, or modified from time to time in accordance with its terms.

1.10 "Matter" means C&H Matter No. 1040-00001 (Client No. C-88214), encompassing all legal services provided by C&H to WET under the Engagement Letter, including all sub-matters, related proceedings, and follow-on engagements opened in connection therewith.

ARTICLE 2: PURPOSE AND SCOPE

2.1 Purpose. This Addendum establishes the obligations, standards, and procedures governing C&H's handling of Protected Data received from or on behalf of WET during the course of the engagement under the Engagement Letter. The purpose of this Addendum is to ensure that all Protected Data is handled, stored, transmitted, and ultimately returned or destroyed in compliance with FERPA, applicable state data privacy and student data protection laws, and the data security requirements set forth in Section 14 of WET OGG v.4.2. This Addendum is intended to supplement, and not to replace, the general confidentiality obligations set forth in the Engagement Letter and the Rules of Professional Conduct applicable to C&H's representation of WET.

2.2 Scope of Protected Data. The Parties acknowledge and agree that Protected Data may arise in connection with several aspects of C&H's representation of WET, including the following:

(a) The defense of the unfair labor practice charge filed by the Veltrano Federation of Educators, Local 1147, before the Delaware Public Employment Relations Board (Case No. PERB-2026-ULP-0041), in which employee grievance files and related documentation may contain references to specific students, student academic performance, or student disciplinary incidents;

(b) Multi-state employment law advisory work related to WET's planned elimination of forty-seven (47) full-time teaching positions across WET's charter school network in Delaware, Pennsylvania, and New Jersey, in which faculty evaluation records, student assessment data, classroom observations, and other personnel records may contain or reference student Education Records or PII;

(c) Anticipated individual wrongful-termination claims that may be asserted by terminated faculty members, in which discovery and litigation materials may include student records, parent correspondence, and other documents containing PII; and

(d) Any related proceedings, investigations, administrative actions, or regulatory inquiries arising from or connected to the matters described in subsections (a) through (c) above.

Without limiting the generality of the foregoing, Protected Data may include student records incidentally contained in employee personnel files, grievance records referencing students by name or identifiable characteristics, student disciplinary records, academic performance data and assessment results, Individualized Education Programs (IEPs) or Section 504 plans referenced in faculty evaluation materials, and parent or guardian correspondence that forms part of an employee's personnel or grievance file.

2.3 Applicability of FERPA. C&H acknowledges that, to the extent it receives Education Records from WET in connection with the engagement, it does so as an authorized representative of WET under 34 C.F.R. § 99.31(a)(1)(i)(B) for the purpose of performing an institutional service or function for which WET would otherwise use its own employees. C&H agrees to be bound by the conditions governing the use and re-disclosure of Education Records as set forth in FERPA, 34 C.F.R. Part 99, and this Addendum. C&H further acknowledges that its receipt of Education Records under the school-official or authorized-representative exception does not require the consent of parents or eligible students, provided that C&H complies with the conditions and limitations set forth herein.

2.4 Relationship to Engagement Letter. This Addendum supplements and forms part of the Engagement Letter. In the event of any conflict or inconsistency between the terms of this Addendum and the terms of the Engagement Letter with respect to data protection, information security, or the handling of Protected Data, the provisions of this Addendum shall control and govern. All other terms and conditions of the Engagement Letter, including without limitation the fee arrangements, billing procedures, and scope of engagement, shall remain in full force and effect and are unaffected by this Addendum.

ARTICLE 3: FERPA COMPLIANCE OBLIGATIONS

3.1 Designated Representative Status. For purposes of FERPA compliance in connection with the legal services described in the Engagement Letter, C&H shall be deemed a "school official" with a "legitimate educational interest" in the Education Records disclosed to it by WET, or, in the alternative, an authorized representative of WET designated to receive Education Records under 34 C.F.R. § 99.31(a)(1)(i)(B) and 34 C.F.R. § 99.35. C&H's status as a school official or authorized representative is limited to the scope of the engagement described in the Engagement Letter and does not extend to any other purpose or any other matter. C&H's designation under this Section shall terminate upon the conclusion or termination of the engagement and the completion of all data return or destruction obligations under Article 9.

3.2 Use Limitation. C&H shall use Protected Data solely for the purpose of providing legal services to WET under the Engagement Letter, including legal analysis, preparation of pleadings and filings, discovery preparation and review, legal advice, and related professional services, and for no other purpose whatsoever. Without limiting the foregoing, C&H shall not use Protected Data for commercial advantage, marketing, business development, statistical analysis unrelated to the engagement, data mining, or any purpose unrelated to the legal representation of WET in the Matter. C&H shall not aggregate or combine Protected Data with data from other clients or matters, except to the extent necessary for conflict-checking purposes conducted in accordance with applicable Rules of Professional Conduct.

3.3 Re-Disclosure Prohibition. C&H shall not disclose or re-disclose any Education Records or PII received from WET to any third party, except in the following limited circumstances:

(a) As required by a court order, subpoena, or other legal process, in which case C&H shall provide WET's General Counsel, Priya Anand-Desai, with prompt written notice prior to such disclosure, to the maximum extent permitted by applicable law, in order to afford WET a reasonable opportunity to seek a protective order, quash the subpoena, or otherwise contest the disclosure. In the event that a court order or legal process prohibits prior notification to WET, C&H shall provide notice to WET at the earliest date permitted by law following such disclosure;

(b) To WET's authorized agents, officers, board members, or other counsel, with the prior written authorization of Priya Anand-Desai, WET's General Counsel, specifying the identity of the recipient, the scope of the Protected Data to be disclosed, and the purpose for which the disclosure is authorized; and

(c) As necessary for the defense of the PERB matter, individual wrongful-termination claims, or related proceedings, subject to the use of redaction and de-identification protocols described in Section 3.4 below, and provided that any such disclosure in the context of litigation is made under applicable protective orders or confidentiality agreements to the extent obtainable.

In no event shall C&H disclose Education Records to any party in a manner that would violate the re-disclosure limitations of 34 C.F.R. § 99.33.

3.4 De-Identification and Redaction. Where Protected Data must be referenced in filings, correspondence, memoranda, or other documents prepared in connection with the engagement, C&H shall redact or de-identify student PII to the maximum extent practicable consistent with applicable legal obligations and the requirements of the forum in which the documents are to be filed or submitted. De-identification shall be performed in accordance with the standards set forth in 34 C.F.R. § 99.31(b), such that the records do not contain PII and there is no reasonable basis to believe that the information can be used to identify a particular student. Prior to filing any document with a court, administrative tribunal, or regulatory body that contains unredacted student PII, C&H shall consult with WET's General Counsel to determine whether redaction is feasible and, if not, whether a motion for a protective order or request for in camera review is appropriate.

3.5 Compliance with State Privacy Laws. In addition to FERPA, C&H shall comply with all applicable state data privacy and student data protection laws of the States of Delaware, Pennsylvania, and New Jersey to the extent they impose requirements on the handling of student records or personally identifiable information, including without limitation the Delaware Student Data Privacy Protection Act (14 Del. C. § 8101 et seq.), the Pennsylvania Breach of Personal Information Notification Act (73 P.S. § 2303), and the New Jersey Identity Theft Prevention Act (N.J.S.A. 56:11-44 et seq.). To the extent any state law imposes obligations that are more protective of student data than those required by FERPA, C&H shall comply with the more protective standard.

ARTICLE 4: ACCESS CONTROLS

4.1 Principle of Least Privilege. Access to Protected Data shall be limited to Authorized Personnel on a strict need-to-know basis. C&H shall grant access to Protected Data only to those individuals who require such access in order to perform their assigned responsibilities in connection with the Matter, and only to the extent necessary for the performance of such responsibilities. C&H shall maintain a current and accurate list of all Authorized Personnel who have been granted access to WET Protected Data, and shall make such list available to WET upon written request within five (5) business days. The list shall include each individual's name, title, role on the engagement, and the date on which access was granted.

4.2 Initial Authorized Personnel. As of the Effective Date, the following C&H personnel are designated as Authorized Personnel for purposes of this Addendum and are authorized to access Protected Data in connection with the Matter:

(a) Miriam Calloway — Responsible Partner;

(b) Joel Strauss — Billing Partner;

(d) James Underwood — Working Associate.

Any additions to, or removals from, the Authorized Personnel list shall require the prior written approval of Priya Anand-Desai, General Counsel of WET, in accordance with the staffing approval requirements of Section 6.2 of WET OGG v.4.2. Requests for additions shall include the proposed individual's name, title, role, and the specific justification for access. C&H shall promptly notify WET's General Counsel in writing of the departure from the engagement or from C&H of any Authorized Personnel member, and shall confirm that such individual's access to Protected Data has been revoked.

4.3 Ethical Screen Compliance. The Parties acknowledge that, consistent with the ethical screen implemented by C&H as of February 14, 2026 in connection with C&H's prior representation of Thornfield Academy of Sciences, Inc. (Delaware Court of Chancery, Case No. 2023-0847-SG), Conrad Ashworth (Partner, Corporate & Governance Practice Group, Wilmington office) shall be permanently excluded from the Authorized Personnel list established under this Addendum. Mr. Ashworth shall have no access, whether direct or indirect, to any Protected Data, work product, correspondence, or other files associated with the WET engagement or the Matter. The document management system access restrictions implemented under the ethical screen memorandum dated February 14, 2026 shall apply equally to all Protected Data received by C&H under this Addendum. Any other C&H personnel who were members of the Thornfield Academy of Sciences engagement team are likewise excluded from access to WET Protected Data and the Matter. C&H shall ensure that all technological and administrative barriers necessary to enforce this ethical screen with respect to Protected Data remain in place throughout the duration of the engagement.

4.4 Multi-Factor Authentication. All Authorized Personnel must authenticate through multi-factor authentication ("MFA") before accessing any Receiving System containing Protected Data. MFA shall require at least two independent authentication factors, consisting of (a) something the user knows (e.g., a password or PIN), and (b) something the user has (e.g., a hardware token, software token, or push notification to a registered mobile device) or something the user is (e.g., a biometric identifier). C&H shall not permit access to Receiving Systems containing Protected Data through single-factor authentication under any circumstances.

4.5 Role-Based Access Controls. C&H shall implement role-based access controls ("RBAC") within its document management system (currently Stonefield Systems) and any case-management platforms, litigation support databases, or collaboration tools used in connection with the Matter, restricting access to Protected Data repositories to Authorized Personnel only. Access permissions shall be configured to reflect each individual's role on the engagement team and shall be reviewed and updated no less frequently than quarterly, or upon any change to the Authorized Personnel list.

4.6 Physical Access. Hard-copy materials containing Protected Data shall be stored in locked cabinets or secure rooms accessible only to Authorized Personnel at C&H's Philadelphia office (600 Market Street, Suite 4200) and, to the extent applicable, C&H's Wilmington office. Hard-copy materials containing Protected Data shall be marked "CONFIDENTIAL — WET PROTECTED DATA" or with a substantially equivalent designation. Hard copies of Protected Data shall not be removed from C&H's offices without the prior written approval of the Responsible Partner, Miriam Calloway, and any such removal shall be logged and tracked. When not in active use, hard-copy Protected Data shall be secured in accordance with C&H's clean-desk policy, and shall not be left unattended in common areas, conference rooms, or other unsecured locations.

ARTICLE 5: ENCRYPTION AND TECHNICAL SECURITY REQUIREMENTS

5.1 Encryption at Rest. All Protected Data stored electronically on C&H systems, including on file servers, databases, document management systems, backup media, and portable storage devices, shall be encrypted using the Advanced Encryption Standard with a key length of 256 bits (AES-256), or an equivalent or stronger encryption standard as may be approved by C&H's CISO, Patricia Hwang. Encryption keys shall be managed in accordance with industry best practices, including secure key generation, storage, rotation, and retirement procedures.

5.2 Encryption in Transit. All electronic transmissions of Protected Data between C&H and WET, between C&H offices, or between C&H and any authorized subcontractor or third-party service provider, shall utilize Transport Layer Security (TLS) version 1.2 or higher encryption. Email transmissions containing Protected Data shall be sent using C&H's encrypted email platform (currently Ashford Health IT) or an equivalent secure file transfer mechanism that provides end-to-end encryption. Unencrypted email transmission of Protected Data is strictly prohibited. C&H shall ensure that its email gateway is configured to enforce TLS encryption for all communications with WET's email domain (@wyndmeretrust.org).

5.3 Endpoint Security. All devices used by Authorized Personnel to access Protected Data, including laptops, desktop workstations, tablets, and mobile devices, shall be equipped with: (a) full-disk encryption compliant with FIPS 140-2 standards; (b) endpoint detection and response ("EDR") software capable of detecting, investigating, and responding to advanced threats in real time; (c) current anti-malware and antivirus protections with signature updates applied no less frequently than daily; and (d) host-based firewall protections. C&H shall maintain a mobile device management ("MDM") solution to enforce security policies on any mobile devices used to access Protected Data, including the ability to remotely wipe a device in the event of loss or theft.

5.4 Network Security. C&H shall maintain enterprise-grade firewall protections, intrusion detection and prevention systems ("IDS/IPS"), and network segmentation appropriate to protect Protected Data from unauthorized access, both from external threats and from internal users who are not Authorized Personnel. Network traffic to and from systems containing Protected Data shall be monitored and logged. C&H shall maintain secure configurations for all network infrastructure components in accordance with Center for Internet Security (CIS) benchmarks or equivalent standards.

5.5 Cloud and SaaS Platforms. Any cloud-based or Software-as-a-Service (SaaS) platforms used by C&H to store, process, or transmit Protected Data in connection with the Matter must satisfy each of the following requirements:

(a) The platform and all data at rest must be hosted within the United States, with no data replication, processing, or storage occurring outside the territorial boundaries of the United States;

(b) The platform provider must maintain a current SOC 2 Type II certification (or equivalent independent third-party assessment, such as ISO 27001 certification) covering the security, availability, and confidentiality trust service criteria; and

(c) The platform must be reviewed and approved by C&H's CISO, Patricia Hwang, as compliant with the technical standards set forth in this Addendum, prior to the storage or processing of any Protected Data on such platform.

C&H shall maintain a current inventory of all cloud and SaaS platforms used to store or process WET Protected Data and shall make such inventory available to WET upon request.

5.6 Vulnerability Management. C&H shall conduct regular vulnerability assessments and penetration testing of all Receiving Systems that store or process Protected Data, no less frequently than annually, using qualified internal or external security professionals. Critical vulnerabilities (defined as vulnerabilities with a CVSS score of 9.0 or higher) shall be remediated within thirty (30) days of identification. High-severity vulnerabilities (CVSS score of 7.0 to 8.9) shall be remediated within sixty (60) days. C&H shall maintain records of vulnerability assessments, penetration testing results, and remediation actions, and shall make summary reports available to WET upon request in connection with any audit conducted under Article 10.

ARTICLE 6: PERSONNEL TRAINING AND AWARENESS

6.1 Data Protection Training. All Authorized Personnel shall complete C&H's data protection and FERPA awareness training program prior to accessing any Protected Data in connection with the Matter, and shall complete refresher training on an annual basis thereafter for the duration of the engagement. The training program shall address, at a minimum: (a) the obligations of C&H under FERPA, including use limitations and re-disclosure restrictions; (b) the classification, handling, and storage of Protected Data; (c) the identification and reporting of Security Incidents; (d) the access control and encryption requirements set forth in this Addendum; and (e) the specific sensitivity of student Education Records and the potential consequences of unauthorized disclosure. C&H shall maintain records of training completion for all Authorized Personnel and shall make such records available to WET upon request.

6.2 Confidentiality Acknowledgment. Each member of the Authorized Personnel list shall execute an internal confidentiality acknowledgment specific to the WET engagement prior to receiving access to Protected Data. The acknowledgment shall confirm the individual's understanding of the obligations set forth in this Addendum, the sensitivity of student Education Records, the prohibition on re-disclosure, and the consequences of non-compliance, including potential disciplinary action. C&H shall retain executed copies of all such acknowledgments for the duration of the engagement and for a period of three (3) years thereafter, and shall provide copies to WET upon request.

6.3 Supervision. Miriam Calloway, as Responsible Partner for the Matter, and Patricia Hwang, as C&H's Chief Information Security Officer, shall jointly oversee compliance with the data protection obligations set forth in this Addendum. Ms. Calloway shall be responsible for ensuring that all members of the engagement team understand and comply with the substantive data handling requirements herein, and Ms. Hwang shall be responsible for ensuring that C&H's technical infrastructure and security controls continue to meet the standards required by this Addendum throughout the duration of the engagement. Any questions or concerns regarding the handling of Protected Data shall be directed to Ms. Calloway or Ms. Hwang, as appropriate.

ARTICLE 7: SUBCONTRACTORS AND THIRD-PARTY SERVICE PROVIDERS

7.1 Prior Approval. C&H shall not engage, retain, or permit any subcontractor or third-party service provider to access, receive, process, store, or transmit Protected Data without the prior written consent of WET's General Counsel, Priya Anand-Desai. The foregoing requirement applies to all categories of third-party service providers, including without limitation e-discovery vendors, litigation support providers, document review contractors, court reporters, expert consultants, forensic accountants, translators, and any other individuals or entities that are not C&H employees or partners. C&H's request for approval shall include the identity of the proposed subcontractor, a description of the services to be performed, the categories of Protected Data to which the subcontractor will have access, and a summary of the subcontractor's data security capabilities.

7.2 Flow-Down Obligations. Any subcontractor or third-party service provider approved by WET under Section 7.1 shall be bound by data protection obligations that are no less protective than those set forth in this Addendum, through a written agreement executed by the subcontractor prior to the subcontractor's receipt of any Protected Data. Such agreement shall include, at a minimum, obligations relating to use limitation, re-disclosure prohibition, encryption, access controls, Security Incident notification, and data return or destruction. C&H shall provide WET with a copy of the data protection provisions of any such subcontractor agreement upon request.

7.3 Liability. C&H shall remain fully responsible and liable for any acts, omissions, or failures of its subcontractors or third-party service providers with respect to Protected Data, to the same extent as if such acts, omissions, or failures were those of C&H itself. The engagement of a subcontractor or third-party service provider shall not relieve C&H of any obligation under this Addendum or limit C&H's liability hereunder.

ARTICLE 8: SECURITY INCIDENT AND BREACH NOTIFICATION

8.1 Detection and Investigation. C&H shall implement and maintain processes, technologies, and personnel resources sufficient to detect, investigate, and respond to Security Incidents involving Protected Data in a timely and effective manner. C&H's incident response capabilities shall include, at a minimum, continuous monitoring of Receiving Systems for indicators of compromise, established escalation procedures for suspected Security Incidents, and a documented incident response plan that addresses containment, eradication, recovery, and post-incident review.

8.2 Notification Timeline. In the event of a confirmed or reasonably suspected Breach involving Protected Data, C&H shall notify WET's General Counsel, Priya Anand-Desai, and WET's Chief Information Security Officer or designee, in writing within forty-eight (48) hours of C&H's discovery of the Breach. For purposes of this Section, "Discovery" means the point at which C&H has a reasonable basis to believe that a Security Incident has resulted in the unauthorized access to, acquisition of, use of, or disclosure of Protected Data. Notification shall be made by email to the addresses designated in Section 16.5 of this Addendum, with telephone confirmation to WET's General Counsel at the contact number provided separately.

8.3 Content of Notification. The Breach notification provided under Section 8.2 shall include, to the extent known at the time of notification, the following information:

(a) The date and time of the Breach, or the estimated date and time if the exact timing is unknown;

(b) The nature and scope of the Protected Data affected, including the categories of data involved and the approximate number of records or individuals potentially impacted;

(c) The circumstances and cause of the Breach, including a description of the vulnerability or failure that led to the incident;

(d) The steps taken or planned by C&H to contain the Breach and to remediate the underlying cause, including any immediate corrective actions implemented; and

(e) The identity of any individuals (including students, parents, and WET employees) whose PII may have been compromised as a result of the Breach, to the extent such information is known or reasonably determinable.

If C&H is unable to provide all of the foregoing information within the forty-eight (48) hour notification window, C&H shall provide the information then available and shall supplement the notification with additional details as they become known, on a continuing basis until the investigation is complete.

8.4 Cooperation and Remediation. C&H shall cooperate fully and in good faith with WET in investigating and remediating any Breach, including providing WET and its designated forensic investigators with timely access to relevant forensic reports, system logs, access records, and other information necessary to assess the scope and impact of the Breach. C&H shall bear all costs and expenses associated with forensic investigation, remediation, and any notifications to affected individuals or regulatory authorities that are required as a result of a Breach caused by C&H's acts, omissions, negligence, or failure to comply with the requirements of this Addendum.

8.5 Regulatory Notifications. WET shall retain sole authority and discretion to determine whether and when notifications must be made to affected individuals, parents or guardians, regulatory authorities (including the U.S. Department of Education's Family Policy Compliance Office), state attorneys general, or any other persons or entities in connection with any Breach involving Protected Data. C&H shall not make any such notifications, public statements, or disclosures regarding a Breach without the prior written authorization of WET's General Counsel, except to the extent that C&H is independently required by applicable law to make such notifications with respect to its own data security obligations.

8.6 Preservation of Evidence. In the event of a Breach or suspected Breach involving Protected Data, C&H shall immediately take all reasonable steps to preserve all relevant evidence, including system logs, access records, audit trails, forensic images of affected systems, and any other documentation that may be relevant to the investigation, remediation, or legal analysis of the Breach. Such evidence shall be preserved for a minimum period of three (3) years following the date of the Breach, or such longer period as may be required by applicable law, regulation, or written instruction from WET.

ARTICLE 9: DATA RETURN AND DESTRUCTION

9.1 Upon Conclusion of Matter. Within sixty (60) days of the conclusion or termination of the engagement under the Engagement Letter (including any post-engagement wind-down period agreed upon by the Parties), C&H shall, at WET's sole election as communicated in writing by WET's General Counsel:

(a) Return all Protected Data to WET in a format and on a medium designated by WET, including all originals, copies, extracts, summaries, and derivative works containing Protected Data, whether in electronic or hard-copy form; or

(b) Securely destroy all Protected Data in C&H's possession or control in accordance with the destruction standards set forth in Section 9.2, and certify such destruction in writing in accordance with Section 9.3.

WET shall communicate its election to C&H within thirty (30) days of the conclusion or termination of the engagement. If WET fails to make an election within such period, C&H shall proceed with secure destruction in accordance with Section 9.2.

9.2 Destruction Standards. Destruction of Protected Data shall be performed in a manner that renders the data permanently unreadable, unrecoverable, and incapable of reconstruction, in accordance with the following standards:

(a) Electronic data, including data stored on hard drives, solid-state drives, servers, backup tapes, removable media, and cloud-based storage platforms, shall be destroyed using methods compliant with the National Institute of Standards and Technology Special Publication 800-88, Revision 1 ("NIST SP 800-88"), including the clear, purge, or destroy methods as appropriate to the media type and classification of the data; and

(b) Hard-copy documents containing Protected Data shall be destroyed by cross-cut shredding (with a maximum particle size of 15mm x 25mm) or by incineration, using a service provider that provides a certificate of destruction.

9.3 Certification of Destruction. C&H shall provide WET with a written certificate of destruction, signed by Patricia Hwang, C&H's Chief Information Security Officer, or her authorized designee, within ten (10) business days of completing the destruction of Protected Data. The certificate shall specify: (a) the categories and general description of the Protected Data destroyed; (b) the method of destruction employed for each category of data; (c) the date or dates on which destruction was completed; and (d) a statement that the destruction was performed in accordance with the standards set forth in Section 9.2 and NIST SP 800-88.

9.4 Retained Copies. Notwithstanding Section 9.1, C&H may retain copies of Protected Data to the limited extent that:

(a) Retention is required by applicable law, regulation, or professional responsibility rules, including rules governing the retention of client files and work product; or

(b) Protected Data is contained within C&H's standard automated system backups, provided that: (i) such backups are maintained in encrypted form in accordance with Article 5; (ii) C&H shall not actively access, use, or process Protected Data contained in such backups except as necessary for disaster recovery purposes; and (iii) such backups shall be overwritten or destroyed in the ordinary course of C&H's backup rotation schedule.

Any Protected Data retained by C&H under this Section 9.4 shall continue to be subject to the confidentiality, use-limitation, and security protections set forth in this Addendum for the duration of such retention. C&H's document retention policy provides for the retention of closed matter files for a period of ten (10) years following the closure of the matter, which exceeds the seven (7) year post-matter retention requirement set forth in WET OGG v.4.2. C&H shall notify WET in writing of any Protected Data retained under this Section 9.4, specifying the categories of data retained and the legal or regulatory basis for such retention, at the time the certificate of destruction is provided under Section 9.3.

9.5 Survival. The obligations set forth in this Article 9, together with the confidentiality and use-limitation obligations in Articles 3 and 4, the Breach notification obligations in Article 8, the indemnification obligations in Article 13, and the limitation of liability provisions in Article 12, shall survive the expiration or termination of the Engagement Letter and this Addendum.

ARTICLE 10: AUDIT AND INSPECTION RIGHTS

10.1 WET Audit Right. WET, or its designated third-party auditor (currently Hargrove & Linden CPAs LLP), shall have the right, upon not less than fifteen (15) business days' prior written notice to C&H, to conduct an audit of C&H's compliance with the terms and conditions of this Addendum. Such audit may include the inspection and review of relevant policies, procedures, system configurations, access logs, training completion records, incident response records, and other documentation reasonably related to C&H's handling of Protected Data. WET's audit right under this Section may be exercised no more than once per calendar year during the term of the engagement under the Engagement Letter, and one (1) additional time during the one (1) year period following the termination or expiration of the engagement.

10.2 Scope of Audit. Audits conducted under Section 10.1 shall be limited in scope to C&H's handling of WET Protected Data and C&H's compliance with the specific obligations set forth in this Addendum. Audits shall be conducted during normal business hours and in a manner that does not unreasonably interfere with C&H's business operations, client service obligations, or the confidentiality of other clients' matters. The Parties acknowledge that certain information reviewed during an audit may be subject to attorney-client privilege or attorney work product protection, and nothing in this Addendum shall be construed to require C&H to disclose privileged or work-product-protected information to WET's auditors, except to the extent that such disclosure is necessary to verify compliance with the technical and procedural requirements of this Addendum and does not compromise privilege protections.

10.3 Third-Party Assessments. In lieu of a direct audit under Section 10.1, WET may, at WET's election, accept a current SOC 2 Type II report or equivalent independent third-party assessment of C&H's information security controls, if such a report is available and covers the security, availability, and confidentiality trust service criteria relevant to C&H's handling of Protected Data. C&H shall provide a copy of any such report to WET upon request, subject to any confidentiality restrictions imposed by the assessor.

10.4 Remediation of Findings. In the event that an audit conducted under Section 10.1 or a third-party assessment reviewed under Section 10.3 identifies any material deficiencies in C&H's compliance with this Addendum, C&H shall remediate such deficiencies within thirty (30) days of receipt of written notification from WET identifying the deficiencies, or within such longer period as may be mutually agreed upon by the Parties in writing. C&H shall provide WET with written confirmation of remediation upon completion, including a description of the corrective actions taken. If any material deficiency is not remediated within the agreed-upon timeframe, WET may, in addition to any other remedies available under this Addendum or at law, suspend the transmission of Protected Data to C&H until the deficiency is resolved.

ARTICLE 11: REPRESENTATIONS AND WARRANTIES

11.1 C&H Representations and Warranties. C&H represents and warrants to WET as follows:

(a) C&H has implemented and maintains a comprehensive information security program that is consistent with industry best practices for law firms of similar size and scope, and that complies with all applicable legal and regulatory requirements for the protection of sensitive data, as confirmed by C&H's Chief Information Security Officer, Patricia Hwang;

(b) C&H's Receiving Systems meet or exceed the technical security standards set forth in Article 5 of this Addendum, including the encryption, access control, endpoint security, network security, and vulnerability management requirements specified therein;

(c) As of the Effective Date, C&H has no knowledge of any existing, unresolved security vulnerabilities in its systems or infrastructure that would reasonably be expected to compromise the security, confidentiality, or integrity of Protected Data stored, processed, or transmitted by C&H;

(d) C&H will comply with all applicable federal, state, and local laws, rules, and regulations governing the handling, storage, transmission, and protection of Education Records and PII, including FERPA (20 U.S.C. § 1232g and 34 C.F.R. Part 99), the data privacy and breach notification laws of the States of Delaware, Pennsylvania, and New Jersey, and any other applicable privacy or data security laws; and

(e) C&H has the organizational capacity, technical infrastructure, and trained personnel necessary to fulfill its obligations under this Addendum throughout the duration of the engagement.

11.2 WET Representations and Warranties. WET represents and warrants to C&H as follows:

(a) WET has the legal authority to disclose Protected Data to C&H for the purposes described in the Engagement Letter, including under the FERPA school-official exception (34 C.F.R. § 99.31(a)(1)) and the authorized-representative exception (34 C.F.R. § 99.31(a)(3) and § 99.35), and such disclosure does not violate any obligation WET owes to any third party; and

(b) WET will clearly identify and label materials containing Protected Data when transmitting them to C&H, to the extent practicable, using the designation "CONTAINS PROTECTED DATA — WET" or a substantially equivalent marking, so as to enable C&H to apply the protections required by this Addendum.

ARTICLE 12: LIMITATION OF LIABILITY

12.1 Liability Cap. Except in cases of gross negligence or willful misconduct by C&H, C&H's aggregate liability under this Addendum for any and all claims arising from data protection failures, Security Incidents, or Breaches shall not exceed the lesser of:

(a) Two Million Dollars ($2,000,000); or

(b) The total fees actually paid by WET to C&H under the Engagement Letter during the twelve (12) month period immediately preceding the event or occurrence giving rise to the claim.

12.2 Exclusions. The limitation of liability set forth in Section 12.1 shall not apply to, and shall not limit or restrict:

(a) C&H's indemnification obligations under Article 13 with respect to third-party claims arising from a Breach caused by C&H's acts or omissions; or

(b) Regulatory fines, penalties, or sanctions imposed on WET by any governmental authority, including the U.S. Department of Education, as a direct result of C&H's breach of this Addendum or C&H's failure to comply with FERPA or applicable state data protection laws.

Nothing in this Article 12 shall be construed to limit or modify WET's rights or remedies under the Engagement Letter, applicable Rules of Professional Conduct, or applicable law, except as expressly set forth herein.

ARTICLE 13: INDEMNIFICATION

13.1 C&H Indemnification. C&H shall indemnify, defend, and hold harmless WET, its officers, directors, trustees, employees, agents, and representatives from and against any and all third-party claims, demands, actions, suits, losses, liabilities, damages, costs, and expenses (including reasonable attorneys' fees and costs of litigation) arising from or related to: (a) C&H's breach of any provision of this Addendum; (b) any unauthorized access to, acquisition of, use of, or disclosure of Protected Data caused by C&H's acts, omissions, negligence, or failure to comply with the requirements of this Addendum; or (c) any acts or omissions of C&H's subcontractors or third-party service providers with respect to Protected Data. C&H's indemnification obligations under this Section shall survive the termination or expiration of this Addendum and the Engagement Letter.

13.2 WET Indemnification. WET shall indemnify, defend, and hold harmless C&H, its partners, associates, employees, agents, and representatives from and against any and all third-party claims, demands, actions, suits, losses, liabilities, damages, costs, and expenses (including reasonable attorneys' fees and costs of litigation) arising from or related to: (a) WET's failure to properly identify or label Protected Data in accordance with Section 11.2(b), to the extent that such failure is the proximate cause of C&H's failure to apply the protections required by this Addendum; or (b) WET's own unauthorized disclosure of Protected Data that is not attributable to C&H's acts or omissions.

ARTICLE 14: INSURANCE

14.1 Cyber Liability Insurance. C&H shall maintain, at its own cost and expense, cyber liability insurance (including network security and privacy liability coverage) and professional liability (errors and omissions) insurance in amounts reasonably sufficient to cover C&H's obligations under this Addendum and the Engagement Letter, throughout the term of the engagement and for a period of two (2) years following the termination or expiration of the engagement. Such insurance shall provide coverage for, at a minimum, data breach response costs, notification costs, forensic investigation expenses, regulatory defense and penalty coverage, and third-party liability arising from unauthorized disclosure of personally identifiable information.

14.2 Evidence of Coverage. Upon written request from WET, C&H shall provide WET with certificates of insurance evidencing the coverage required by Section 14.1, including the identity of the insurer, the policy number, the coverage limits, and the policy period. C&H shall provide WET with no less than thirty (30) days' prior written notice of any material change, cancellation, or non-renewal of such insurance coverage.

ARTICLE 15: TERM AND TERMINATION

15.1 Term. This Addendum shall be effective as of February 10, 2026 (the Effective Date) and shall remain in effect for the duration of the engagement under the Engagement Letter, including any extensions or renewals thereof, and thereafter as to any surviving obligations specified herein.

15.2 Termination. This Addendum shall terminate upon the later of: (a) the termination, expiration, or conclusion of the Engagement Letter (including any post-engagement wind-down period); or (b) the completion of all data return or destruction obligations under Article 9, as evidenced by the delivery of a certificate of destruction under Section 9.3 or the confirmed receipt by WET of all returned Protected Data.

15.3 Effect of Termination. Termination of this Addendum shall not relieve either Party of any obligations accrued prior to the effective date of termination, or of any obligations that by their nature or express terms are intended to survive termination, including without limitation the obligations set forth in Articles 3 (FERPA Compliance Obligations), 4 (Access Controls), 8 (Security Incident and Breach Notification), 9 (Data Return and Destruction), 12 (Limitation of Liability), and 13 (Indemnification).

ARTICLE 16: GENERAL PROVISIONS

16.1 Governing Law. This Addendum shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict-of-laws principles, consistent with the governing law provision of the Engagement Letter. Any dispute arising under or in connection with this Addendum that is not resolved by mutual agreement of the Parties shall be submitted to the exclusive jurisdiction of the state and federal courts located in New Castle County, Delaware.

16.2 Entire Agreement. This Addendum, together with the Engagement Letter (including all schedules and exhibits thereto), constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior or contemporaneous agreements, understandings, representations, warranties, and communications, whether written or oral, relating to data protection, data security, or the handling of Protected Data in connection with the engagement. The WET OGG is incorporated by reference to the extent expressly referenced herein but does not independently create binding contractual obligations except as incorporated into this Addendum and the Engagement Letter.

16.3 Amendments. This Addendum may be amended, modified, or supplemented only by a written instrument signed by duly authorized representatives of both Parties. No oral agreement, course of dealing, or course of performance shall be deemed to amend or modify the terms of this Addendum.

16.4 Severability. If any provision of this Addendum, or the application thereof to any person or circumstance, is held invalid, illegal, or unenforceable by a court of competent jurisdiction, such invalidity, illegality, or unenforceability shall not affect any other provision of this Addendum, and the remaining provisions shall continue in full force and effect. The Parties shall negotiate in good faith to replace any invalid or unenforceable provision with a valid and enforceable provision that achieves, to the greatest extent possible, the original intent of the Parties.

16.5 Notices. All notices, requests, demands, consents, and other communications required or permitted under this Addendum shall be in writing and shall be deemed duly given when: (a) delivered in person; (b) sent by certified or registered mail, return receipt requested, postage prepaid; (c) sent by nationally recognized overnight courier service; or (d) sent by email with confirmation of receipt. Notices shall be addressed to the Parties at the following addresses, or at such other addresses as either Party may designate in writing from time to time:

If to C&H:

Miriam Calloway, Partner Calderwood & Harkness LLP 600 Market Street, Suite 4200 Philadelphia, PA 19106

Email: m.calloway@calderwoodharkness.com

With a copy to:

Patricia Hwang, Chief Information Security Officer Calderwood & Harkness LLP 600 Market Street, Suite 4200 Philadelphia, PA 19106

Email: p.hwang@calderwoodharkness.com

If to WET:

Priya Anand-Desai, General Counsel Wyndmere Education Trust 1400 Brandywine Boulevard, Suite 300 Wilmington, DE 19801

Email: panand-desai@wyndmeretrust.org

16.6 Counterparts. This Addendum may be executed in one or more counterparts, each of which shall be deemed an original and all of which, taken together, shall constitute one and the same instrument. Execution and delivery of this Addendum by electronic means, including by email transmission of a PDF copy of a signed signature page, shall be valid and binding to the same extent as execution and delivery of an original.

16.7 No Waiver. The failure of either Party to enforce any provision of this Addendum at any time shall not constitute a waiver of such provision or of any other provision hereof, nor shall it be construed as a waiver of any succeeding breach of the same or any other provision. No waiver of any provision of this Addendum shall be effective unless made in writing and signed by the waiving Party.

16.8 Assignment. Neither Party may assign, transfer, or delegate its rights or obligations under this Addendum, in whole or in part, without the prior written consent of the other Party, which consent shall not be unreasonably withheld. Any purported assignment in violation of this Section shall be void and of no force or effect. Notwithstanding the foregoing, either Party may assign this Addendum to a successor entity in connection with a merger, consolidation, or sale of all or substantially all of the assigning Party's assets, provided that the successor entity agrees in writing to be bound by the terms of this Addendum.

SIGNATURE PAGE

IN WITNESS WHEREOF, the Parties have caused this Data Protection Addendum to be executed by their duly authorized representatives as of the Effective Date.

CALDERWOOD & HARKNESS LLP

By: ________

Name: Miriam Calloway

Title: Partner, Healthcare & Life Sciences Practice Group

Date: ________

WYNDMERE EDUCATION TRUST

By: ________

Name: Priya Anand-Desai

Title: General Counsel

Date: ________

ACKNOWLEDGMENT — CHIEF INFORMATION SECURITY OFFICER

I, Patricia Hwang, Chief Information Security Officer of Calderwood & Harkness LLP, hereby certify that I have reviewed the data protection and information security requirements set forth in this Data Protection Addendum in their entirety. Based on my review of C&H's current information security infrastructure, policies, procedures, and technical controls, I confirm that C&H's information security program complies with the standards required by this Addendum, including the encryption, access control, endpoint security, network security, vulnerability management, and incident response requirements set forth in Articles 4 through 8. I further confirm that C&H's security controls are designed and maintained in a manner consistent with industry best practices for law firms handling sensitive educational and personally identifiable information, and that C&H is capable of fulfilling the data protection obligations set forth herein throughout the duration of the engagement.

This acknowledgment is provided in support of the representations set forth in Section 11.1 of this Addendum and does not create any independent obligations on my part separate from C&H's obligations under this Addendum.

ACKNOWLEDGED AND CONFIRMED:

By: ________

Name: Patricia Hwang

Title: Chief Information Security Officer, Calderwood & Harkness LLP

Date: ________

APPENDIX A

C&H INFORMATION SECURITY STANDARDS SUMMARY

The following is a summary of Calderwood & Harkness LLP's information security program, as confirmed by Patricia Hwang, Chief Information Security Officer, in connection with the execution of this Data Protection Addendum. This summary is provided for informational purposes to assist WET in evaluating C&H's compliance posture and does not limit, modify, or supersede C&H's obligations under the body of this Addendum. In the event of any inconsistency between this Appendix and the obligations set forth in the Addendum, the terms of the Addendum shall control.

1. Encryption Standards

• At Rest: All sensitive data, including Protected Data, stored on C&H systems is encrypted using AES-256 encryption. Full-disk encryption is deployed on all endpoints (laptops, workstations, and portable devices) using FIPS 140-2 validated encryption modules.

• In Transit: All data transmissions utilize TLS 1.2 or higher. C&H's encrypted email platform (Ashford Health IT) is used for the transmission of sensitive data via email. Secure file transfer is available via C&H's client portal (Ashford Software) with end-to-end encryption.

2. Multi-Factor Authentication

MFA is required for all C&H personnel accessing firm systems, including email, document management, VPN, and cloud applications. C&H utilizes hardware and software token-based authentication (currently Beaumont Software) for all remote access and

DATA PROTECTION ADDENDUM
Exhibit A to Engagement Letter dated February 10, 2026
PARTIES:
This Data Protection Addendum (this "Addendum") is entered into as of February 10, 2026 (the "Effective Date"), by and between:
Calderwood & Harkness LLP, a Delaware limited liability partnership ("Firm" or "C&H"), with its principal office at 600 Market Street, Suite 4200, Philadelphia, PA 19106;
and
Wyndmere Education Trust, a Delaware nonprofit corporation ("Client" or "WET"), with its principal office at 1400 Brandywine Boulevard, Suite 300, Wilmington, DE 19801.
C&H and WET are each referred to herein individually as a "Party" and collectively as the "Parties."
REFERENCE: This Addendum is attached as Exhibit A to, and incorporated into and forms part of, the Engagement Letter between C&H and WET of even date (Matter No. 1040-00001; Client No. C-88214) (the "Engagement Letter"), pursuant to which C&H has been engaged to represent WET in employment-law advisory and litigation matters arising from WET's faculty restructuring plan, including the defense of an unfair labor practice charge before the Delaware Public Employment Relations Board, multi-state employment law compliance advisory work, and anticipated individual wrongful-termination claims.
This Addendum is entered into to satisfy the requirements of Section 14.3 of the Wyndmere Education Trust — Outside Counsel Guidelines & Billing Policies, v.4.2, effective July 1, 2025 ("WET OGG"), which mandates the execution of a Data Protection Addendum by all outside counsel prior to the receipt of any Protected Data (as defined herein) from WET or its affiliates.
Right-click to update Table of Contents
RECITALS
WHEREAS, C&H has been engaged by WET to provide legal services in connection with employment-law matters, including the defense of an unfair labor practice charge filed by the Veltrano Federation of Educators, Local 1147, before the Delaware Public Employment Relations Board (Case No. PERB-2026-ULP-0041), multi-state employment law compliance advisory work relating to WET's planned elimination of forty-seven (47) full-time teaching positions across the States of Delaware, Pennsylvania, and New Jersey, and anticipated individual wrongful-termination claims that may be asserted by affected faculty members;
WHEREAS, in the course of such representation, C&H may receive, access, process, or store student education records and other personally identifiable information ("PII") that is subject to the Family Educational Rights and Privacy Act ("FERPA"), 20 U.S.C. § 1232g, and its implementing regulations at 34 C.F.R. Part 99, as such records may be incidentally contained within employee personnel files, grievance records, disciplinary files, and related documentation;
WHEREAS, WET operates a network of twelve (12) public charter schools across the States of Delaware, Pennsylvania, and New Jersey, serving approximately 8,400 students in kindergarten through twelfth grade, and maintains student education records governed by FERPA in connection with the administration and operation of those schools;
WHEREAS, WET OGG v.4.2 requires all outside counsel retained by WET to comply with FERPA data handling standards and to execute a Data Protection Addendum prior to receiving any Protected Data, as a condition of engagement;
WHEREAS, C&H's Chief Information Security Officer, Patricia Hwang, has reviewed the data protection and information security requirements set forth in WET OGG v.4.2 and has confirmed that C&H's information security protocols, infrastructure, and policies meet or exceed the requirements set forth herein; and
WHEREAS, the Parties desire to set forth their respective obligations regarding the handling, storage, transmission, and destruction of Protected Data received by C&H in connection with the engagement, and to ensure that all such data is treated in accordance with applicable law and the standards established by this Addendum.
NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
ARTICLE 1: DEFINITIONS
For purposes of this Addendum, the following terms shall have the meanings set forth below. Capitalized terms used but not otherwise defined in this Addendum shall have the meanings ascribed to them in the Engagement Letter or the WET OGG, as applicable.
1.1 "Authorized Personnel" means those C&H attorneys, paralegals, and professional staff who have been assigned to Matter No. 1040-00001 and who have been granted access to Protected Data in accordance with Article 4 of this Addendum. As of the Effective Date, Authorized Personnel specifically includes the following engagement team members: Miriam Calloway (Responsible Partner), Joel Strauss (Billing Partner), Nadia Petrov (Lead Associate), and James Underwood (Working Associate). Any additional timekeepers, paralegals, or support staff may be added to the Authorized Personnel list only with the prior written approval of WET's General Counsel, Priya Anand-Desai, consistent with the staffing approval provisions of Section 6.2 of WET OGG v.4.2. The term "Authorized Personnel" shall not include any individual who is excluded from access under Section 4.3 of this Addendum.
1.2 "Breach" or "Security Incident" means any unauthorized access to, acquisition of, use of, or disclosure of Protected Data, whether accidental or intentional, including any event that compromises the confidentiality, integrity, or availability of Protected Data in C&H's possession or control. The term includes, without limitation, the loss or theft of devices or media containing Protected Data, unauthorized system intrusions, inadvertent disclosure to unauthorized recipients, and any other event that constitutes a breach of security under applicable federal or state data breach notification laws.
1.3 "Education Records" means records directly related to a student that are maintained by WET or by a party acting for WET, as defined under FERPA, 20 U.S.C. § 1232g(a)(4), and as further interpreted by the implementing regulations at 34 C.F.R. Part 99. The term excludes records that are excluded from the definition of "education records" under FERPA, including sole-possession records, law enforcement unit records, employment records (except as otherwise provided by FERPA), medical and treatment records, and alumni records.
1.4 "FERPA" means the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, as amended from time to time, together with its implementing regulations at 34 C.F.R. Part 99, and any guidance issued by the U.S. Department of Education's Family Policy Compliance Office (or its successor) with respect thereto.
1.5 "Personally Identifiable Information" or "PII" means information that, alone or in combination with other information, can be used to distinguish or trace the identity of a student, as defined in 34 C.F.R. § 99.3. PII includes, but is not limited to: (a) a student's name; (b) the name of a student's parent, guardian, or other family member; (c) the address of a student or the student's family; (d) a personal identifier such as a Social Security number, student identification number, or biometric record; (e) other indirect identifiers such as a student's date of birth, place of birth, or mother's maiden name; (f) other information that, alone or in combination, is linked or linkable to a specific student and that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; and (g) information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates.
1.6 "Protected Data" means, collectively, Education Records, PII, and any other confidential information provided by WET to C&H in connection with the engagement that contains or is derived from student records, employee personnel records containing student information, or other sensitive data categories identified in Section 14.1 of WET OGG v.4.2, including faculty evaluation records containing student performance data, grievance records referencing specific students, and disciplinary records involving student interactions.
1.7 "Receiving System" means any electronic system, device, application, platform, or medium used by C&H to receive, process, store, or transmit Protected Data, including C&H's document management system, email systems, litigation support databases, file servers, cloud storage platforms, portable computing devices, and removable media.
1.8 "WET OGG" means the Wyndmere Education Trust — Outside Counsel Guidelines & Billing Policies, v.4.2, effective July 1, 2025, as may be amended from time to time by WET with written notice to C&H.
1.9 "Engagement Letter" means the engagement letter between C&H and WET dated February 10, 2026, to which this Addendum is attached as Exhibit A, together with all schedules and exhibits thereto (other than this Addendum), as the same may be amended, supplemented, or modified from time to time in accordance with its terms.
1.10 "Matter" means C&H Matter No. 1040-00001 (Client No. C-88214), encompassing all legal services provided by C&H to WET under the Engagement Letter, including all sub-matters, related proceedings, and follow-on engagements opened in connection therewith.
ARTICLE 2: PURPOSE AND SCOPE
2.1 Purpose. This Addendum establishes the obligations, standards, and procedures governing C&H's handling of Protected Data received from or on behalf of WET during the course of the engagement under the Engagement Letter. The purpose of this Addendum is to ensure that all Protected Data is handled, stored, transmitted, and ultimately returned or destroyed in compliance with FERPA, applicable state data privacy and student data protection laws, and the data security requirements set forth in Section 14 of WET OGG v.4.2. This Addendum is intended to supplement, and not to replace, the general confidentiality obligations set forth in the Engagement Letter and the Rules of Professional Conduct applicable to C&H's representation of WET.
2.2 Scope of Protected Data. The Parties acknowledge and agree that Protected Data may arise in connection with several aspects of C&H's representation of WET, including the following:
(a) The defense of the unfair labor practice charge filed by the Veltrano Federation of Educators, Local 1147, before the Delaware Public Employment Relations Board (Case No. PERB-2026-ULP-0041), in which employee grievance files and related documentation may contain references to specific students, student academic performance, or student disciplinary incidents;
(b) Multi-state employment law advisory work related to WET's planned elimination of forty-seven (47) full-time teaching positions across WET's charter school network in Delaware, Pennsylvania, and New Jersey, in which faculty evaluation records, student assessment data, classroom observations, and other personnel records may contain or reference student Education Records or PII;
(c) Anticipated individual wrongful-termination claims that may be asserted by terminated faculty members, in which discovery and litigation materials may include student records, parent correspondence, and other documents containing PII; and
(d) Any related proceedings, investigations, administrative actions, or regulatory inquiries arising from or connected to the matters described in subsections (a) through (c) above.
Without limiting the generality of the foregoing, Protected Data may include student records incidentally contained in employee personnel files, grievance records referencing students by name or identifiable characteristics, student disciplinary records, academic performance data and assessment results, Individualized Education Programs (IEPs) or Section 504 plans referenced in faculty evaluation materials, and parent or guardian correspondence that forms part of an employee's personnel or grievance file.
2.3 Applicability of FERPA. C&H acknowledges that, to the extent it receives Education Records from WET in connection with the engagement, it does so as an authorized representative of WET under 34 C.F.R. § 99.31(a)(1)(i)(B) for the purpose of performing an institutional service or function for which WET would otherwise use its own employees. C&H agrees to be bound by the conditions governing the use and re-disclosure of Education Records as set forth in FERPA, 34 C.F.R. Part 99, and this Addendum. C&H further acknowledges that its receipt of Education Records under the school-official or authorized-representative exception does not require the consent of parents or eligible students, provided that C&H complies with the conditions and limitations set forth herein.
2.4 Relationship to Engagement Letter. This Addendum supplements and forms part of the Engagement Letter. In the event of any conflict or inconsistency between the terms of this Addendum and the terms of the Engagement Letter with respect to data protection, information security, or the handling of Protected Data, the provisions of this Addendum shall control and govern. All other terms and conditions of the Engagement Letter, including without limitation the fee arrangements, billing procedures, and scope of engagement, shall remain in full force and effect and are unaffected by this Addendum.
ARTICLE 3: FERPA COMPLIANCE OBLIGATIONS
3.1 Designated Representative Status. For purposes of FERPA compliance in connection with the legal services described in the Engagement Letter, C&H shall be deemed a "school official" with a "legitimate educational interest" in the Education Records disclosed to it by WET, or, in the alternative, an authorized representative of WET designated to receive Education Records under 34 C.F.R. § 99.31(a)(1)(i)(B) and 34 C.F.R. § 99.35. C&H's status as a school official or authorized representative is limited to the scope of the engagement described in the Engagement Letter and does not extend to any other purpose or any other matter. C&H's designation under this Section shall terminate upon the conclusion or termination of the engagement and the completion of all data return or destruction obligations under Article 9.
3.2 Use Limitation. C&H shall use Protected Data solely for the purpose of providing legal services to WET under the Engagement Letter, including legal analysis, preparation of pleadings and filings, discovery preparation and review, legal advice, and related professional services, and for no other purpose whatsoever. Without limiting the foregoing, C&H shall not use Protected Data for commercial advantage, marketing, business development, statistical analysis unrelated to the engagement, data mining, or any purpose unrelated to the legal representation of WET in the Matter. C&H shall not aggregate or combine Protected Data with data from other clients or matters, except to the extent necessary for conflict-checking purposes conducted in accordance with applicable Rules of Professional Conduct.
3.3 Re-Disclosure Prohibition. C&H shall not disclose or re-disclose any Education Records or PII received from WET to any third party, except in the following limited circumstances:
(a) As required by a court order, subpoena, or other legal process, in which case C&H shall provide WET's General Counsel, Priya Anand-Desai, with prompt written notice prior to such disclosure, to the maximum extent permitted by applicable law, in order to afford WET a reasonable opportunity to seek a protective order, quash the subpoena, or otherwise contest the disclosure. In the event that a court order or legal process prohibits prior notification to WET, C&H shall provide notice to WET at the earliest date permitted by law following such disclosure;
(b) To WET's authorized agents, officers, board members, or other counsel, with the prior written authorization of Priya Anand-Desai, WET's General Counsel, specifying the identity of the recipient, the scope of the Protected Data to be disclosed, and the purpose for which the disclosure is authorized; and
(c) As necessary for the defense of the PERB matter, individual wrongful-termination claims, or related proceedings, subject to the use of redaction and de-identification protocols described in Section 3.4 below, and provided that any such disclosure in the context of litigation is made under applicable protective orders or confidentiality agreements to the extent obtainable.
In no event shall C&H disclose Education Records to any party in a manner that would violate the re-disclosure limitations of 34 C.F.R. § 99.33.
3.4 De-Identification and Redaction. Where Protected Data must be referenced in filings, correspondence, memoranda, or other documents prepared in connection with the engagement, C&H shall redact or de-identify student PII to the maximum extent practicable consistent with applicable legal obligations and the requirements of the forum in which the documents are to be filed or submitted. De-identification shall be performed in accordance with the standards set forth in 34 C.F.R. § 99.31(b), such that the records do not contain PII and there is no reasonable basis to believe that the information can be used to identify a particular student. Prior to filing any document with a court, administrative tribunal, or regulatory body that contains unredacted student PII, C&H shall consult with WET's General Counsel to determine whether redaction is feasible and, if not, whether a motion for a protective order or request for in camera review is appropriate.
3.5 Compliance with State Privacy Laws. In addition to FERPA, C&H shall comply with all applicable state data privacy and student data protection laws of the States of Delaware, Pennsylvania, and New Jersey to the extent they impose requirements on the handling of student records or personally identifiable information, including without limitation the Delaware Student Data Privacy Protection Act (14 Del. C. § 8101 et seq.), the Pennsylvania Breach of Personal Information Notification Act (73 P.S. § 2303), and the New Jersey Identity Theft Prevention Act (N.J.S.A. 56:11-44 et seq.). To the extent any state law imposes obligations that are more protective of student data than those required by FERPA, C&H shall comply with the more protective standard.
ARTICLE 4: ACCESS CONTROLS
4.1 Principle of Least Privilege. Access to Protected Data shall be limited to Authorized Personnel on a strict need-to-know basis. C&H shall grant access to Protected Data only to those individuals who require such access in order to perform their assigned responsibilities in connection with the Matter, and only to the extent necessary for the performance of such responsibilities. C&H shall maintain a current and accurate list of all Authorized Personnel who have been granted access to WET Protected Data, and shall make such list available to WET upon written request within five (5) business days. The list shall include each individual's name, title, role on the engagement, and the date on which access was granted.
4.2 Initial Authorized Personnel. As of the Effective Date, the following C&H personnel are designated as Authorized Personnel for purposes of this Addendum and are authorized to access Protected Data in connection with the Matter:
(a) Miriam Calloway — Responsible Partner;
(b) Joel Strauss — Billing Partner;
(c) Nadia Petrov — Lead Associate; and
(d) James Underwood — Working Associate.
Any additions to, or removals from, the Authorized Personnel list shall require the prior written approval of Priya Anand-Desai, General Counsel of WET, in accordance with the staffing approval requirements of Section 6.2 of WET OGG v.4.2. Requests for additions shall include the proposed individual's name, title, role, and the specific justification for access. C&H shall promptly notify WET's General Counsel in writing of the departure from the engagement or from C&H of any Authorized Personnel member, and shall confirm that such individual's access to Protected Data has been revoked.
4.3 Ethical Screen Compliance. The Parties acknowledge that, consistent with the ethical screen implemented by C&H as of February 14, 2026 in connection with C&H's prior representation of Thornfield Academy of Sciences, Inc. (Delaware Court of Chancery, Case No. 2023-0847-SG), Conrad Ashworth (Partner, Corporate & Governance Practice Group, Wilmington office) shall be permanently excluded from the Authorized Personnel list established under this Addendum. Mr. Ashworth shall have no access, whether direct or indirect, to any Protected Data, work product, correspondence, or other files associated with the WET engagement or the Matter. The document management system access restrictions implemented under the ethical screen memorandum dated February 14, 2026 shall apply equally to all Protected Data received by C&H under this Addendum. Any other C&H personnel who were members of the Thornfield Academy of Sciences engagement team are likewise excluded from access to WET Protected Data and the Matter. C&H shall ensure that all technological and administrative barriers necessary to enforce this ethical screen with respect to Protected Data remain in place throughout the duration of the engagement.
4.4 Multi-Factor Authentication. All Authorized Personnel must authenticate through multi-factor authentication ("MFA") before accessing any Receiving System containing Protected Data. MFA shall require at least two independent authentication factors, consisting of (a) something the user knows (e.g., a password or PIN), and (b) something the user has (e.g., a hardware token, software token, or push notification to a registered mobile device) or something the user is (e.g., a biometric identifier). C&H shall not permit access to Receiving Systems containing Protected Data through single-factor authentication under any circumstances.
4.5 Role-Based Access Controls. C&H shall implement role-based access controls ("RBAC") within its document management system (currently Stonefield Systems) and any case-management platforms, litigation support databases, or collaboration tools used in connection with the Matter, restricting access to Protected Data repositories to Authorized Personnel only. Access permissions shall be configured to reflect each individual's role on the engagement team and shall be reviewed and updated no less frequently than quarterly, or upon any change to the Authorized Personnel list.
4.6 Physical Access. Hard-copy materials containing Protected Data shall be stored in locked cabinets or secure rooms accessible only to Authorized Personnel at C&H's Philadelphia office (600 Market Street, Suite 4200) and, to the extent applicable, C&H's Wilmington office. Hard-copy materials containing Protected Data shall be marked "CONFIDENTIAL — WET PROTECTED DATA" or with a substantially equivalent designation. Hard copies of Protected Data shall not be removed from C&H's offices without the prior written approval of the Responsible Partner, Miriam Calloway, and any such removal shall be logged and tracked. When not in active use, hard-copy Protected Data shall be secured in accordance with C&H's clean-desk policy, and shall not be left unattended in common areas, conference rooms, or other unsecured locations.
ARTICLE 5: ENCRYPTION AND TECHNICAL SECURITY REQUIREMENTS
5.1 Encryption at Rest. All Protected Data stored electronically on C&H systems, including on file servers, databases, document management systems, backup media, and portable storage devices, shall be encrypted using the Advanced Encryption Standard with a key length of 256 bits (AES-256), or an equivalent or stronger encryption standard as may be approved by C&H's CISO, Patricia Hwang. Encryption keys shall be managed in accordance with industry best practices, including secure key generation, storage, rotation, and retirement procedures.
5.2 Encryption in Transit. All electronic transmissions of Protected Data between C&H and WET, between C&H offices, or between C&H and any authorized subcontractor or third-party service provider, shall utilize Transport Layer Security (TLS) version 1.2 or higher encryption. Email transmissions containing Protected Data shall be sent using C&H's encrypted email platform (currently Ashford Health IT) or an equivalent secure file transfer mechanism that provides end-to-end encryption. Unencrypted email transmission of Protected Data is strictly prohibited. C&H shall ensure that its email gateway is configured to enforce TLS encryption for all communications with WET's email domain (@wyndmeretrust.org).
5.3 Endpoint Security. All devices used by Authorized Personnel to access Protected Data, including laptops, desktop workstations, tablets, and mobile devices, shall be equipped with: (a) full-disk encryption compliant with FIPS 140-2 standards; (b) endpoint detection and response ("EDR") software capable of detecting, investigating, and responding to advanced threats in real time; (c) current anti-malware and antivirus protections with signature updates applied no less frequently than daily; and (d) host-based firewall protections. C&H shall maintain a mobile device management ("MDM") solution to enforce security policies on any mobile devices used to access Protected Data, including the ability to remotely wipe a device in the event of loss or theft.
5.4 Network Security. C&H shall maintain enterprise-grade firewall protections, intrusion detection and prevention systems ("IDS/IPS"), and network segmentation appropriate to protect Protected Data from unauthorized access, both from external threats and from internal users who are not Authorized Personnel. Network traffic to and from systems containing Protected Data shall be monitored and logged. C&H shall maintain secure configurations for all network infrastructure components in accordance with Center for Internet Security (CIS) benchmarks or equivalent standards.
5.5 Cloud and SaaS Platforms. Any cloud-based or Software-as-a-Service (SaaS) platforms used by C&H to store, process, or transmit Protected Data in connection with the Matter must satisfy each of the following requirements:
(a) The platform and all data at rest must be hosted within the United States, with no data replication, processing, or storage occurring outside the territorial boundaries of the United States;
(b) The platform provider must maintain a current SOC 2 Type II certification (or equivalent independent third-party assessment, such as ISO 27001 certification) covering the security, availability, and confidentiality trust service criteria; and
(c) The platform must be reviewed and approved by C&H's CISO, Patricia Hwang, as compliant with the technical standards set forth in this Addendum, prior to the storage or processing of any Protected Data on such platform.
C&H shall maintain a current inventory of all cloud and SaaS platforms used to store or process WET Protected Data and shall make such inventory available to WET upon request.
5.6 Vulnerability Management. C&H shall conduct regular vulnerability assessments and penetration testing of all Receiving Systems that store or process Protected Data, no less frequently than annually, using qualified internal or external security professionals. Critical vulnerabilities (defined as vulnerabilities with a CVSS score of 9.0 or higher) shall be remediated within thirty (30) days of identification. High-severity vulnerabilities (CVSS score of 7.0 to 8.9) shall be remediated within sixty (60) days. C&H shall maintain records of vulnerability assessments, penetration testing results, and remediation actions, and shall make summary reports available to WET upon request in connection with any audit conducted under Article 10.
ARTICLE 6: PERSONNEL TRAINING AND AWARENESS
6.1 Data Protection Training. All Authorized Personnel shall complete C&H's data protection and FERPA awareness training program prior to accessing any Protected Data in connection with the Matter, and shall complete refresher training on an annual basis thereafter for the duration of the engagement. The training program shall address, at a minimum: (a) the obligations of C&H under FERPA, including use limitations and re-disclosure restrictions; (b) the classification, handling, and storage of Protected Data; (c) the identification and reporting of Security Incidents; (d) the access control and encryption requirements set forth in this Addendum; and (e) the specific sensitivity of student Education Records and the potential consequences of unauthorized disclosure. C&H shall maintain records of training completion for all Authorized Personnel and shall make such records available to WET upon request.
6.2 Confidentiality Acknowledgment. Each member of the Authorized Personnel list shall execute an internal confidentiality acknowledgment specific to the WET engagement prior to receiving access to Protected Data. The acknowledgment shall confirm the individual's understanding of the obligations set forth in this Addendum, the sensitivity of student Education Records, the prohibition on re-disclosure, and the consequences of non-compliance, including potential disciplinary action. C&H shall retain executed copies of all such acknowledgments for the duration of the engagement and for a period of three (3) years thereafter, and shall provide copies to WET upon request.
6.3 Supervision. Miriam Calloway, as Responsible Partner for the Matter, and Patricia Hwang, as C&H's Chief Information Security Officer, shall jointly oversee compliance with the data protection obligations set forth in this Addendum. Ms. Calloway shall be responsible for ensuring that all members of the engagement team understand and comply with the substantive data handling requirements herein, and Ms. Hwang shall be responsible for ensuring that C&H's technical infrastructure and security controls continue to meet the standards required by this Addendum throughout the duration of the engagement. Any questions or concerns regarding the handling of Protected Data shall be directed to Ms. Calloway or Ms. Hwang, as appropriate.
ARTICLE 7: SUBCONTRACTORS AND THIRD-PARTY SERVICE PROVIDERS
7.1 Prior Approval. C&H shall not engage, retain, or permit any subcontractor or third-party service provider to access, receive, process, store, or transmit Protected Data without the prior written consent of WET's General Counsel, Priya Anand-Desai. The foregoing requirement applies to all categories of third-party service providers, including without limitation e-discovery vendors, litigation support providers, document review contractors, court reporters, expert consultants, forensic accountants, translators, and any other individuals or entities that are not C&H employees or partners. C&H's request for approval shall include the identity of the proposed subcontractor, a description of the services to be performed, the categories of Protected Data to which the subcontractor will have access, and a summary of the subcontractor's data security capabilities.
7.2 Flow-Down Obligations. Any subcontractor or third-party service provider approved by WET under Section 7.1 shall be bound by data protection obligations that are no less protective than those set forth in this Addendum, through a written agreement executed by the subcontractor prior to the subcontractor's receipt of any Protected Data. Such agreement shall include, at a minimum, obligations relating to use limitation, re-disclosure prohibition, encryption, access controls, Security Incident notification, and data return or destruction. C&H shall provide WET with a copy of the data protection provisions of any such subcontractor agreement upon request.
7.3 Liability. C&H shall remain fully responsible and liable for any acts, omissions, or failures of its subcontractors or third-party service providers with respect to Protected Data, to the same extent as if such acts, omissions, or failures were those of C&H itself. The engagement of a subcontractor or third-party service provider shall not relieve C&H of any obligation under this Addendum or limit C&H's liability hereunder.
ARTICLE 8: SECURITY INCIDENT AND BREACH NOTIFICATION
8.1 Detection and Investigation. C&H shall implement and maintain processes, technologies, and personnel resources sufficient to detect, investigate, and respond to Security Incidents involving Protected Data in a timely and effective manner. C&H's incident response capabilities shall include, at a minimum, continuous monitoring of Receiving Systems for indicators of compromise, established escalation procedures for suspected Security Incidents, and a documented incident response plan that addresses containment, eradication, recovery, and post-incident review.
8.2 Notification Timeline. In the event of a confirmed or reasonably suspected Breach involving Protected Data, C&H shall notify WET's General Counsel, Priya Anand-Desai, and WET's Chief Information Security Officer or designee, in writing within forty-eight (48) hours of C&H's discovery of the Breach. For purposes of this Section, "Discovery" means the point at which C&H has a reasonable basis to believe that a Security Incident has resulted in the unauthorized access to, acquisition of, use of, or disclosure of Protected Data. Notification shall be made by email to the addresses designated in Section 16.5 of this Addendum, with telephone confirmation to WET's General Counsel at the contact number provided separately.
8.3 Content of Notification. The Breach notification provided under Section 8.2 shall include, to the extent known at the time of notification, the following information:
(a) The date and time of the Breach, or the estimated date and time if the exact timing is unknown;
(b) The nature and scope of the Protected Data affected, including the categories of data involved and the approximate number of records or individuals potentially impacted;
(c) The circumstances and cause of the Breach, including a description of the vulnerability or failure that led to the incident;
(d) The steps taken or planned by C&H to contain the Breach and to remediate the underlying cause, including any immediate corrective actions implemented; and
(e) The identity of any individuals (including students, parents, and WET employees) whose PII may have been compromised as a result of the Breach, to the extent such information is known or reasonably determinable.
If C&H is unable to provide all of the foregoing information within the forty-eight (48) hour notification window, C&H shall provide the information then available and shall supplement the notification with additional details as they become known, on a continuing basis until the investigation is complete.
8.4 Cooperation and Remediation. C&H shall cooperate fully and in good faith with WET in investigating and remediating any Breach, including providing WET and its designated forensic investigators with timely access to relevant forensic reports, system logs, access records, and other information necessary to assess the scope and impact of the Breach. C&H shall bear all costs and expenses associated with forensic investigation, remediation, and any notifications to affected individuals or regulatory authorities that are required as a result of a Breach caused by C&H's acts, omissions, negligence, or failure to comply with the requirements of this Addendum.
8.5 Regulatory Notifications. WET shall retain sole authority and discretion to determine whether and when notifications must be made to affected individuals, parents or guardians, regulatory authorities (including the U.S. Department of Education's Family Policy Compliance Office), state attorneys general, or any other persons or entities in connection with any Breach involving Protected Data. C&H shall not make any such notifications, public statements, or disclosures regarding a Breach without the prior written authorization of WET's General Counsel, except to the extent that C&H is independently required by applicable law to make such notifications with respect to its own data security obligations.
8.6 Preservation of Evidence. In the event of a Breach or suspected Breach involving Protected Data, C&H shall immediately take all reasonable steps to preserve all relevant evidence, including system logs, access records, audit trails, forensic images of affected systems, and any other documentation that may be relevant to the investigation, remediation, or legal analysis of the Breach. Such evidence shall be preserved for a minimum period of three (3) years following the date of the Breach, or such longer period as may be required by applicable law, regulation, or written instruction from WET.
ARTICLE 9: DATA RETURN AND DESTRUCTION
9.1 Upon Conclusion of Matter. Within sixty (60) days of the conclusion or termination of the engagement under the Engagement Letter (including any post-engagement wind-down period agreed upon by the Parties), C&H shall, at WET's sole election as communicated in writing by WET's General Counsel:
(a) Return all Protected Data to WET in a format and on a medium designated by WET, including all originals, copies, extracts, summaries, and derivative works containing Protected Data, whether in electronic or hard-copy form; or
(b) Securely destroy all Protected Data in C&H's possession or control in accordance with the destruction standards set forth in Section 9.2, and certify such destruction in writing in accordance with Section 9.3.
WET shall communicate its election to C&H within thirty (30) days of the conclusion or termination of the engagement. If WET fails to make an election within such period, C&H shall proceed with secure destruction in accordance with Section 9.2.
9.2 Destruction Standards. Destruction of Protected Data shall be performed in a manner that renders the data permanently unreadable, unrecoverable, and incapable of reconstruction, in accordance with the following standards:
(a) Electronic data, including data stored on hard drives, solid-state drives, servers, backup tapes, removable media, and cloud-based storage platforms, shall be destroyed using methods compliant with the National Institute of Standards and Technology Special Publication 800-88, Revision 1 ("NIST SP 800-88"), including the clear, purge, or destroy methods as appropriate to the media type and classification of the data; and
(b) Hard-copy documents containing Protected Data shall be destroyed by cross-cut shredding (with a maximum particle size of 15mm x 25mm) or by incineration, using a service provider that provides a certificate of destruction.
9.3 Certification of Destruction. C&H shall provide WET with a written certificate of destruction, signed by Patricia Hwang, C&H's Chief Information Security Officer, or her authorized designee, within ten (10) business days of completing the destruction of Protected Data. The certificate shall specify: (a) the categories and general description of the Protected Data destroyed; (b) the method of destruction employed for each category of data; (c) the date or dates on which destruction was completed; and (d) a statement that the destruction was performed in accordance with the standards set forth in Section 9.2 and NIST SP 800-88.
9.4 Retained Copies. Notwithstanding Section 9.1, C&H may retain copies of Protected Data to the limited extent that:
(a) Retention is required by applicable law, regulation, or professional responsibility rules, including rules governing the retention of client files and work product; or
(b) Protected Data is contained within C&H's standard automated system backups, provided that: (i) such backups are maintained in encrypted form in accordance with Article 5; (ii) C&H shall not actively access, use, or process Protected Data contained in such backups except as necessary for disaster recovery purposes; and (iii) such backups shall be overwritten or destroyed in the ordinary course of C&H's backup rotation schedule.
Any Protected Data retained by C&H under this Section 9.4 shall continue to be subject to the confidentiality, use-limitation, and security protections set forth in this Addendum for the duration of such retention. C&H's document retention policy provides for the retention of closed matter files for a period of ten (10) years following the closure of the matter, which exceeds the seven (7) year post-matter retention requirement set forth in WET OGG v.4.2. C&H shall notify WET in writing of any Protected Data retained under this Section 9.4, specifying the categories of data retained and the legal or regulatory basis for such retention, at the time the certificate of destruction is provided under Section 9.3.
9.5 Survival. The obligations set forth in this Article 9, together with the confidentiality and use-limitation obligations in Articles 3 and 4, the Breach notification obligations in Article 8, the indemnification obligations in Article 13, and the limitation of liability provisions in Article 12, shall survive the expiration or termination of the Engagement Letter and this Addendum.
ARTICLE 10: AUDIT AND INSPECTION RIGHTS
10.1 WET Audit Right. WET, or its designated third-party auditor (currently Hargrove & Linden CPAs LLP), shall have the right, upon not less than fifteen (15) business days' prior written notice to C&H, to conduct an audit of C&H's compliance with the terms and conditions of this Addendum. Such audit may include the inspection and review of relevant policies, procedures, system configurations, access logs, training completion records, incident response records, and other documentation reasonably related to C&H's handling of Protected Data. WET's audit right under this Section may be exercised no more than once per calendar year during the term of the engagement under the Engagement Letter, and one (1) additional time during the one (1) year period following the termination or expiration of the engagement.
10.2 Scope of Audit. Audits conducted under Section 10.1 shall be limited in scope to C&H's handling of WET Protected Data and C&H's compliance with the specific obligations set forth in this Addendum. Audits shall be conducted during normal business hours and in a manner that does not unreasonably interfere with C&H's business operations, client service obligations, or the confidentiality of other clients' matters. The Parties acknowledge that certain information reviewed during an audit may be subject to attorney-client privilege or attorney work product protection, and nothing in this Addendum shall be construed to require C&H to disclose privileged or work-product-protected information to WET's auditors, except to the extent that such disclosure is necessary to verify compliance with the technical and procedural requirements of this Addendum and does not compromise privilege protections.
10.3 Third-Party Assessments. In lieu of a direct audit under Section 10.1, WET may, at WET's election, accept a current SOC 2 Type II report or equivalent independent third-party assessment of C&H's information security controls, if such a report is available and covers the security, availability, and confidentiality trust service criteria relevant to C&H's handling of Protected Data. C&H shall provide a copy of any such report to WET upon request, subject to any confidentiality restrictions imposed by the assessor.
10.4 Remediation of Findings. In the event that an audit conducted under Section 10.1 or a third-party assessment reviewed under Section 10.3 identifies any material deficiencies in C&H's compliance with this Addendum, C&H shall remediate such deficiencies within thirty (30) days of receipt of written notification from WET identifying the deficiencies, or within such longer period as may be mutually agreed upon by the Parties in writing. C&H shall provide WET with written confirmation of remediation upon completion, including a description of the corrective actions taken. If any material deficiency is not remediated within the agreed-upon timeframe, WET may, in addition to any other remedies available under this Addendum or at law, suspend the transmission of Protected Data to C&H until the deficiency is resolved.
ARTICLE 11: REPRESENTATIONS AND WARRANTIES
11.1 C&H Representations and Warranties. C&H represents and warrants to WET as follows:
(a) C&H has implemented and maintains a comprehensive information security program that is consistent with industry best practices for law firms of similar size and scope, and that complies with all applicable legal and regulatory requirements for the protection of sensitive data, as confirmed by C&H's Chief Information Security Officer, Patricia Hwang;
(b) C&H's Receiving Systems meet or exceed the technical security standards set forth in Article 5 of this Addendum, including the encryption, access control, endpoint security, network security, and vulnerability management requirements specified therein;
(c) As of the Effective Date, C&H has no knowledge of any existing, unresolved security vulnerabilities in its systems or infrastructure that would reasonably be expected to compromise the security, confidentiality, or integrity of Protected Data stored, processed, or transmitted by C&H;
(d) C&H will comply with all applicable federal, state, and local laws, rules, and regulations governing the handling, storage, transmission, and protection of Education Records and PII, including FERPA (20 U.S.C. § 1232g and 34 C.F.R. Part 99), the data privacy and breach notification laws of the States of Delaware, Pennsylvania, and New Jersey, and any other applicable privacy or data security laws; and
(e) C&H has the organizational capacity, technical infrastructure, and trained personnel necessary to fulfill its obligations under this Addendum throughout the duration of the engagement.
11.2 WET Representations and Warranties. WET represents and warrants to C&H as follows:
(a) WET has the legal authority to disclose Protected Data to C&H for the purposes described in the Engagement Letter, including under the FERPA school-official exception (34 C.F.R. § 99.31(a)(1)) and the authorized-representative exception (34 C.F.R. § 99.31(a)(3) and § 99.35), and such disclosure does not violate any obligation WET owes to any third party; and
(b) WET will clearly identify and label materials containing Protected Data when transmitting them to C&H, to the extent practicable, using the designation "CONTAINS PROTECTED DATA — WET" or a substantially equivalent marking, so as to enable C&H to apply the protections required by this Addendum.
ARTICLE 12: LIMITATION OF LIABILITY
12.1 Liability Cap. Except in cases of gross negligence or willful misconduct by C&H, C&H's aggregate liability under this Addendum for any and all claims arising from data protection failures, Security Incidents, or Breaches shall not exceed the lesser of:
(a) Two Million Dollars ($2,000,000); or
(b) The total fees actually paid by WET to C&H under the Engagement Letter during the twelve (12) month period immediately preceding the event or occurrence giving rise to the claim.
12.2 Exclusions. The limitation of liability set forth in Section 12.1 shall not apply to, and shall not limit or restrict:
(a) C&H's indemnification obligations under Article 13 with respect to third-party claims arising from a Breach caused by C&H's acts or omissions; or
(b) Regulatory fines, penalties, or sanctions imposed on WET by any governmental authority, including the U.S. Department of Education, as a direct result of C&H's breach of this Addendum or C&H's failure to comply with FERPA or applicable state data protection laws.
Nothing in this Article 12 shall be construed to limit or modify WET's rights or remedies under the Engagement Letter, applicable Rules of Professional Conduct, or applicable law, except as expressly set forth herein.
ARTICLE 13: INDEMNIFICATION
13.1 C&H Indemnification. C&H shall indemnify, defend, and hold harmless WET, its officers, directors, trustees, employees, agents, and representatives from and against any and all third-party claims, demands, actions, suits, losses, liabilities, damages, costs, and expenses (including reasonable attorneys' fees and costs of litigation) arising from or related to: (a) C&H's breach of any provision of this Addendum; (b) any unauthorized access to, acquisition of, use of, or disclosure of Protected Data caused by C&H's acts, omissions, negligence, or failure to comply with the requirements of this Addendum; or (c) any acts or omissions of C&H's subcontractors or third-party service providers with respect to Protected Data. C&H's indemnification obligations under this Section shall survive the termination or expiration of this Addendum and the Engagement Letter.
13.2 WET Indemnification. WET shall indemnify, defend, and hold harmless C&H, its partners, associates, employees, agents, and representatives from and against any and all third-party claims, demands, actions, suits, losses, liabilities, damages, costs, and expenses (including reasonable attorneys' fees and costs of litigation) arising from or related to: (a) WET's failure to properly identify or label Protected Data in accordance with Section 11.2(b), to the extent that such failure is the proximate cause of C&H's failure to apply the protections required by this Addendum; or (b) WET's own unauthorized disclosure of Protected Data that is not attributable to C&H's acts or omissions.
ARTICLE 14: INSURANCE
14.1 Cyber Liability Insurance. C&H shall maintain, at its own cost and expense, cyber liability insurance (including network security and privacy liability coverage) and professional liability (errors and omissions) insurance in amounts reasonably sufficient to cover C&H's obligations under this Addendum and the Engagement Letter, throughout the term of the engagement and for a period of two (2) years following the termination or expiration of the engagement. Such insurance shall provide coverage for, at a minimum, data breach response costs, notification costs, forensic investigation expenses, regulatory defense and penalty coverage, and third-party liability arising from unauthorized disclosure of personally identifiable information.
14.2 Evidence of Coverage. Upon written request from WET, C&H shall provide WET with certificates of insurance evidencing the coverage required by Section 14.1, including the identity of the insurer, the policy number, the coverage limits, and the policy period. C&H shall provide WET with no less than thirty (30) days' prior written notice of any material change, cancellation, or non-renewal of such insurance coverage.
ARTICLE 15: TERM AND TERMINATION
15.1 Term. This Addendum shall be effective as of February 10, 2026 (the Effective Date) and shall remain in effect for the duration of the engagement under the Engagement Letter, including any extensions or renewals thereof, and thereafter as to any surviving obligations specified herein.
15.2 Termination. This Addendum shall terminate upon the later of: (a) the termination, expiration, or conclusion of the Engagement Letter (including any post-engagement wind-down period); or (b) the completion of all data return or destruction obligations under Article 9, as evidenced by the delivery of a certificate of destruction under Section 9.3 or the confirmed receipt by WET of all returned Protected Data.
15.3 Effect of Termination. Termination of this Addendum shall not relieve either Party of any obligations accrued prior to the effective date of termination, or of any obligations that by their nature or express terms are intended to survive termination, including without limitation the obligations set forth in Articles 3 (FERPA Compliance Obligations), 4 (Access Controls), 8 (Security Incident and Breach Notification), 9 (Data Return and Destruction), 12 (Limitation of Liability), and 13 (Indemnification).
ARTICLE 16: GENERAL PROVISIONS
16.1 Governing Law. This Addendum shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict-of-laws principles, consistent with the governing law provision of the Engagement Letter. Any dispute arising under or in connection with this Addendum that is not resolved by mutual agreement of the Parties shall be submitted to the exclusive jurisdiction of the state and federal courts located in New Castle County, Delaware.
16.2 Entire Agreement. This Addendum, together with the Engagement Letter (including all schedules and exhibits thereto), constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior or contemporaneous agreements, understandings, representations, warranties, and communications, whether written or oral, relating to data protection, data security, or the handling of Protected Data in connection with the engagement. The WET OGG is incorporated by reference to the extent expressly referenced herein but does not independently create binding contractual obligations except as incorporated into this Addendum and the Engagement Letter.
16.3 Amendments. This Addendum may be amended, modified, or supplemented only by a written instrument signed by duly authorized representatives of both Parties. No oral agreement, course of dealing, or course of performance shall be deemed to amend or modify the terms of this Addendum.
16.4 Severability. If any provision of this Addendum, or the application thereof to any person or circumstance, is held invalid, illegal, or unenforceable by a court of competent jurisdiction, such invalidity, illegality, or unenforceability shall not affect any other provision of this Addendum, and the remaining provisions shall continue in full force and effect. The Parties shall negotiate in good faith to replace any invalid or unenforceable provision with a valid and enforceable provision that achieves, to the greatest extent possible, the original intent of the Parties.
16.5 Notices. All notices, requests, demands, consents, and other communications required or permitted under this Addendum shall be in writing and shall be deemed duly given when: (a) delivered in person; (b) sent by certified or registered mail, return receipt requested, postage prepaid; (c) sent by nationally recognized overnight courier service; or (d) sent by email with confirmation of receipt. Notices shall be addressed to the Parties at the following addresses, or at such other addresses as either Party may designate in writing from time to time:
If to C&H:
Miriam Calloway, Partner Calderwood & Harkness LLP 600 Market Street, Suite 4200 Philadelphia, PA 19106
Email: m.calloway@calderwoodharkness.com
With a copy to:
Patricia Hwang, Chief Information Security Officer Calderwood & Harkness LLP 600 Market Street, Suite 4200 Philadelphia, PA 19106
Email: p.hwang@calderwoodharkness.com
If to WET:
Priya Anand-Desai, General Counsel Wyndmere Education Trust 1400 Brandywine Boulevard, Suite 300 Wilmington, DE 19801
Email: panand-desai@wyndmeretrust.org
16.6 Counterparts. This Addendum may be executed in one or more counterparts, each of which shall be deemed an original and all of which, taken together, shall constitute one and the same instrument. Execution and delivery of this Addendum by electronic means, including by email transmission of a PDF copy of a signed signature page, shall be valid and binding to the same extent as execution and delivery of an original.
16.7 No Waiver. The failure of either Party to enforce any provision of this Addendum at any time shall not constitute a waiver of such provision or of any other provision hereof, nor shall it be construed as a waiver of any succeeding breach of the same or any other provision. No waiver of any provision of this Addendum shall be effective unless made in writing and signed by the waiving Party.
16.8 Assignment. Neither Party may assign, transfer, or delegate its rights or obligations under this Addendum, in whole or in part, without the prior written consent of the other Party, which consent shall not be unreasonably withheld. Any purported assignment in violation of this Section shall be void and of no force or effect. Notwithstanding the foregoing, either Party may assign this Addendum to a successor entity in connection with a merger, consolidation, or sale of all or substantially all of the assigning Party's assets, provided that the successor entity agrees in writing to be bound by the terms of this Addendum.
SIGNATURE PAGE
IN WITNESS WHEREOF, the Parties have caused this Data Protection Addendum to be executed by their duly authorized representatives as of the Effective Date.
CALDERWOOD & HARKNESS LLP
By: ________
Name: Miriam Calloway
Title: Partner, Healthcare & Life Sciences Practice Group
Date: ________
WYNDMERE EDUCATION TRUST
By: ________
Name: Priya Anand-Desai
Title: General Counsel
Date: ________
ACKNOWLEDGMENT — CHIEF INFORMATION SECURITY OFFICER
I, Patricia Hwang, Chief Information Security Officer of Calderwood & Harkness LLP, hereby certify that I have reviewed the data protection and information security requirements set forth in this Data Protection Addendum in their entirety. Based on my review of C&H's current information security infrastructure, policies, procedures, and technical controls, I confirm that C&H's information security program complies with the standards required by this Addendum, including the encryption, access control, endpoint security, network security, vulnerability management, and incident response requirements set forth in Articles 4 through 8. I further confirm that C&H's security controls are designed and maintained in a manner consistent with industry best practices for law firms handling sensitive educational and personally identifiable information, and that C&H is capable of fulfilling the data protection obligations set forth herein throughout the duration of the engagement.
This acknowledgment is provided in support of the representations set forth in Section 11.1 of this Addendum and does not create any independent obligations on my part separate from C&H's obligations under this Addendum.
ACKNOWLEDGED AND CONFIRMED:
By: ________
Name: Patricia Hwang
Title: Chief Information Security Officer, Calderwood & Harkness LLP
Date: ________
APPENDIX A
C&H INFORMATION SECURITY STANDARDS SUMMARY
The following is a summary of Calderwood & Harkness LLP's information security program, as confirmed by Patricia Hwang, Chief Information Security Officer, in connection with the execution of this Data Protection Addendum. This summary is provided for informational purposes to assist WET in evaluating C&H's compliance posture and does not limit, modify, or supersede C&H's obligations under the body of this Addendum. In the event of any inconsistency between this Appendix and the obligations set forth in the Addendum, the terms of the Addendum shall control.
1. Encryption Standards
•  At Rest: All sensitive data, including Protected Data, stored on C&H systems is encrypted using AES-256 encryption. Full-disk encryption is deployed on all endpoints (laptops, workstations, and portable devices) using FIPS 140-2 validated encryption modules.
•  In Transit: All data transmissions utilize TLS 1.2 or higher. C&H's encrypted email platform (Ashford Health IT) is used for the transmission of sensitive data via email. Secure file transfer is available via C&H's client portal (Ashford Software) with end-to-end encryption.
2. Multi-Factor Authentication
MFA is required for all C&H personnel accessing firm systems, including email, document management, VPN, and cloud applications. C&H utilizes hardware and software token-based authentication (currently Beaumont Software) for all remote access and

DATA PROTECTION ADDENDUM

PARTIES:

RECITALS

ARTICLE 1: DEFINITIONS

ARTICLE 2: PURPOSE AND SCOPE

ARTICLE 3: FERPA COMPLIANCE OBLIGATIONS

ARTICLE 4: ACCESS CONTROLS

ARTICLE 5: ENCRYPTION AND TECHNICAL SECURITY REQUIREMENTS

ARTICLE 6: PERSONNEL TRAINING AND AWARENESS

ARTICLE 7: SUBCONTRACTORS AND THIRD-PARTY SERVICE PROVIDERS

ARTICLE 8: SECURITY INCIDENT AND BREACH NOTIFICATION

ARTICLE 9: DATA RETURN AND DESTRUCTION

ARTICLE 10: AUDIT AND INSPECTION RIGHTS

ARTICLE 11: REPRESENTATIONS AND WARRANTIES

ARTICLE 12: LIMITATION OF LIABILITY

ARTICLE 13: INDEMNIFICATION

ARTICLE 14: INSURANCE

ARTICLE 15: TERM AND TERMINATION

ARTICLE 16: GENERAL PROVISIONS

SIGNATURE PAGE

CALDERWOOD & HARKNESS LLP

WYNDMERE EDUCATION TRUST

ACKNOWLEDGED AND CONFIRMED:

APPENDIX A

C&H INFORMATION SECURITY STANDARDS SUMMARY

Record

Parties

Dates

Amounts