Integrated Standards Prep™ to help ALL students achieve success. Designed by teachers for teachers.

Effective as of February 25, 2022

Privacy Policy

Asteria Learning, Inc. Asteria Learning, Inc. d.b.a. ECS Learning Systems ("ECS", “we”, “us”, or “our”) develops supplemental and blended learning solutions under the brands STAAR MASTER®, and STAARMASTER eBOOKS, to help ALL students in Grades K–12 achieve academic success and mastery of state standards. We do this by adhering to our proven Integrated Standards PrepTM methodology, leveraging our award-winning Learning Positioning System®, a digital learning platform, developing proprietary content, and maintaining affordable pricing.

This Privacy Policy describes our practices regarding information we collect through our websites, including ecslearn.com, ecslearningsystems.com, testsmart.com, novelunits.com, staarmaster.com, and prepworks.com, and any other interactive features or services owned or controlled by ECS that post a link to this Privacy Policy (each, a "Service" and collectively, the "Services"), as well as any information we collect offline and combine in our databases. Certain features discussed in this Privacy Policy may not be offered on each Service at any particular time.

Note about Children: As required by applicable law and our Terms of Service, children under the age of 13 in the U.S. (and a higher age if required by the applicable law in another country) may only use our Services with the express prior consent of a parent or legal guardian. To the extent you are using our Services through our agreement with a school, ECS is not obligated to get separate parental consent.

1. What is this policy?

Information collection/How we use your information: Information that we collect is primarily used to communicate with you and to provide and maintain access to the ECS Services. For accounts created through schools and school districts, information from teacher and students accounts is shared with school or district administrators (and school administrator account information may be shared with district administrators). Please

WE FULLY DESCRIBE OUR PRIVACY PRACTICES BELOW IN THIS PRIVACY POLICY. THIS SUMMARY PROVIDES AN OVERVIEW OF SOME IMPORTANT INFORMATION REGARDING OUR USE AND SHARING OF YOUR INFORMATION. PLEASE READ THE ENTIRE PRIVACY POLICY VERY CAREFULLY. BY USING ANY SERVICE, YOU AGREE TO BE BOUND BY THIS PRIVACY POLICY IN ITS ENTIRETY.

1

review the "What information does ECS Collect?” and "How does ECS use the information it collects?" sections of this Privacy Policy for a full description of the information we collect, including Personal Information (as defined below), and how we use that information.

Information Sharing: Remember that if you create a Profile (as defined below) or share Personal Information with other users on the Services, your information may be visible to others. However, child data will only be visible to their parents and student data will only be visible to their teachers and appropriate school and district administrators. Note that we do not share your and your children’s/students’ Personal Information with third parties for their marketing purposes; however, we may share such Personal Information under certain limited circumstances. For more details, please review the section below entitled "Will ECS share any of the information it collects?"

Third parties: We work with service providers, like Amazon Web Services, to provide us with information regarding traffic on the Services, including the frequency of use and the actions users take when visiting the Services and to provide us with information regarding the use of the Services. We may also work with learning management systems that provide us with a platform to host our application. If that is the case, then Personal Information may be stored on the learning management system’s server.

2. What information does ECS collect? Information Shared with Us

  1. Registration and Other Information You Provide
    The Services may collect "Personal Information" (which is information that can reasonably be used alone or in combination with other reasonably available information, to identify or contact a specific individual). Personal Information collected varies between the Services but can include information such as name, email address, and phone number. Any information combined with Personal Information will be treated as Personal Information.
  2. Your Account

    Your Account Page: Note that different information is collected through each of the Services.

    STAAR MASTER eBOOKS and STAAR MASTER eBOOK services.

- Consumer Accounts

  • Consumer name
  • Consumer email

2

  • Student email
  • Consumer phone number
  • Credit card information

- School Accounts

  • School administrator name
  • School administrator email
  • School address
  • Student email address or student ID
  • Student name
  • Teacher name
  • Teacher email
  • Teacher phone
  • Teacher’s School delivery address

    STAAR MASTER

  • -  Student Accounts
    • Student name
    • Student email address
    • Delivery address
    • Parent Name
    • Parent phone number
  • -  School Accounts
    • School administrator name
    • School administrator email
    • School administrator phone
    • School delivery address
    • Teacher name
    • Teacher email
    • Teacher phone
    • Teacher’s School delivery address

      ECS will share student information to third parties only for the purpose of providing services and ECS not share personally identifiable student information with third parties for the purpose of marketing. However, ECS may share information collected with third parties when an individual requests information via a webform, lead scanners at trade shows, or in purchased lists

      • Name of district representative or individual consumer
      • Phone of district representative or individual consumer
      • Email of district representative or individual consumer
      • Title of district administrator (if applicable)
      • School name
      • School district, city, state, and zip code\individual consumer’s address (if applicable)

3. Third Party Services and Information Third Parties Provide About You

The Services may permit interactions between the Services and a third-party feature or service. These third parties may provide us with information about you. Similarly, if you publicly post information on a

3

third-party platform, such as a social media site, that references ECS or one of the Services, your post may be published on our Services in accordance with that third party’s terms. These features may collect your IP address or other unique identifier, which page you are visiting on our website, and may set a cookie to enable the third-party feature to function properly. When you use a third-party feature through the Services, the third party may also have access to information about you and your use of our Services. Your interactions with third-party links and features are governed by the privacy policies of the third parties.

You may access some of our Services through a third-party platform that provides a school with access to our Services. If you access the Services through a third party, your data may be on their servers and is subject to their privacy policies.

The information we collect is subject to this Privacy Policy. The information collected and stored by the third party remains subject to the third party's privacy practices, including whether the third party continues to share information with us, the types of information shared, and your choices with regard to what is visible to others on that third party website and service. The third party may allow you to remove the application or feature, in which case we will no longer collect information about you through the application or feature, but we may retain the information previously collected in compliance with all applicable laws.

Information We Collect Automatically

Like other websites and online services, we and our analytics providers, vendors and other third-party service providers may automatically collect certain "Usage Information" whenever you access and use the Services. For example, we may collect information regarding how often a user accesses certain features.

Usage Information may include the browser and operating system you are using, the URL that referred you to our Services (if applicable), the search terms you entered into a search engine that lead you to our Services (if applicable), all of the areas within our Services that you visit, and the time of day you used the Services, among other information. We may use Usage Information for a variety of purposes, including to select appropriate content to display to you and to enhance or otherwise improve the Services and our products.

In addition, we automatically collect your IP address or other unique identifier ("Device Identifier") for any computer, mobile phone or other device (any, a "Device") you may use to access the Services. A Device Identifier is a number that is automatically assigned to your Device used to access a Service, and our servers identify your Device by its Device Identifier. Some mobile service providers may also provide us or our third-party service

4

providers with information regarding the physical location of the Device used to access a Service, internet service provider (ISP), date and time of your visit, browser language, browser type, referring and exit pages and URLs, amount of time spent on particular pages, which parts of our Services you use, which links you click, search terms, operating system, traffic and related statistics, keywords, and/or other general browsing or usage data. Usage Information is generally non-identifying, but if we associate it with you as a specific and identifiable person, we treat it as Personal Information.

Usage Information is collected via tracking technologies.

Cookies

Like many other websites and apps, we use “cookies” (a small file sent to your computer by a website or device to allow the website or app to store information which uniquely identifies you) or other similar software to collect data in order to assist our users and provide them with a more personal experience visits in our Website or apps. For example, cookies help our systems recognize you if you return to our Services shortly after exiting them. You can always disable cookies at your browser or device’s settings, but please note that if you do so, some (or all) of the features and functionality of our Services may not be available to you.

3. How does ECS use the information it collects?

We may use information about you, including Personal Information, the information you provide in your Profile, User Content, and Usage Information for the following purposes:

1. To provide the Services. We use your personal information to verify your registration, allow you to participate in features we offer, contact you regarding the Services, and to allow other users to contact you.
2. To operate the websites. Your personal information may be used to tailor content, recommendations and offers we display to you, both on the Services and elsewhere online, as well as to maintain or improve our Services.

3. To send marketing communications. Anyone may sign up to receive communications from us regarding new or existing offerings or other materials that may be of interest. Recipients who have opted-in to such communications may unsubscribe at any time by clicking on the unsubscribe link in any email. Children under the age of 18 are prohibited from signing up for these communications and we will unsubscribe any person under the age of 18 that we become aware of signing up to receive these communications.

4. To create anonymous data for analytics. We may make information anonymous by excluding information that makes it personally identifiable to you, and use that anonymous data for our lawful business purposes.

5

5. For compliance, fraud prevention, and safety. We use your personal information as we believe is necessary or appropriate to (a) enforce our terms and conditions; (b) protect our rights, privacy, safety or property, and that of you or others; and (c) protect, investigate, and deter against fraudulent, harmful, unauthorized, unethical, or illegal activity.

6. To comply with law. We use your personal information as we believe necessary or appropriate to comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities.
7. With your consent. In some cases, we may ask for your consent to collect, use, or share your personal information, such as when required by law or agreements with third parties.

Please note that information submitted on the Services via a "Contact Us" or other similar function may not receive a response. We will not use the information provided via these functions to contact you for marketing purposes unrelated to your request unless you agree otherwise.

4. Will ECS share any of the information it collects?

ECS does not share your Personal Information with third parties for their marketing purposes in compliance with all applicable laws. ECS may share non-Personal Information, such as aggregate or de-identified user statistics, demographic information and Usage Information with third parties.

We also may share your Personal Information with third parties with your consent (if permissible under applicable law), as disclosed at the time you provide us with information, and as described below or otherwise in this Privacy Policy:

1. Service Providers

We will share your Personal Information with third parties to provide services to us or you in connection with the Services, but subject to confidentiality obligations, which limit their use and disclosure of such information. For example, we may provide your Personal Information to companies that provide services to help us with our business activities, sending our emails, or offering customer service. For the Services, consumer payments and payments by schools who choose to use a credit card are processed through a third party servicer and through our own system and ECS receives full credit card information used for all transactions.

2. Administrative, Legal Reasons & Academic Integrity Investigations

We may also disclose your information, including Personal Information, in response to a subpoena, court order, or when otherwise required by law; in response to bankruptcy proceedings; to defend

6

our rights; in response to a request from law enforcement; to provide information to a claimed owner of intellectual property who claims that content you have provided to us infringes on their rights; upon request of or as otherwise authorized by an academic institution connected to an investigation into academic integrity; to protect and/or defend any applicable Terms of Service or other policies applicable to the Services; or to protect the personal safety, rights, property or security of any organization or individual.

We may also use Device Identifiers, including IP addresses, to identify users, and may do so in cooperation with copyright owners, Internet service providers, wireless service providers or law enforcement agencies in our discretion. These disclosures may be carried out without your consent or without notice to you.

3. Business Transitions

ECS may share Personal Information with its parent, subsidiaries and affiliates, and investors primarily for business and operational purposes so long as any recipient agrees to comply with this Privacy Policy and applicable law with regard to such Personal Information. In the event that ECS goes through a business transition, such as a merger, acquisition by another company, or sale of all or a portion of its assets, bankruptcy, or other corporate change, including, without limitation, during the course of any due diligence process, your information, including Personal Information, will likely be among the assets transferred.

You will be notified via email and/or a prominent notice on Services of any completed change in ownership or uses of your Personal Information, as well as any choices you may have regarding your Personal Information. This Privacy Policy will become binding upon the new owner of the information until amended.

4. Testimonials

We may display personal testimonials of satisfied adult users on our Services in addition to other endorsements. With your consent, we may post your testimonial along with your name. If you wish to update or delete your testimonial, you can contact us.

5. How does ECS work with third parties?

Third-Party Advertising

7

ECS will never use any student, teacher, school administrator, or parent data provided to register for any of the Services to market on behalf of third parties. We will not mine student data for any purposes other than those agreed to by the parties, although ECS may use aggregated student data to improve our products as permitted by law. Data mining or scanning of user content for the purpose of advertising or marketing to students or their parents is prohibited.

Information provided when an adult user signs up for marketing will be used by third parties to provide those services such as for ECS’s analytics and ECS’s advertising services.

Third-Party Sign-In

For certain Services, you may choose to connect the Services to your email account or other third-party services. We do not control these third parties’ use of your personal information. The information collected and stored by the third party remains subject to the third party's privacy practices, including whether the third party continues to share information with us, the types of information shared, and your choices with regard to what is visible to others on that third party website and service.

Third-Party Providers

We work with service providers to provide us with services such as user support, email, and marketing, and to provide us with web analytics and information regarding traffic on the Services, including the features used when visiting the Services and to provide us with information regarding the use of the Services.

Third-Party Content, Links to Other Sites, and ECS Content Found Outside of the Services

Certain content provided through the Services may be hosted and served by third parties. In addition, the Services may link to third party websites or content over which ECS has no control and which are governed by the privacy policies and business practices of those third parties.

Please also note that ECS content may be included on web pages and websites that are not associated with us and over which we have no control. These third parties may independently collect data. ECS is not responsible or liable for the privacy practices or business practices of any third party.

For more information about data we receive from third parties, please refer to “Third Party Services, Social Media Platforms, and Information Third Parties Provide About You” above.

8

6. What happens if I access ECS’s services through a mobile device?

7. How does ECS protect children’s information?

Protecting the privacy of young children is especially important to ECS. For that reason, we created certain features designed to help protect Personal Information relating to children who are less than 13 years of age or older if required by applicable law (“Child Users”).

ECS does not knowingly permit Child Users to use our Services without prior, express consent from a parent or legal guardian, except through agreements with schools or districts or as otherwise permitted under the Children’s Online Privacy Protection Rule (COPPA) and the Family Educational Rights and Privacy Act (FERPA). If we learn that Personal Information of a Child User has been collected on our Services without prior parental consent, then we will take appropriate steps to delete this information. If you are a parent or guardian (“Parent”) and discover that your child under the age of 13 (or a higher age if required by applicable law) has a registered account with our Services without your consent, please contact CustomerCare@ECSLearn.com to request that we delete that child’s personal information from our systems.

How does a child use the Services?

Child Users can access our Services through an account requested by their parent or their school. For accounts accessed through agreements with schools, ECS relies on schools and teachers (or other authorized individuals) to first obtain any necessary parental consents before permitting children to access or use the Services.

What children’s information is visible to others?

No child’s profile is made available or visible to the public through ECS. In consumer accounts, parents may view their children’s information at any time by logging into their account. In school accounts, teachers and school and district administrators may view information of their students, and parents may access their student’s information if the student gives them access to the account. If, in a school account, a teacher utilizes certain features on a device in the classroom, other students may be able to view information that is displayed by the teacher in the classroom, but students cannot view each other’s individual student profiles.

If you use the Services through a mobile device, you agree that ECS may store and use that information for security purposes (for example, for user verification or authentication).

9

A Note about FERPA:

Certain records collected or maintained by ECS are subject to FERPA. FERPA provides parents (or students if over the age of 18) with certain rights with regard to those records. For more information on those rights and other important information about FERPA, please see ECS’s FERPA Policy.

8. How does ECS protect and store my information?

ECS takes data security very seriously. ECS takes commercially reasonable technical, physical, and administrative security measures designed to protect the Personal Information submitted to us, both during transmission and upon receipt, and at rest. Such measures vary depending on the sensitivity of the information at issue.

Please note that no method of transmission over the Internet, or method of electronic storage, is completely secure. Therefore, while we strive to use commercially reasonable means to protect your Personal Information, we cannot guarantee its absolute security.

How will ECS handle a data breach or security incident?

In the event that ECS becomes aware of a data breach impacting your Personal Information, we will provide notification in compliance with all applicable laws. For example, we may post a notice on our homepage or elsewhere on the Service, and may email you at the email address you have provided to us. Depending on where you live, you may have a legal right to receive notice of a security breach in writing.

ECS has procedures in place that are designed to stop threats that may expose personally identifiable information, restore Services to full functionality, and document and take proactive steps to ensure the incident cannot be repeated. ECS will also preserve necessary evidence for investigation by security professionals and law enforcement as appropriate. In the unlikely event of an unauthorized disclosure of records, ECS will follow its internal procedures, which articulates how to report the problem to internal and external stakeholders. The notification process includes any information that can identify which customers may have been impacted, the data that may have been accessed, ECS’s process to inform affected customers, and steps to prevent the incident from happening again as appropriate.

In the unlikely event of an unauthorized disclosure of Data, ECS has implemented a process for responding to incidents and notifying affected individuals and, if applicable, law enforcement personnel.

If you have any questions about security on our Services, you can contact us at CustomerCare@ECSLearn.com. 10

9. How can I opt-out of sharing, providing, or receiving certain information?

Providing Personal Information: You can always decline to share personal information with us, or even block all cookies. However, it is important to remember that many of ECS’s features may not be accessible, or may not function properly - for example, we may not be able to remember your language preferences for you.

10. How can I access and manage my personal information?

Email Communication: You can opt-out of receiving further communications by clicking the unsubscribe button at the bottom of an email. ECS may continue to send you Service-related emails, as we believe necessary to provide the Services. ECS will never email students.

You may be able to review the information you provided to us on a Service and make any desired changes to the information, or to the settings for your account on that Service, by logging in to your account for that Service and editing or deleting the information. Note that certain accounts may have limitations regarding the ability to delete information. Even after information is deleted, we may maintain it in backup or archive form unless you request permanent deletion or the account is terminated.

11. What communications will I receive from ECS and how do I limit them?

ECS may post notices on the homepage on any of the Services.

ECS may send adult users’ information by email. You may choose to stop receiving certain emails from ECS by using the unsubscribe button at the bottom of the ECS email. However, we reserve the right to send you information on our behalf and on behalf of third parties in connection with providing the Services. If you no longer want to receive information from us, you will need to close your account for that Service.

11

12. How do I close my account?

If you have a consumer account and you wish to close your account with one of our Services, please contact us, and we will remove your Personal Information and Profile, if applicable, from the active databases for the Service(s) you request. Please let us know which Service(s) you wish to close and, if applicable, send your request using an email account that you have registered with ECS under your name. You typically will receive a response to a request sent to this account within five business days of our receiving it.

If you have an account through a school, the school can request that the information be deleted. If a student is no longer enrolled in the school or class using the Services, a parent may request deletion. For students who are currently enrolled, the request must come from the school to ensure that graded material is not deleted.

13. How long does ECS keep my information?

Upon termination of your Account, ECS will take commercially reasonable steps to delete any Personal Information, excluding information relating to messages you sent to active users, from our live databases in a reasonable amount of time. You understand and agree that ECS may continue to have Personal Information in archive files or similar databases. You further agree that ECS has no obligation to delete aggregated or de- identified information. ECS may retain and use aggregated and de-identified information for any purpose consistent with laws and regulations. For our STAAR MASTER Services, hard copies of invoices are stored for 7 years, then they are recycled. Credit card information is shredded once payment has been processed and applied to the customer’s transaction.

Even if your account is closed, information may remain in backup or archive records and we may retain certain data relevant to preventing fraud or future abuse or for legitimate business purposes, such as analysis of aggregated, non-personally identifiable or de-identified data, account recovery or if required by law. All retained data will continue to be subject to the applicable privacy policy for the Service.

14. How will ECS notify me of changes to this policy?

We will notify you of material changes to the Privacy Policy on our Website and/or by email, and may make additional efforts to notify customers of material changes that impact the treatment of data collected through our Services.

12

ECS may update this Privacy Policy at any time and any changes will be effective upon posting. Upon any update, the date at the top of this policy will be updated. In the event that there are material changes to the way we treat your Personal Information, you are responsible for regularly reviewing this Privacy Policy and your ECS account for notice of such modifications. Your continued use of the Services following an update to this Privacy Policy will constitute your acceptance of the updated Privacy Policy.

15. What if I don’t live in the U.S.?

Consent to Transfer

The Services are operated in the United States. If you are located outside of the United States, please be aware that information we collect will be transferred to and processed in the United States. Support information is stored in the United States, but if a User emails one of our support technicians directly, emails may be routed through servers in India. By using the Services, or providing us with any information, you fully understand and unambiguously consent to this transfer, processing and storage of your information in the United States, a jurisdiction in which the privacy laws may not be as comprehensive as those in the country where you reside and/or are a citizen.

Important Information for Users in the European Economic Area

The following information only applies to users in the European Economic Area (EEA), provided that we are the controller of your personal information as described below.

Controller

If you use the Services through your employer, school or another organization, that organization is the controller of your personal information and all questions or requests regarding your rights under European data protection legislation (including the rights described under Your rights below) or the processing of your personal information, should be directed to the organization. ECS is the organization’s processor and uses your personal information only as instructed by the organization and to the extent necessary to comply with applicable law.

If you do not use the Services through an organization, ECS is the controller of your personal information and can be reached using the contact details in “How can I contact ECS with questions” section.

Legal bases for processing

We process your personal information on the following legal bases:

13

Processing purpose (click link for details)

Legal basis

To provide the Services.

Processing is necessary to perform the contract governing our provision of the Services or to take steps that you request prior to requesting the Services.

To operate the websites.
To send marketing communications.
To create anonymous data for analytics.
For compliance, fraud prevention, and safety.

These processing activities constitute our legitimate interests. We consider and balance the potential impact on our rights before we process your personal information for our legitimate interests. We do not use your personal information for activities where your data protection interests override these legitimate interests (unless we have your consent or are otherwise required or permitted to by law).

To comply with law With your consent

Cross-border data transfer

Processing is necessary to comply with our legal obligations.

Processing is based on your consent. Where we rely on your consent you have the right to withdraw it anytime in the manner indicated at the time consent is requested.

Whenever we transfer your personal information out of the European Economic Area (“EEA”) to countries not deemed by the European Commission to provide an adequate level of personal information protection, the transfer will be based on safeguards that allow us to conduct the transfer in accordance with the EEA’s data protection laws. Such safeguards may include applying the European Commission model contracts for the transfer of personal data to third countries described here. Please contact us for further information about any such transfers or the specific safeguards applied.

Your rights

You may ask us to take the following actions in relation to your personal information that we hold:

Access. Provide you with information about our processing of your personal information and give you access to your personal information.

Correct. Update or correct inaccuracies in your personal information.

Delete. Delete your personal information.

Transfer. Transfer a machine-readable copy of your personal information to you or a third party of your choice.

Restrict. Restrict the processing of your personal information.

Object. Object to our reliance on our legitimate interests as the legal basis of our processing your personal information, where that processing adversely impacts your legal rights.

14

You may send us these requests by contacting us at CustomerCare@ecslearn.com. We may request information from you to help us confirm your identity and process your request. Applicable law may require or permit us to reject part or all of your request. If we reject your request, we will tell you why, subject to legal restrictions. If you would like to submit a complaint about our use of your personal information or response to your requests regarding your personal information, you may contact us or submit a complaint to the data protection regulator in your jurisdiction. You can find your data protection regulator here.

Retention

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including to continue providing the Services to active users you sent information to and for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements. In some circumstances we may anonymize your personal information (so that it can no longer be associated with you) in which case we may use this information indefinitely without further notice to you.

16. How can I contact ECS?

If you have questions or comments about this Privacy Policy, please contact us via email at CustomerCare@ECSLearn.com, by phone at 1-877-688-3224, or by mail at:
ECS Learning Systems
116 Kestrel Drive

Spring Branch, TX 78070

15