Government & Education Data Processing Addendum

1. Applicability

This Addendum applies to organizations that are: (a) a government agency, municipality, county, special district, or public body subject to open meetings laws or public records laws; or (b) an educational institution subject to the Family Educational Rights and Privacy Act (FERPA) or equivalent state student privacy laws.

2. Data Ownership

The organization (“Controller”) retains full ownership of all data submitted to or generated within its Meeting Signup account, including all meeting records, attendee sign-up data, speaker lists, and audit logs. CommTrail, LLC acts solely as a data processor and has no ownership interest in any Controller data.

CommTrail will not use Controller data for any purpose other than delivering the Service, will not analyze or aggregate Controller data for commercial intelligence, and will not disclose Controller data to any third party except as necessary to deliver the Service (see Sub-processors in the DPA).

3. Public Records and Open Records Laws

The Controller acknowledges and agrees that:

• The Controller is the records custodian for all meeting and attendee data generated through the Service. The Controller is solely responsible for responding to public records requests, Freedom of Information Act (FOIA) requests, state open records law requests, and similar requests directed to the Controller.
• CommTrail will cooperate with the Controller in responding to such requests. Upon written request, CommTrail will provide a complete data export of the requested records within five (5) business days.
• CommTrail is not a government agency and is not independently subject to FOIA or state open records laws. Requests for CommTrail records should be directed to the Controller, not to CommTrail.
• Speaker sign-up lists, attendee names, and public comment topics submitted through the Service may constitute public records subject to disclosure under applicable law. The Controller is responsible for making that determination and handling any required disclosures.

4. FERPA and Student Privacy

Meeting Signup is designed for managing public meeting speaker lists, not for managing student records. The following clarifications apply to educational institutions:

• Names and public comment topics submitted by members of the public through the public signup form are not “education records” as defined by FERPA. They are records of public participation at a public meeting.
• CommTrail does not knowingly collect information about students in their capacity as students. The public signup form does not collect student IDs, grades, disciplinary records, or any other information that would constitute an education record under FERPA.
• If an educational institution uses Meeting Signup in a context where attendees may include students, and if the institution has reason to believe that submissions may contain FERPA-protected information, the institution is responsible for providing appropriate notice to those attendees and for handling any resulting FERPA obligations.
• CommTrail is not a “school official” under FERPA and does not act in a capacity involving access to education records on behalf of the institution.

5. Data Residency

All data submitted to or generated within a Meeting Signup account is stored and processed exclusively within the United States. Specifically:

• Application servers: Microsoft Azure, United States regions
• Database: Supabase on AWS US East (Virginia)
• Email delivery: Microsoft Azure Communication Services, United States

CommTrail does not transfer, replicate, or store data in jurisdictions outside the United States.

6. Data Deletion on Account Closure

Upon termination of a Controller’s account, whether by the Controller or by CommTrail:

• The Controller may export all meeting and attendee records in CSV format prior to account closure
• CommTrail will provide a full data export upon written request within five (5) business days
• All Controller data will be deleted from active systems within thirty (30) days of account closure
• Backup copies will be purged within ninety (90) days of account closure
• CommTrail will provide written confirmation of deletion upon written request

Retention for legal hold: If the Controller has placed any data on legal hold or has pending litigation, public records requests, or audits that require retention, the Controller must notify CommTrail in writing before account closure. CommTrail will work with the Controller to preserve required records.

7. Audit Rights

Upon written request, CommTrail will provide the Controller with documentation of its security practices, sub-processor agreements, and data handling procedures. Formal on-site audits are not available at this time; documentation audits (review of this Addendum, the DPA, the Security Self-Assessment, and the Security Attestation Letter) are available at no charge.

8. Governing Law

This Addendum is governed by the laws of the State of Wyoming, United States, without regard to conflict of law principles. Nothing in this Addendum limits any rights or obligations the Controller may have under applicable federal or state law.

9. Dispute Resolution

Notwithstanding the arbitration and dispute resolution provisions in the Terms of Service, government entities may elect to resolve disputes through applicable state or local law and courts of competent jurisdiction in lieu of mandatory arbitration. Government entities that wish to elect this option should notify CommTrail LLC in writing at legal@commtrail.com prior to initiating any dispute proceeding.

10. Contact

For questions about this Addendum, to request a countersigned copy, or to discuss procurement requirements, contact: legal@commtrail.com

CommTrail, LLC · Sheridan, Wyoming 82801