Template: not legal advice. A starting point for agreements with schools and districts. Have an attorney review and adapt it before use. Many districts use their own state form (for example the Student Data Privacy Consortium National DPA); you can usually sign that instead. Delete this notice once reviewed.

Student Data Processing Agreement

This agreement is between [LEGAL BUSINESS NAME] ("Provider"), which operates DecodeDesk, and the school, district or organization named below ("School"). It covers student data the School's staff enter into DecodeDesk.

1. Definitions

• Student Data: any information about an identified or identifiable student that School users enter or that the service creates from it, including lesson results, assessments, notes and schedules.
• Education Records: as defined by the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, and 34 CFR Part 99.
• Subprocessor: a third party Provider uses to deliver the service, listed in the Trust Center.

2. Purpose and ownership

Student Data remains the property of, and under the control of, the School. Provider processes Student Data only to provide, maintain, secure and support DecodeDesk for the School, as directed by the School. For FERPA purposes, Provider acts as a school official with a legitimate educational interest, under the School's direct control over the use and maintenance of Education Records.

3. Prohibited uses

Provider will not: sell or rent Student Data; use it for targeted advertising; build profiles of students except to deliver the service; or disclose it except to Subprocessors needed for the service, as required by law, or as the School directs in writing.

4. Security

Provider maintains administrative, technical and physical safeguards appropriate to the sensitivity of Student Data, including: encryption in transit (TLS) and at rest (AES-256); role-based access; two-step sign-in available to all users and enforceable by the School's account owner; activity logging; encrypted, tested backups; and restricting Provider personnel access to what is needed to operate and support the service.

5. Subprocessors

Provider binds each Subprocessor to data-protection obligations at least as protective as this agreement and remains responsible for them. Provider will list Subprocessors in the Trust Center and notify the School of material changes [30] days in advance where practical. Optional features (AI help, Zoom, card payments) engage their Subprocessors only if the School turns them on.

6. Parent and student rights

Parents and eligible students may inspect and request correction of Education Records through the School. The School can view, export, correct and delete Student Data directly in DecodeDesk. Provider will help the School respond to such requests within [10] business days of being asked.

7. Data breach

If Provider confirms unauthorized access to Student Data, it will notify the School without undue delay, and no later than [72 hours] after confirmation, describing the incident, the data involved and the steps taken. It will also cooperate with any notifications the School must make under applicable law.

8. Retention, return and deletion

Student Data is kept while the School's account is active. The School may export it at any time. On termination, or on written request, Provider will delete Student Data within [30] days (after returning it, if asked). Deleted data leaves rolling encrypted backups within [14] days. Provider may keep de-identified, aggregate data that cannot reasonably be linked to a student or School.

9. Term and changes

This agreement lasts as long as the School uses DecodeDesk and survives until Student Data is deleted. Changes require written agreement of both parties. If this agreement conflicts with the Terms of Service, this agreement governs Student Data.

10. Governing law

This agreement is governed by the laws of [STATE], and by any student-privacy law that applies to the School.

Signatures

Contact: [PRIVACY EMAIL] · [MAILING ADDRESS] · Template version [DATE]