FERPA Compliance & Education Data Agreement

“Education Records” means records directly related to a student that are maintained by an educational agency or institution or by a party acting for the agency or institution, as defined under FERPA.

“Directory Information” means information contained in an education record that would not generally be considered harmful or an invasion of privacy if disclosed, as designated by the Institution.

“Legitimate Educational Interest” means access to education records is necessary to perform an institutional service or function for which the Provider has been designated as a school official.

“Personally Identifiable Information (PII)”includes direct identifiers such as a student's name or student ID number, as well as indirect identifiers and other information that could be used to identify a student.

Under this Agreement, the Provider is designated as a “school official” with “legitimate educational interests” under FERPA (34 CFR § 99.31(a)(1)) for the purpose of:

• Providing quiz and assessment services to the Institution
• Storing and processing student educational data
• Generating performance analytics and reports
• Supporting the Institution's educational mission

This Agreement covers the following types of education records processed through QuizMeBaby:

The Provider may use education records ONLY for:

• Providing the contracted quiz and assessment services
• Technical support and service improvement
• Generating reports for authorized Institution personnel
• Compliance with legal requirements

The Provider shall not disclose education records or PII to any third party except:

• To authorized sub-processors necessary for service delivery, who are bound by equivalent confidentiality obligations
• As directed by the Institution in writing
• As required by law, with prior notice to the Institution when permitted

Any permitted re-disclosure will include notification that the recipient may not further disclose the information without consent from the parent/eligible student.

The Provider maintains the following security measures to protect education records:

In the event of a security breach involving education records, the Provider will:

• Notify the Institution within 24 hours of discovering the breach
• Provide details of the records affected and scope of the breach
• Cooperate with the Institution's investigation and response
• Assist with required notifications to affected individuals
• Take immediate steps to mitigate the breach
• Document the breach and remediation actions

The Provider will support the Institution in fulfilling parent and eligible student rights under FERPA:

• Right to Inspect: Provide access to education records within 45 days of request
• Right to Amend: Process amendment requests through the Institution
• Right to Consent: Not disclose PII without proper consent except as permitted
• Right to File Complaint: Information about filing complaints with the Department of Education

Requests from parents or students should be directed to the Institution, which will coordinate with the Provider as needed.

Education records will be retained only as long as necessary for the educational purpose:

• Active student data: Duration of enrollment plus end of academic year
• Grade records: As directed by Institution (default 7 years)
• Assessment responses: 3 years unless otherwise specified

Upon termination of services:

• The Institution may request return of all education records in standard format
• All education records will be securely deleted within 60 days of termination
• Written certification of deletion provided upon request

The Institution retains the right to:

• Audit the Provider's FERPA compliance annually
• Request access logs for education records
• Review security measures and policies
• Inspect Sub-processor agreements related to education records

The Institution agrees to:

• Designate the Provider as a school official in its FERPA annual notification
• Ensure proper authorization before uploading student data
• Manage user access appropriately within the Institution
• Notify parents/students about the use of the service as required
• Direct FERPA-related requests from parents/students appropriately