FERPA Data Processing Addendum (Template)

This template addendum is for US educational institutions that use ɳSelf and need to comply with the Family Educational Rights and Privacy Act (FERPA).

1. Definitions

• "Education Records" means records directly related to a student maintained by an educational agency or institution, as defined by FERPA (20 U.S.C. 1232g).
• "School Official" means the educational institution using ɳSelf services.
• "Service Provider" means ɳSelf, Inc., acting as a processor of Education Records on behalf of the School Official.

2. Purpose

The Service Provider processes Education Records solely to provide the ɳSelf platform services as described in the service agreement. The Service Provider has a legitimate educational interest in accessing Education Records only as necessary to fulfill its contractual obligations.

3. Service Provider Obligations

• Use Education Records only for the purpose of providing the agreed services
• Not disclose Education Records to any third party except as required by law or as directed by the School Official
• Maintain appropriate administrative, technical, and physical safeguards
• Return or destroy all Education Records upon termination of the service agreement
• Cooperate with the School Official in responding to parent/student requests to inspect and review Education Records

4. School Official Obligations

• Maintain direct control over the use and maintenance of Education Records
• Ensure that the Service Provider's use complies with FERPA requirements
• Include the Service Provider in its annual FERPA notification to parents as a "school official" with a legitimate educational interest

5. Data Handling

For self-hosted ɳSelf instances, all Education Records remain on infrastructure controlled by the School Official. ɳSelf cloud services (plugin registry, license validation) do not receive or store Education Records.

6. Incident Response

In the event of a security breach involving Education Records, the Service Provider will notify the School Official within 72 hours and cooperate fully in the investigation and remediation.

7. Term and Termination

This addendum remains in effect for the duration of the service agreement. Upon termination, the Service Provider will delete all Education Records within 30 days and provide written certification of deletion.