Skip

Forum

Welcome to the REF forum!

Notifications

Clear all

Topic Tags

No tags found

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed

Press Enter To Begin Your Search

Terms of Service & Privacy

Terms of Service (TOS) & Privacy

Review of this document is recommended in an effort for Rebuilding Educational Foundations to practice the recommendations below in an effort that will best protect student privacy. Schools and districts should exercise diligence and assure this agreement meets established school and district policies for evaluating and approving online educational services and mobile applications. This will ensure that the service supports the school’s broader mission and goals, and that the Terms of Service (TOS) is legally appropriate and compatible with the school’s policies and procedures. This agreement exists to explicitly describe how Rebuilding Educational Foundations may use and share student data.

Definition of Data

All Personally Identifiable Information (PII) and other non-public information. Data include, but are not limited to, student data, metadata, and user content.

Data De-identification

De-identified data will be utilized for product development, research, or other purposes. De-identified data will have all direct and indirect personal identifiers removed. This includes, but is not limited to, name, ID numbers, demographic information, and location information. Furthermore, Rebuilding Educational Foundations agrees not to attempt to re-identify de-identified data and not to transfer de-identified data to any party.

Marketing and Advertising

Rebuilding Educational Foundations will not use any data to advertise or market to students or their parents. Advertising or marketing may be directed to the school/district only if student information is properly de-identified.

Modification of Terms of Service

Rebuilding Educational Foundations will not change how data are collected, used, or shared under the terms of this agreement in any way without advance notice to and consent from the school/district.

Data Collection

Rebuilding Educational Foundations will only collect data necessary to fulfill its duties as outlined in this agreement.

Data Use

Rebuilding Educational Foundations will use data only for the purpose of fulfilling its duties and providing services under this agreement, and for improving services under this agreement.

Data Mining

Rebuilding Educational Foundations is prohibited from mining data for any purposes other than those agreed to by the parties. Data mining or scanning of user content for the purpose of advertising or marketing to students or their parents is prohibited.

Data Sharing

Data may not be shared with any additional parties without prior written consent of the user except as required by law.

Data Transfer or Destruction

Rebuilding Educational Foundations will ensure that all data in its possession and in the possession of any subcontractors, or agents to which the provider may have transferred data, are destroyed or transferred to the school/district when the data are no longer needed for their specified purpose, at the request of the school/district.

Rights and License in and to Data

All parties agree that Rebuilding Educational Foundations has limited, nonexclusive license solely for the purpose of performing its obligations as outlined in this agreement. The agreement does not give Rebuilding Educational Foundations any rights, implied or otherwise, the right to sell or trade data.

Access

Any data held by Rebuilding Educational Foundations will be made available to the school/district upon request by the school/district in order to satisfy FERPA’s parental access requirement.

Security Controls

Rebuilding Educational Foundations will store and process data in accordance with industry best practices. This includes appropriate administrative, physical, and technical safeguards to secure data from unauthorized access, disclosure, and use. Rebuilding Educational Foundations will conduct periodic risk assessments and remediate any identified security vulnerabilities in a timely manner. Rebuilding Educational Foundations will also have a written incident response plan, to include prompt notification of the school/district in the event of a security or privacy incident, as well as best practices for responding to a breach of PII. This incident response plan will be available upon request.

Family Educational Rights and Privacy Act (FERPA)

Rebuilding Educational Foundations contractors will assure student personal identifying
information (PII) is:

Adequately protected once it is under their control. Comprehensive security
standards should protect the Rebuilding Educational Foundations electronic data systems. Standardized policies and procedures, including role-based access controls, are in place to mitigate data security risks.
Not disclosed to another party (except back to the school). Data must not be shared with unauthorized users, and must be safe from inadvertent disclosure due to careless handling.
Protected in public reporting. Appropriate disclosure avoidance techniques must be applied.
Not used for other purposes. The PII has been provided only to perform services in the contract. It must not be used for other purposes.
Destroyed by Rebuilding Educational Foundations on the agreed-upon date. FERPA requires data be destroyed when no longer needed for the specific purpose for which it was disclosed.

Individuals with Disabilities Act (IDEA) Parts B & C

Rebuilding Educational Foundations will follow and comply with applicable IDEA Part B
and Part C confidentiality provisions that are specifically related to children with disabilities receiving services under IDEA and provide protections beyond the FERPA
requirements. This includes:

Name of child, parent name, family member name(s);
Address of child;
Personal identifiers such as child’s social security number, student number,
biometric record; or
Other indirect identifiers such as place of birth, mother’s maiden name, list of
personal characteristics that would make it possible to identify the child with
reasonable certainty.

Resources

Family Policy Compliance Office, U.S. Department of Education: https://studentprivacy.ed.gov

FTC: Bureau of Consumer Protection Business Center, Complying with COPPA: Frequently Asked Questions: https://www.ftc.gov/tips-advice/business-center/guidance/complying-coppa-frequently-asked-questions

National Center for Education Statistics, Data Stewardship: Managing Personally Identifiable Information in Student Education Records (NCES 2011- 602): http://nces.ed.gov/pubsearch/pubsinfo.asp?pubid=2011602

National Institute of Standards and Technology, Guidelines on Security and Privacy in Public Cloud Computing (2011): http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-144.pdf

Privacy Technical Assistance Center, U.S. Department of Education: https://studentprivacy.ed.gov

Protecting Student Privacy While Using Online Educational Services: Requirements and Best Practices (2014): https://studentprivacy.ed.gov/resources/protecting-student-privacy-while-using-online-educational-services-requirements-and-best
Written Agreement Checklist (2012): https://studentprivacy.ed.gov/resources/written-agreement-checklist