School Data Privacy Agreement

1. Purpose

This Data Privacy Agreement (“DPA”) sets out how we collect, use, store, and disclose student data and school staff data in connection with the MN School Dashboard (“Service”). It is incorporated by reference into the Master Service Agreement or Order Form between MNI and School.

2. Definitions

3. FERPA — School Official Designation

School designates MNI as a “school official” with a “legitimate educational interest” under 34 C.F.R. § 99.31(a)(1)(i)(B) for the limited purpose of operating the Service. MNI agrees to:

1. Use Student Data only to provide and improve the Service for School.
2. Not disclose Student Data to any third party except Sub-processors listed in Section 9 or as required by law.
3. Not use Student Data to build advertising profiles or to market products directly to students or families.
4. Return or securely delete Student Data within thirty (30) days of written request or termination (Section 10).
5. Maintain direct control over Student Data and not permit re-disclosure without School’s prior written consent.
6. Comply with all other conditions FERPA places on school officials.

4. COPPA — School Authorization for Under-13 Students

Where School’s student population includes children under 13, School provides operator authorization under 16 C.F.R. § 312.5(b)(1) for MNI to collect limited personal information from students solely for the educational purpose of operating the Service. MNI will:

1. Collect only the data types listed in Section 6 (Data Inventory) from students under 13.
2. Not condition participation on disclosure beyond what is necessary for the Service.
3. Not use information collected from under-13 students for any commercial purpose outside the educational context authorized by School.
4. Not disclose under-13 student data to third parties except Sub-processors listed in Section 9.

School represents that it has provided appropriate notice to parents and students to the extent required by its own policies and applicable law.

5. New York Education Law § 2-d

This section applies only when School is a New York educational agency subject to NY Ed Law § 2-d.

MNI acknowledges it is an “operator” under NY Ed Law § 2-d and agrees to:

1. Implement and maintain a data security program meeting the requirements of 8 N.Y.C.R.R. Part 121.
2. Not sell Student Data or use it for any commercial purpose outside the service described in this DPA.
3. Not disclose Student Data to third parties for advertising or to develop a personal profile for non-educational purposes.
4. Not use Student Data to engage in targeted advertising.
5. Maintain a public-facing data security and privacy policy consistent with this DPA.
6. Notify School within seven (7) calendar days of discovering a breach of Student Data (see Section 8).
7. Upon termination, delete or return all Student Data within the timeframe specified in Section 10.

6. Data Inventory

Data NOT collected: Social Security numbers · medical or health records · disciplinary records · financial information · biometric data · location data · parent or guardian contact information.

7. AI Boundaries

The MN School Dashboard AI support assistant answers teacher, counselor, and school admin questions about the dashboard and the MN framework only. It never receives student names, student IDs, or any personal student data. It does not train on School’s data, does not retain conversation history across sessions, and does not make placement, disciplinary, diagnostic, safety, or mental-health decisions. It escalates to human support when confidence is low or when questions involve student privacy, school policy, or high-stakes interpretation.

No other AI functionality processes School or student data without a DPA amendment and School’s prior written consent.

8. Security and Breach Notification

MNI maintains the following security controls: encryption in transit (TLS 1.2+) and at rest for Student Data; role-based access control with separate scopes for teacher, counselor, and school admin roles; session tokens never exposed in client-accessible storage; all school dashboard API responses served with Cache-Control: no-store; Cloudflare infrastructure with SOC 2-compliant sub-processors.

In the event of a confirmed breach of Student Data, MNI will:

1. Notify School’s designated privacy officer within seven (7) calendar days of confirmation.
2. Provide: nature of the breach, data categories affected, approximate number of students affected, steps taken to contain the breach, and a point of contact.
3. Cooperate with School’s investigation and any required notifications to parents, state agencies, or the U.S. Department of Education.

9. Sub-processors

MNI will notify School at least thirty (30) days before adding a new sub-processor that will process Student Data, giving School the right to object.

MNI requires each sub-processor that processes Student Data to be bound by written data protection terms that provide at least equivalent protections to those in this Agreement, including: (a) prohibition on use of Student Data for any purpose other than providing the contracted service; (b) prohibition on sale or disclosure of Student Data to unauthorized third parties; (c) security controls appropriate to the nature of the data; (d) breach notification obligations consistent with this Agreement; and (e) deletion of Student Data upon termination of the sub-processing relationship. MNI remains liable to School for any failure by a sub-processor to meet these obligations.

10. Data Return and Deletion

Upon expiration or termination of the Service, MNI will within thirty (30) days either return all Student Data to School in a standard export format (CSV or JSON) or securely delete it, at School’s election. Written confirmation of deletion is provided upon request.

De-identified, aggregated data may be retained for product improvement; individual records will not be retained.

School may request deletion of specific student records at any time during the term; MNI will complete deletion within fourteen (14) days of a verified written request.

11. School’s Obligations

1. Provision access only to staff who are Authorized Users with a legitimate educational interest.
2. Notify MNI promptly when an Authorized User’s access should be revoked (e.g., staff departure).
3. Ensure student self-ratings are collected with appropriate notice and assent consistent with School’s own policies.
4. Not use the Service to collect data beyond what is listed in Section 6 without a written amendment.
5. Not share MNI-provided student reports externally without confirming the report type has been privacy-reviewed for that purpose.

12. Term, Termination, and Survival

This DPA is effective as of the Effective Date and continues for the term of the Master Service Agreement. Sections 3, 4, 5, 6, 7, 8, 10, and 12 survive termination.

Either party may terminate this DPA with thirty (30) days’ written notice if the other party materially breaches its obligations and fails to cure within that period.

13. Governing Law

This DPA is governed by the laws of the State of New Jersey, without regard to conflict-of-law principles, except that Section 5 (NY Ed Law § 2-d) is governed by the laws of the State of New York with respect to New York-specific obligations.

14. Signatures

This agreement was prepared for pilot use with the MN School Dashboard v1. It is not a substitute for legal advice. MNI recommends review by qualified education-law counsel before execution with any district.