Data Processing Agreement
A Data Processing Agreement (DPA) is a contract between your school or district and Multiple Natures International, LLC that governs how student data is collected, stored, used, and protected. Many districts require a signed DPA before approving any third-party tool that handles student data.
What the DPA covers
Section titled “What the DPA covers”The DPA establishes:
- The legal basis for processing student data under FERPA
- What data is collected, for what purpose, and for how long it is retained
- Security measures in place to protect student data
- Restrictions on how the data may be used (no commercial sale, no AI training)
- Data breach notification obligations
- Student data deletion rights and procedures
- Sub-processor disclosures (third-party services used to operate the platform)
Who needs a DPA
Section titled “Who needs a DPA”Most districts with a formal vendor review process will require a signed DPA before the dashboard can be used with live student data. If you are unsure whether your district requires one, check with your district’s privacy officer, legal team, or technology director.
If your district is in a pilot or demo phase using only fictional data, a DPA may not be required until you move to live student data — but confirming this with your district’s legal team is advisable.
Requesting a DPA
Section titled “Requesting a DPA”To request a DPA:
- Email support@multiplenatures.com with the subject line DPA Request — [Your School/District Name]
- Include your school or district name and the name of the person authorized to sign agreements on behalf of the district
- We will send you the standard DPA for review within 2 business days
If your district uses its own standard DPA template, send it along and we will review it.
District-specific addenda
Section titled “District-specific addenda”Some districts require specific addenda — for example, New York’s NYSED Data Privacy Addendum, California’s SOPIPA addendum, or addenda specific to your state’s student data privacy laws. Contact support@multiplenatures.com and let us know what your district requires.
Data retention and deletion
Section titled “Data retention and deletion”Student data is retained for the duration of the school’s active account. When a school’s account is closed, student data is deleted within 30 days unless otherwise required by law or agreed in the DPA. Schools and districts may request data deletion at any time — contact support@multiplenatures.com.