FERPA & Student Data Addendum
Template addendum — review with counsel and use the NDPA v2.2 for executed district agreements.
1. School official designation
When a school or district uses Spectrum Hub to store student records, Spectrum Hub acts as a "school official" with a "legitimate educational interest" under FERPA (34 CFR § 99.31(a)(1)(i)(B)), performing services the school would otherwise use its own employees to perform. Spectrum Hub processes student records under the school's direct control.
2. Ownership and use of student data
- The school district owns all student records entered into the platform.
- Spectrum Hub uses student records only to provide the service to the district.
- We do not sell student data, advertise to students, profile students for non-educational purposes, or use student data to train AI models.
3. Data return and deletion
On contract termination or written request, Spectrum Hub will export student records to the district in a structured, machine-readable format and delete them from active systems within 30 days, and from backups within 90 days.
4. Parent access
Parents may request access to and correction of their child's records through the district. Spectrum Hub provides tools that let the district fulfill those requests directly.
5. Breach notification
Spectrum Hub will notify the district of a confirmed unauthorized disclosure of student records within 72 hours, with enough detail for the district to meet state breach-notification timelines (including New York Ed Law 2-d, Illinois SOPPA, California, Colorado, and Connecticut).
6. Subprocessors
Spectrum Hub uses subprocessors listed on the Security page and Exhibit E of the executed DPA. We provide 30 days' notice before adding a subprocessor that processes student records.
7. Security
Encryption in transit and at rest, role-based access control, row-level database security, audit logging, and annual security review. Details on the Security page.
8. Recommended executed agreement
For active district contracts, Spectrum Hub signs the National Data Privacy Agreement (NDPA) v2.2, which is recognized in most US states, plus state-specific exhibits where required.
9. Contact
District privacy contact: privacy@spectrumhubspace.org.