Data Processing Agreement and FERPA Addendum
This Data Processing Agreement and FERPA Addendum (the “Agreement”) is entered into by and between [INSTITUTION NAME] (the “Institution”) and [LEGAL ENTITY NAME] (“Dexter”), effective as of [DATE] (the “Effective Date”). It governs Dexter’s handling of student data in connection with the Dexter application (the “Service”).
Recitals
The Institution wishes to make the Service available to its students. In providing the Service, Dexter will access and process student education records maintained by the Institution’s learning management system (Canvas). The parties enter into this Agreement to establish the terms on which Dexter processes such data and to designate Dexter as a “school official” under the Family Educational Rights and Privacy Act (“FERPA”).
1. Definitions
“Education Records” has the meaning given in FERPA (20 U.S.C. § 1232g; 34 CFR Part 99).
“Student Data” means any Education Records and other personally identifiable information about a student that Dexter accesses, receives, or processes to provide the Service.
“Process” means any operation performed on Student Data, including access, collection, use, storage, disclosure, and deletion.
“Subprocessor” means a third party engaged by Dexter to Process Student Data.
“School Official” has the meaning given under FERPA and its implementing regulations.
2. Roles and scope
The Institution owns and controls the Student Data. Dexter Processes Student Data solely on behalf of, and under the direction of, the Institution to provide the Service. Dexter does not acquire any ownership interest in Student Data.
3. FERPA — School Official designation
The Institution designates Dexter as a School Official with a legitimate educational interest in the Student Data to the extent necessary to provide the Service, under the exception at 34 CFR § 99.31(a)(1)(i)(B).
Dexter (i) performs an institutional service or function for which the Institution would otherwise use its own employees; (ii) is under the direct control of the Institution with respect to the use and maintenance of Education Records; and (iii) uses Education Records only for the purposes for which the disclosure was made and does not re-disclose them to any other party without the Institution’s authorization, except as permitted by FERPA.
Dexter complies with the use and re-disclosure limitations of 34 CFR § 99.33(a).
4. Permitted use
Dexter Processes Student Data only to provide, maintain, secure, and improve the Service as directed by the Institution and described in the Dexter Privacy Policy. Dexter does not Process Student Data for any other purpose, including advertising or the creation of user profiles unrelated to the Service.
5. No sale; no advertising; no model training on Student Data
Dexter does not sell Student Data and does not use it for targeted advertising. Dexter does not use Student Data, and does not permit any Subprocessor to use Student Data, to train, fine-tune, or otherwise develop general-purpose artificial-intelligence or machine-learning models. Use of AI providers to generate a student’s own responses is limited as described in Section 9.
6. Confidentiality
Dexter keeps Student Data confidential and limits access to personnel and Subprocessors who need it to provide the Service and who are bound by confidentiality obligations.
7. Security safeguards
Dexter maintains administrative, technical, and physical safeguards appropriate to the sensitivity of Student Data, including: encryption in transit (TLS 1.2+) and at rest (AES-256); read-only integration with Canvas via OAuth with tokens held in a server-side vault (no student passwords stored); per-user data isolation with server-enforced identity checks; access controls limiting production data to authorized personnel; and logging of access to systems and data. The Service is hosted on Google Cloud Platform, which maintains SOC 2, SOC 3, and ISO 27001/27017/27018 certifications.
8. Subprocessors
The Institution authorizes Dexter to engage the Subprocessors listed in Exhibit B.
Dexter imposes data-protection obligations on each Subprocessor consistent with this Agreement and remains responsible for their performance.
Dexter will provide notice of any new Subprocessor that Processes Student Data and give the Institution a reasonable opportunity to object.
9. Artificial-intelligence providers
To generate coaching content and answer a student’s questions, Dexter transmits relevant course context drawn from the student’s own materials to the AI provider(s) listed in Exhibit B. Dexter engages such providers under business/API terms that prohibit use of the transmitted content to train the provider’s models and that provide for zero or limited retention. Dexter will make the applicable provider terms available to the Institution on request.
10. Incident and breach notification
Dexter will notify the Institution without undue delay, and in any event within 72 hours, after confirming a security incident that results in the unauthorized access to or disclosure of Student Data. The notice will describe the nature of the incident, the Student Data involved, and the measures taken to address it. Dexter will cooperate with the Institution’s investigation and any notification obligations the Institution may have.
11. Data retention, return, and destruction
Dexter retains Student Data only as long as needed to provide the Service. On expiration or termination of this Agreement, or on the Institution’s written request, Dexter will return and/or securely delete Student Data within 30 days, except where retention is required by law, and will confirm deletion on request.
12. Student rights
Dexter will assist the Institution in responding to student requests to access, correct, or delete Education Records, consistent with FERPA and the Institution’s policies.
13. Audit and compliance
On reasonable request and notice, Dexter will provide information reasonably necessary to demonstrate compliance with this Agreement, including its completed HECVAT and a description of its security practices.
14. Term and termination
This Agreement remains in effect for as long as Dexter Processes Student Data for the Institution. Either party may terminate as set out in the underlying service agreement or on 30 days’ written notice. Sections concerning confidentiality, security, breach notification, and data return/destruction survive termination.
15. Miscellaneous
This Agreement is governed by the laws of [STATE/JURISDICTION]. It may be amended only in a writing signed by both parties. If any provision conflicts with FERPA, FERPA controls. This Agreement, together with the underlying service agreement, is the entire agreement of the parties regarding the Processing of Student Data.
Signatures
[INSTITUTION NAME]
By: ______________________________
Name: [NAME]
Title: [TITLE]
Date: ______________
[LEGAL ENTITY NAME] (Dexter)
By: ______________________________
Name: [NAME]
Title: [TITLE]
Date: ______________
Exhibit A — Description of Processing
Subject matter: provision of the Dexter academic-coaching Service to the Institution’s students.
Duration: the term of the Agreement.
Nature and purpose: reading the student’s Canvas data to surface deadlines, flag submission issues, help the student prepare for assessments, and answer questions grounded in the student’s own course materials.
Categories of data subjects: the Institution’s students who choose to use the Service.
Categories of Student Data: identity and enrollment (name, Canvas and institution identifiers, institutional email/login, courses); coursework (assignments, quizzes/exams, due dates, grades and submission status, syllabi, course materials, announcements, calendar); message metadata; and student-provided content (preferences, chat, questions to the assistant).
Exhibit B — Subprocessors
Google LLC (Google Cloud Platform / Firebase) — hosting, database, storage, and compute; United States. Google Cloud Data Processing Addendum applies.
[AI PROVIDER 1] — generation of coaching responses; [region]; engaged under [terms]. [CONFIRM]
[AI PROVIDER 2, if any] — [purpose]; [region]; [terms]. [CONFIRM]
List all AI providers to which Student Data is transmitted, with each provider’s data-retention and no-training terms confirmed.
This is a working draft prepared for institutional review. It is not legal advice and should be reviewed and finalized by legal counsel before signature. Institutions may prefer to use their own DPA or the SDPC data privacy agreement; this draft is written to be compatible with that approach.