Student Data Addendum

Summary

Offload offers a student data addendum for school customers that need written privacy and security commitments for pupil records.

This page is a public summary of our default posture. If a signed addendum or customer agreement conflicts with this summary, the signed agreement controls.

School Control of Records

• Pupil records remain the property of and under the control of the school or local educational agency.
• Offload uses school-provided records only to provide and support the contracted service, plus limited uses otherwise required or permitted by law and contract.
• Where applicable, Offload supports school-directed workflows for access, correction, export, return, and deletion.

Use Restrictions

• No targeted advertising using pupil records.
• No sale of pupil information provided for K-12 school purposes.
• No use of school-provided records for purposes outside the school-directed service relationship, except as allowed for deidentified or aggregated improvement work where permitted.

Security and Confidentiality

• Offload applies reasonable administrative, technical, and organizational safeguards designed to protect records from unauthorized access, use, disclosure, modification, or destruction.
• Access inside the product is role-based, school-scoped, and audit-sensitive workflows are logged in key areas.
• Service providers that help Offload deliver the service are expected to handle data only for permitted service purposes and under written restrictions.

Parent and Eligible Student Requests

Schools remain the primary contact for education-record requests because schools control the records and determine how they should be reviewed or corrected under their legal obligations.

If Offload receives a direct request for a school-controlled record, we may route that request to the school or respond in coordination with the school, depending on the request type and applicable law.

Incident Response

If Offload confirms an unauthorized disclosure or security incident affecting school-controlled records, we will work under the signed agreement and applicable law to notify the school, support investigation, and coordinate remediation steps.

Return and Deletion

The signed customer agreement or addendum should define the return and deletion process, including timing, scope, and any legally required retention or backup constraints.

Schools that need a signed student data addendum or DPA can request it through our contact page.