Data Processing Agreement Requests

A Data Processing Agreement, often called a “DPA,” is a written agreement between an educational technology provider and a school, district, or authorized educational institution.

A DPA usually explains how student-related information may be collected, used, protected, retained, and deleted when a school uses an educational technology service.

Depending on the school or district, a DPA may also be called a:

• Student Data Privacy Agreement;
• Student Data Protection Agreement;
• Data Privacy Agreement;
• School Service Provider Agreement;
• Vendor Privacy Addendum; or
• District Data Agreement.

Your school or district may require a DPA before using Grade Harbor if required by:

• District procurement rules;
• School board policy;
• State student privacy laws;
• A district technology approval process;
• A school or district legal review;
• A vendor privacy review;
• A security review; or
• A state or regional student data privacy program.

If you are a teacher interested in using Grade Harbor, we recommend checking with your school or district before uploading student work or student-related information.

When a school or district requests a DPA, Grade Harbor will work through the request in a practical review process.

Our process generally includes:

1. Reviewing the school or district request
   We will review the school or district's privacy, security, procurement, or legal requirements.
2. Reviewing the required template
   If your district has its own DPA, privacy addendum, security questionnaire, or vendor form, we will review it.
3. Providing Grade Harbor information
   We can provide information about Grade Harbor's student data practices, privacy policy, security approach, AI use, data retention, and deletion process.
4. Discussing edits if needed
   If a submitted template contains terms that need clarification or adjustment, we will work with the school or district to review those items.
5. Completing the agreement when appropriate
   Once the terms are reviewed and acceptable, Grade Harbor can complete the DPA or related privacy documentation with the school or district.

A school or district DPA review may cover topics such as:

• What student-related information Grade Harbor processes;
• The educational purpose of the Service;
• How Student Data is used;
• Restrictions on selling or renting Student Data;
• Restrictions on advertising use;
• Restrictions on AI model training;
• Data security safeguards;
• Data retention and deletion;
• Breach or security incident notification;
• Service providers used to operate the Service;
• Parent, guardian, or eligible student data requests;
• State-specific student privacy requirements; and
• The relationship between the DPA, Privacy Policy, Terms of Service, and school agreement.

The exact review process may vary by school, district, and state.

To request a DPA review, please use the form below. Please provide:

• School or district name;
• Primary contact name and work email address;
• District name, if the school is part of a larger district (optional);
• In the notes field, any additional context that may help us review your request, including your state, whether the request is for an individual teacher, school, district, or pilot, any procurement deadline, and any state-specific requirements we should know about.

If your district requires a specific DPA template, privacy addendum, security questionnaire, or vendor registration form, please describe it in the notes field. After you submit your request, we will follow up by email to coordinate receiving and reviewing any required documents.

If you are a teacher, you may also include the name of the school or district contact who manages edtech approvals, privacy reviews, or procurement in the notes field.