FERPA Data Processing Agreement

This FERPA Data Processing Agreement ("Agreement") is between MyAttendanceTracker.com, LLC ("MyAT", "we", "us") and the teacher or educational institution ("School Official") who creates an account and uses the MyAttendanceTracker.com service ("Service"). By creating an account, the School Official agrees to the terms of this Agreement.

In this Agreement, "student education records" has the meaning given in the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, and its implementing regulations at 34 C.F.R. Part 99 ("FERPA").

1. Designation as School Official

MyAT operates as a school official with a legitimate educational interest under FERPA, as described in 34 C.F.R. § 99.31(a)(1)(i)(B). MyAT accesses student education records only under the direction and control of the School Official, and is subject to the same conditions governing the use and re-disclosure of education records that apply to other school officials under FERPA.

The School Official represents that they have the authority under applicable law to enter student education records into the Service, and that their use of the Service complies with FERPA and any other applicable state or federal student privacy laws.

2. Permitted Uses of Student Education Records

MyAT may access, store, and process student education records only for the following purposes:

  • Providing and supporting the features and functionality of the Service as directed by the School Official.
  • Maintaining, improving, and securing the technical infrastructure of the Service, in a manner that does not permit identification of individual students.
  • Complying with a legal obligation or responding to a lawful government order or legal process.

3. Prohibited Uses of Student Education Records

MyAT will not:

  • Sell student education records or student personal information to any third party.
  • Use student education records for advertising, behaviorally-targeted marketing, or any commercial purpose unrelated to providing the Service.
  • Build personal profiles of students for non-educational purposes.
  • Re-disclose student education records to any third party except as described in Section 4 (Sub-Processors) or as required by law.

4. Sub-Processors

MyAT uses the following third-party service providers ("sub-processors") that may have access to student education records as part of delivering the Service. Each sub-processor is bound by data protection obligations at least as restrictive as those in this Agreement:

  • DigitalOcean / Cloudways — Cloud hosting and infrastructure provider. All Service data, including student education records, is stored on servers operated by DigitalOcean via Cloudways. DigitalOcean is GDPR compliant and maintains industry-standard security controls.
  • Twilio — SMS and messaging provider. If the School Official uses the messaging features of the Service, student or guardian phone numbers may be transmitted to Twilio solely to deliver messages initiated by the School Official.

MyAT will not add new sub-processors that have access to student education records without updating this Agreement. The current version of this Agreement is always available at myattendancetracker.com/ferpa-agreement.

5. Data Security

MyAT will maintain reasonable and appropriate technical and organizational security measures designed to protect student education records against unauthorized access, disclosure, alteration, or destruction. These measures include:

  • Encryption of data in transit using TLS.
  • Encryption of data at rest.
  • Access controls limiting access to student education records to authorized MyAT personnel who require access to provide the Service.
  • Regular security reviews of infrastructure and application code.

6. Breach Notification

If MyAT becomes aware of a confirmed security breach that results in unauthorized access to, or disclosure of, student education records belonging to the School Official, MyAT will notify the School Official within 72 hours of confirming the breach. The notification will include, to the extent known at the time:

  • A description of what occurred and the categories of records affected.
  • The approximate date and time of the breach.
  • Steps MyAT is taking to contain the breach and prevent recurrence.
  • Recommended steps the School Official may wish to take.

The School Official is responsible for any notifications to parents, students, or regulatory authorities required by FERPA or other applicable law.

7. Data Retention and Deletion

MyAT will retain student education records only as long as necessary to provide the Service or as required by applicable law. Upon termination of the School Official's account, MyAT will retain the data for a grace period of 30 days to allow for reactivation or export, after which the data will be permanently deleted.

The School Official may request deletion of their student education records at any time by contacting MyAT using the contact information below. MyAT will fulfill deletion requests within 30 days of receiving the request. Deletion of student records within the Service may also be performed directly by the School Official at any time.

8. Data Export

The School Official may export their student education records from within the Service at any time using the export features provided. If the School Official requires a complete export of all their data (including data not directly accessible through the export features), they may submit a written request to MyAT. MyAT will provide the export within 14 business days of receiving the request, in a commonly used, machine-readable format (such as CSV).

9. Audit Rights

Upon reasonable written request, MyAT will provide the School Official with a written certification of its compliance with this Agreement. MyAT is not required to grant physical access to its systems or facilities in connection with an audit request.

10. Term

This Agreement is effective from the date the School Official creates an account with MyAT and remains in effect for the duration of the School Official's use of the Service. The obligations regarding prohibited uses, data deletion, and confidentiality survive termination of the Agreement.

11. Updates to This Agreement

MyAT may update this Agreement from time to time. We will notify School Officials of material changes by email or through the Service. Continued use of the Service after notice of an update constitutes acceptance of the revised Agreement. The current version is always available at myattendancetracker.com/ferpa-agreement.

12. Contact

For questions about this Agreement, data deletion requests, or data export requests, contact MyAT using our website contact form or by email at the address published on our website.

Last Updated: June 29, 2026

© 2026 MyAttendanceTracker. All Rights Reserved.