FERPA & Student Data Protection Policy

1. FERPA COMPLIANCE COMMITMENT

AccessStudents is committed to full compliance with the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, which protects the privacy of student education records.

2. DEFINITIONS

• Personally Identifiable Information (PII): Name, address, phone, email, ID number, and any information that directly identifies a student
• Educational Records: Records directly related to a student maintained by an educational institution (transcripts, grades, GPA, enrollment status)
• Directory Information: Information that can be disclosed without consent (name, major, dates of attendance, degrees—if school designates)
• Authorized School Official: Administrator, teacher, or staff with legitimate educational interest in student records

3. WHAT CONSTITUTES EDUCATIONAL RECORDS

Under FERPA, the following are protected educational records:

• Official transcripts and academic records
• Grade point average (GPA) and test scores
• Enrollment status and class year
• Degree and major information
• Academic honors and awards
• Disciplinary records (if maintained by school)
• Special education records
• Financial aid records
• Any personally identifiable information from educational records

4. STUDENT RIGHTS UNDER FERPA

• Right to Inspect: Students 18+ can inspect and review their educational records
• Right to Request Copies: Students can request certified copies of records
• Right to Amend: Students can request correction of inaccurate information
• Right to Consent: Students control disclosure of educational records (with exceptions)
• Right to File Complaints: Students can file complaints with the U.S. Department of Education
• Right to Opt-Out of Directory Information Disclosure (if school provides option)

5. HOW ACCESSSTUDENTS ACCESSES EDUCATIONAL DATA

5.1 With Student Consent

• Students voluntarily provide transcript information to AccessStudents
• Students authorize credential verification from schools
• Students control what academic information appears on their profile
• Students can request removal of educational data anytime

5.2 Through School Partnerships

• Schools authorize data sharing through institutional agreements
• Data is provided for legitimate educational and career development purposes
• School officials maintain oversight of student data access
• AccessStudents acts as a "school official with legitimate educational interest"

5.3 Student Consent Requirements

• Students must explicitly consent to share their educational records
• Consent must specify what data is shared and with whom
• Consent is voluntary and can be withdrawn anytime
• AccessStudents does not require educational data to operate basic services

6. HOW ACCESSSTUDENTS PROTECTS EDUCATIONAL DATA

• Access Controls: Only authorized school officials and support staff can access educational records
• Encryption: All educational data encrypted in transit (SSL/TLS) and at rest (AES-256)
• Audit Logging: All access to educational records is logged and monitored
• Data Segregation: Educational data is stored separately from other profile information
• Limited Retention: Educational data is not retained longer than necessary
• No Secondary Use: Educational records are not used for marketing or unrelated purposes

7. DIRECTORY INFORMATION HANDLING

AccessStudents treats the following as directory information (only if school authorizes):

• Student name
• School name and location
• Major and degree
• Dates of attendance and graduation

Directory information can be displayed on student profiles unless the student or parent opts out.

8. TRANSCRIPT VERIFICATION PROCESS

• Student Initiates: Student requests transcript verification from school
• School Validation: Official school representative confirms student identity and records
• Verification Badge: School confirms "GPA Verified" or similar badge on student profile
• Data Protection: Only verification status is displayed; actual GPA details controlled by student
• Student Control: Students can choose to hide or display verified information
• No Retention of Confidential Details: AccessStudents does not store confidential elements of transcripts

9. SCHOOL PARTNERSHIP RESPONSIBILITIES

Schools that partner with AccessStudents must:

• Obtain proper student/parent consent before sharing educational data
• Maintain oversight of which student records are shared
• Comply with all state and federal education privacy laws
• Designate authorized officials who can manage student data access
• Ensure students understand how their data is used
• Respect student requests to limit or delete educational data
• Comply with AccessStudents Data Processing Agreement

10. STUDENT ACCESS TO THEIR EDUCATIONAL RECORDS

• Review: Students can review what educational data AccessStudents holds
• Request Copy: Students can request a copy in digital format
• Challenge Accuracy: Students can request correction of inaccurate information
• View Access Log: Students can see who has accessed their educational records on AccessStudents
• To submit requests: education@myaccessstudents.com

11. DELETION OF EDUCATIONAL RECORDS

• Students can request deletion of educational data from AccessStudents
• AccessStudents will remove all educational records within 30 days
• This does not affect records maintained by the school
• Deletion requests must come from the student or authorized parent/guardian
• See Data Retention & Deletion Policy for detailed procedures

12. WHAT ACCESSSTUDENTS DOES NOT DO WITH EDUCATIONAL DATA

• Does not sell educational records to third parties
• Does not use educational data for marketing purposes
• Does not share educational data with employers without explicit consent
• Does not use educational data to train commercial AI models (unless anonymized)
• Does not disclose records to law enforcement without proper warrant
• Does not require students to share educational records to use the Platform

13. EMPLOYER ACCESS TO EDUCATIONAL DATA

• With Consent Only: Employers only see educational data if student explicitly permits
• Limited Visibility: Students can choose to share only specific information (e.g., degree but not GPA)
• Employers Agree: Employers must agree not to re-disclose or misuse educational data
• Student Control: Students can revoke employer access anytime

14. PARENTAL ACCESS (DEPENDENT STUDENTS)

• Students under 18 or claimed as dependents may need parental consent to share educational data
• Parents can request to see what educational data their student has shared
• Schools inform parents of FERPA rights during enrollment
• See Minor Student & Parent Consent Policy for details

15. FERPA VIOLATIONS & REMEDIES

If you believe AccessStudents has violated FERPA, you can:

• Contact AccessStudents: education@myaccessstudents.com
• File Complaint with School: School must investigate FERPA violations
• File Complaint with U.S. Department of Education:
• Family Policy Compliance Office
• U.S. Department of Education
• 400 Maryland Ave SW | Washington, DC 20202

16. MINORS & COPPA COMPLIANCE

• Students under 13 cannot create accounts (COPPA compliance)
• High school students (13-18) need parental consent and school authorization
• Schools must opt-in to share educational records of minor students
• See Minor Student & Parent Consent Policy

17. DATA PROCESSING AGREEMENT

Schools entering into data sharing agreements with AccessStudents must execute a Data Processing Agreement that covers:

• Data security and protection requirements
• Limited use and non-disclosure obligations
• Compliance with FERPA, state laws, and regulations
• Student and parent rights
• Breach notification procedures
• Data deletion and return upon termination

18. CONTACT & SUPPORT

For FERPA-related questions: education@myaccessstudents.com

For legal compliance questions: legal@myaccessstudents.com

AccessStudents is committed to protecting student educational records and maintaining full FERPA compliance. We recognize that educational data is sensitive and must be handled with the highest standards of care and confidentiality.