FERPA Compliance & Data Privacy Agreement
Zeckout is built to support educational institutions' obligations under the Family Educational Rights and Privacy Act (FERPA). We act as a "school official" and process student data only on the institution's instructions.
Does Zeckout need a Data Privacy Agreement?
FERPA does not use the term "data disclosure agreement," but in practice, yes — educational institutions cannot lawfully share student personally identifiable information (PII) from education records with a vendor like Zeckout without a signed contract in place. This is typically called a Data Privacy Agreement (DPA) or FERPA addendum, and it is the mechanism by which the institution establishes the "direct control" required under FERPA's school official exception (34 CFR § 99.31(a)(1)(i)(B)).
Zeckout provides a standard DPA template ready for institutional review and signature. Procurement and compliance teams can request it at any time using the button above.
How Zeckout qualifies as a "school official"
Under the school official exception, an institution may disclose PII from education records to Zeckout without individual written consent when Zeckout:
- Performs a service that the institution would otherwise perform itself (equipment and space checkout management);
- Is under the direct control of the institution regarding the use and maintenance of the data;
- Uses the data only for the authorized purpose and does not re-disclose it; and
- Meets the criteria set forth in the institution's annual FERPA notification.
Our DPA formalizes each of these requirements. The institution remains responsible for listing Zeckout in its annual notification of FERPA rights where required.
What our DPA covers
Permitted use
Student data is used solely to provide the checkout and inventory service. We never use it for advertising, marketing, or our own independent purposes.
No re-disclosure
We will not share or sell FERPA-protected student data with third parties except as directed by the institution and permitted by FERPA.
Data return & destruction
Upon contract termination, the institution can export all data and request deletion. Our built-in compliance export and backup tools support this requirement.
Institutional access
We support an institution's obligation to produce a student's education records within 45 days of a request, via our data export and compliance features.
Security safeguards
Encrypted connections, role-based access control, and server-enforced tenant isolation protect student data against unauthorized access.
Audit & inspection
Institutions retain audit rights to confirm Zeckout's compliance with the terms of the DPA and applicable FERPA requirements.
Who is responsible for what
FERPA compliance is a shared responsibility. Zeckout provides the technical and contractual safeguards, while the institution retains control over who has access and how the service is configured.
The institution is responsible for:
- Determining whether Zeckout will be used with student PII and signing the DPA before disclosure;
- Including Zeckout in its annual FERPA notification where required;
- Controlling which staff and students have access to the system and their roles;
- Responding to parent and eligible-student record requests (Zeckout supports this via export tools);
- Ensuring its use of the Service complies with applicable state student privacy laws.
Zeckout is responsible for:
- Processing student data only as directed by the institution;
- Maintaining technical and organizational security safeguards;
- Not re-disclosing or repurposing student data;
- Returning or destroying data upon contract termination, on request.
Ready to review the DPA?
Our standard Data Privacy Agreement is available for your procurement and compliance teams. Request a copy and we'll send it over for review.
Request the DPAThis page is provided for informational purposes and does not constitute legal advice. Institutions should consult their own counsel for FERPA compliance.