Our standard agreement
TPA Ventures signs the Student Data Privacy Consortium (SDPC) National Data Privacy Agreement in the version your state alliance has adopted (NDPA v1 or v2), including state-specific Exhibit G terms. We also sign state-specific agreements such as the California Student Data Privacy Agreement where a state alliance uses its own form.
Where a School has already signed an NDPA with TPA Ventures, other Schools in the same state may adopt it through Exhibit E, the General Offer of Terms, without renegotiation.
Data categories
Exhibit B of our NDPA lists the categories we process: student identifiers, enrollment, demographics needed for reporting, assessment results, special education records (evaluations, IEPs, progress data), and staff names and roles. We do not collect student biometric data, geolocation or social media information.
Use restrictions
Student data is used only to provide the contracted service. No sale, no targeted advertising, no non-educational profiles, and no AI model training. De-identified data is used only for product improvement and research under the NDPA's de-identification and no-re-identification terms, and only if the School has not opted out.
Security requirements
We maintain administrative, physical and technical safeguards aligned with the NIST Cybersecurity Framework, a current SOC 2 Type II report, annual penetration testing, encryption in transit and at rest, and U.S.-only hosting. Exhibit F records our security framework.
Subprocessors
We bind every subprocessor to written terms at least as protective as the NDPA and publish the current list on our Subprocessors page. Schools receive at least 30 days' notice before a new subprocessor that handles student data is added.
Return and deletion
On termination, or earlier at the School's written request, we return student data in a commonly used format and then delete it, providing written certification. The School may use Exhibit D, the Directive for Disposition of Data, to specify timing.
Requesting an agreement
Send your district's DPA or a request for our pre-signed NDPA to legal@tpaventures.si. Our legal team typically returns a signed agreement within 10 business days.