Free Preview: lessons 1 to 3 of every course and extra, in every grade. No account, no ads. See this year’s offers
Goal100™LEARNING
Legal center

School and District Data Privacy Agreement (Template)

Effective November 7, 2026 · Last updated November 7, 2026 · All legal documents

For New York school districts, BOCES and schools that want to use Goal100 with student accounts. Request a ready-to-sign copy through the Contact page.

The short version

  • This is Goal100's template Data Privacy Agreement (DPA) for New York schools and districts. It is not signed until both sides sign.
  • It covers New York Education Law § 2-d, 8 NYCRR Part 121, FERPA and COPPA.
  • The district owns its data. Goal100 uses it only to provide the service, never sells it, and never uses it for ads, marketing or AI training.
  • Breach notice to the district within 7 calendar days of discovery; Goal100 pays for required notifications it causes.
  • Exhibits: Parents' Bill of Rights (the district's), supplemental information, and Goal100's data security and privacy plan.
  • We use one standard data privacy agreement, based on NYSED's model, for every district; we don't negotiate separate custom agreements.

This summary helps you read the full text; the full text controls.

Contents
  1. Parties and purpose
  2. Definitions
  3. Ownership and control
  4. Permitted use; prohibited use
  5. Compliance with Education Law § 2-d and Part 121
  6. Subcontractors
  7. Breach and unauthorized release
  8. Parents' and eligible students' rights
  9. Return and deletion
  10. Audits and records
  11. Term, liability and law
  12. Exhibits
  13. Signatures

1. Parties and purpose

This Data Privacy Agreement (“DPA”) is between [District or school name], a New York educational agency (“District”), and ZAKAZIKY LLC, a New York limited liability company doing business as Goal100 Learning (“Contractor”). It applies to all Student Data and Teacher or Principal Data (together, “Protected Data”) that Contractor receives under the services agreement or purchase order dated [date] (the “Services Agreement”) for the Goal100 learning service (the “Services”). If this DPA conflicts with the Services Agreement, Contractor's Terms of Use or any other document, this DPA controls.

2. Definitions

Terms have the meanings in Education Law § 2-d and 8 NYCRR § 121.1, including “Student Data”, “Teacher or Principal Data”, “Personally Identifiable Information”, “Breach”, “Unauthorized Disclosure”, “Commercial or Marketing Purpose”, “Encryption” and “Third-Party Contractor”. “Education Records” has the meaning in FERPA (20 U.S.C. § 1232g; 34 CFR Part 99).

3. Ownership and control

Protected Data belongs to and remains under the control of the District (and, as the law provides, students and parents). Contractor acquires no rights in Protected Data other than the limited right to use it to provide the Services. For FERPA purposes, Contractor is a school official with a legitimate educational interest, performs an institutional service the District would otherwise use employees for, is under the District's direct control with respect to the use and maintenance of Education Records, and complies with 34 CFR § 99.33(a).

4. Permitted use; prohibited use

5. Compliance with Education Law § 2-d and Part 121

Contractor will comply with Education Law § 2-d, 8 NYCRR Part 121, FERPA, COPPA, the District's data security and privacy policy, and this DPA. Contractor will:

  1. limit internal access to Protected Data to employees and subcontractors who need it to provide the Services;
  2. ensure those people receive training on the federal and state laws governing confidentiality of such data before receiving access;
  3. not disclose Protected Data to any other party except (a) authorized subcontractors carrying out this DPA and bound by it, or (b) as required by statute or court order, with notice to the District no later than the time of disclosure unless the notice is expressly prohibited;
  4. maintain reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of Protected Data;
  5. use Encryption to protect Protected Data in motion and at rest;
  6. align its data security and privacy practices with the NIST Cybersecurity Framework referenced in 8 NYCRR § 121.5 (version 2.0); and
  7. store Protected Data only in the United States.

6. Subcontractors

Contractor will impose on each subcontractor that receives Protected Data written obligations at least as protective as this DPA, will remain responsible for its subcontractors, and will list them in Exhibit B. Contractor will give the District notice before adding a subcontractor that receives Protected Data.

7. Breach and unauthorized release

Contractor will notify the District of any Breach or Unauthorized Disclosure of Protected Data in the most expedient way possible and without unreasonable delay, and no more than seven (7) calendar days after discovery (8 NYCRR § 121.10(a)), with the information § 121.10(g) lists, to the extent known. Contractor will cooperate with the District and law enforcement, preserve evidence, and pay for or promptly reimburse the District for the full cost of notifications required by law when the Breach is attributed to Contractor (§ 121.10(f)). The limitation of liability in any other document does not apply to these obligations.

8. Parents' and eligible students' rights

Contractor will help the District respond, within the time the law allows, to requests to inspect, review, correct or delete Protected Data. Requests made directly to Contractor will be referred to the District. Parents' complaints about possible breaches will be handled under the District's procedures and Part 121.

9. Return and deletion

When the Services Agreement ends, or earlier on the District's written request, Contractor will, at the District's choice, return Protected Data in a commonly used format (such as CSV) or transfer it to a successor contractor, and then securely delete or destroy all Protected Data in its possession (including copies held by subcontractors) within 60 days, with backups expiring within a further 35 days, and certify deletion in writing. Contractor may keep data that is de-identified so that it cannot reasonably be used to identify any person, only to improve the Services and never for any Commercial or Marketing Purpose.

10. Audits and records

On reasonable request, Contractor will provide the District with information reasonably needed to confirm compliance with this DPA (for example security questionnaires, policies and summaries of independent assessments), and will cooperate with the NYSED Chief Privacy Officer as Part 121 requires.

11. Term, liability and law

This DPA lasts as long as Contractor holds Protected Data. Contractor acknowledges the civil penalties and other remedies in Education Law § 2-d and 8 NYCRR § 121.11. Except for the obligations in Section 7 and liability that cannot be limited by law, each party's liability is as stated in the Services Agreement. This DPA is governed by New York law.

12. Exhibits

13. Signatures

District: ____________________ Name / Title: ____________________ Date: ________

ZAKAZIKY LLC (Goal100 Learning): ____________________ Name / Title: ____________________ Date: ________

Template only. It has no effect until signed by authorized representatives of both parties.

Laws and official sources referenced

Questions about this document: use the Contact page; we answer in writing. We post every change on this page with a new date.