Legal
Data Processing Addendum
Version 2026.07 · Effective July 26, 2026
This document is a working draft pending review by legal counsel. It is provided for transparency and is not yet a binding agreement.
In plain language
For schools and agencies: our role as a service provider / school official under FERPA and state student-data laws.
This Data Processing Addendum (DPA) applies to school and agency customers and forms part of the agreement between the customer (the "institution") and Scoraide (operated by Venakan Info Solutions). It describes how we process student and staff personal data on the institution's behalf. Where this DPA conflicts with the Privacy Policy or Terms for that processing, this DPA controls.
Roles
The institution controls the student data and determines the purpose of processing. Scoraide processes that data only to provide the service and on the institution's documented instructions. Under the Family Educational Rights and Privacy Act (FERPA), Scoraide acts as a "school official" with a legitimate educational interest, performing a service the institution would otherwise perform itself, and remains under the institution's direct control with respect to the use and maintenance of education records. Scoraide does not re-disclose education records except as permitted by FERPA and this DPA.
Use and ownership of data
Student data remains the property of the institution and the student/parent as applicable. We use it only to deliver the service to the institution. We do not sell student data, do not use it for advertising, and do not use student responses to train third-party AI models. Aggregated or de-identified data may be used to operate and improve the service, without re-identification.
Security, subprocessors, and breach
We maintain administrative, technical, and physical safeguards including per-tenant row-level isolation, encryption in transit, and least-privilege access. We use the vendors listed on the Subprocessors page to process data under contract, and we will keep that list current. If we become aware of a breach of security leading to unauthorized access to student data, we will notify the institution without undue delay and cooperate with its notification obligations.
Access, correction, deletion, and return
We assist the institution in responding to parent/student requests for access and correction. On termination or on the institution's request, we will delete or return student data within a commercially reasonable period, subject to legal retention (for example billing records) described in the Privacy Policy.
How to sign a DPA
Schools and agencies that require a countersigned DPA or a state-specific student data privacy agreement (for example an SDPC/NDPA exhibit) can request one at support@venakaninfo.com.