Privacy and FERPA contract schedule template

This is a drafting checklist for counsel, not legal advice.

Data role and permitted purpose

The institution should define Notera's role (commonly a school official/service provider where applicable), the legitimate educational interest, and the exact services for which education records may be used. Contract language should prohibit use for advertising, unrelated profiling, model training, sale, or independent product purposes unless separately and lawfully authorized.

Data handled

• Account identity, role, institution, and authentication identifiers
• Athlete roster/profile details and optional date of birth
• NIL deals, amounts, deliverables, compliance status, and review history
• Contracts, tax/supporting documents, messages, audit events, and exports
• Optional published network projections only after the product's consent and publication gates

Required contract decisions

• Institution ownership/control and instructions
• Collection minimization and purpose limitation
• Access, correction, export, deletion, retention, and legal-hold procedures
• Parent/eligible-student request assistance and institutional response times
• Subprocessor approval and equivalent obligations
• Security controls, breach definition, notification window, cooperation, and costs
• Data location and international transfers
• End-of-contract return, deletion, and deletion certification
• AI provider and training restrictions when AI is enabled

retentionDays enforces scheduled vault deletion through the dry-run-first retention script. It is not a legal hold system; the institution must not enable destructive execution until hold requirements are designed.