Student Data Privacy.

1. Scope and legal framework

When a New York educational agency provides Vidcom with student data under a contract or other written agreement, Vidcom may be a “third-party contractor” under New York Education Law § 2-d and Part 121 of the Commissioner’s Regulations. When Vidcom maintains education records on behalf of a school, applicable requirements of the Family Educational Rights and Privacy Act (FERPA) may also apply.

2. School-specific written agreement

Before covered student personally identifiable information is provided, the school and Vidcom should have a written agreement that identifies the service and incorporates required privacy and security terms. As applicable, those documents should state:

• the exclusive purpose for which student data is disclosed;
• the data elements involved and who may access them;
• the contract term and data retention, return and deletion schedule;
• where data is stored and how it is protected in transit and at rest;
• approved subcontractors or other authorized recipients;
• incident notification and cooperation responsibilities;
• how parents and eligible students may exercise applicable rights; and
• the supplemental information required for the school’s Parents’ Bill of Rights.

3. Data used for contracted services

Depending on the school’s instructions and the contracted service, data may include a student’s name, school, grade, class or teacher, school-issued identifier, roster or scheduling information, photograph or video, image association, order status and parent or guardian contact information.

Vidcom should receive only the data reasonably necessary for the contracted service. A school photograph or video can be an education record when it is directly related to a student and maintained by the school or by a party acting for the school.

4. Purpose limits and prohibited uses

Covered student data is used only to perform the services authorized by the applicable school agreement, such as picture-day administration, image matching, secure gallery delivery, identification products, yearbook or print fulfillment, customer support, or another expressly contracted purpose.

Vidcom does not sell student data. Covered student data must not be used for targeted advertising, unrelated product development, or an unauthorized commercial or marketing purpose. It must not be redisclosed except as authorized by the school agreement and applicable law.

5. Access and security commitments

For covered school data, the applicable contract and security plan should require controls appropriate to the sensitivity of the data, including:

• access limited to authorized personnel with a legitimate need to perform the service;
• administrative, technical and physical safeguards;
• encryption of covered PII in transit and at rest as required by New York law and the school agreement;
• account, credential and device protections;
• workforce privacy and security training;
• vendor and subcontractor controls;
• security-event monitoring, incident response and required notice; and
• secure return or deletion when the contract or authorized purpose ends.

The specific safeguards, systems, locations, subprocessors and schedules must be documented and verified in the applicable school contract materials rather than assumed from this public page.

6. Parent and eligible-student rights

FERPA gives parents and eligible students rights concerning education records, including rights to inspect and review records and seek correction through the educational agency. New York Education Law § 2-d also provides rights concerning student PII and complaints about unauthorized disclosure.

To protect privacy, formal requests should be made to the applicable school or district. The school can authenticate the requester, determine the governing right and direct Vidcom to retrieve, correct, return or delete data when appropriate.

7. Gallery and lookup requests

Vidcom verifies a requester’s identity or authority before releasing private gallery information. A name, school or access code alone may not be enough. Vidcom may ask the school, parent, guardian, eligible student or event organizer to confirm authorization.

Do not submit Student IDs, grades, health information or other sensitive education records through the public website form or ordinary email. The public form is for an initial request only; Vidcom may require a verified or secure channel before discussing or delivering private records.

8. Incident and complaint process

A suspected loss, unauthorized access, disclosure or other security incident involving school-provided data should be reported promptly to Vidcom and the applicable school or district Data Protection Officer. Vidcom will follow the notification and cooperation requirements in the school agreement and applicable law.

Parents and eligible students may also review New York State Education Department resources or use NYSED’s student-data privacy complaint process.

9. Children using the public site

The public inquiry and lookup forms are intended for adults, parents, guardians and authorized users. Children under 13 should not submit personal information. A parent or guardian should make the request. This public-site rule is separate from information a school provides under a valid written agreement.

10. Contact and contract review

Schools seeking a contract-specific Data Privacy Agreement, security plan, data-element schedule, subprocessors list, retention schedule or other procurement material should contact Vidcom before transmitting student PII.