Data Processing Agreement

School (Data Controller):

The educational institution or program that subscribes to MicroCampus and determines the purposes and means of processing student and family data.

MicroCampus (Data Processor):

Close to the Coast Creative, which processes personal data on behalf of and as instructed by the School.

Student Data:

Personally identifiable information contained in student education records, as defined under FERPA, that is entered into the MicroCampus platform by the School.

Personal Data:

Any information relating to an identified or identifiable individual, including Student Data and parent/guardian contact information.

Sub-Processor:

A third-party service provider engaged by MicroCampus to assist in delivering the platform.

The School is the Data Controller with respect to all Personal Data it provides to MicroCampus. MicroCampus is the Data Processor, processing Personal Data only on behalf of and at the direction of the School.

For purposes of FERPA (20 U.S.C. § 1232g), MicroCampus operates as a “school official” with a legitimate educational interest in accessing student education records, solely to provide contracted services. The School remains the educational agency responsible for its own FERPA compliance obligations.

MicroCampus agrees to:

• Use student education records only as necessary to provide the contracted platform services to the School
• Not disclose student education records to any third party except as permitted by FERPA, authorized by the School, or required by law
• Maintain the confidentiality and security of student education records using reasonable administrative, technical, and physical safeguards
• Promptly notify the School of any known or suspected unauthorized access to or disclosure of student education records
• Return or delete student education records upon termination of the school’s account, within 90 days, upon request
• Allow the School to review or audit our data practices upon reasonable written request

The School represents and warrants that it has the authority under FERPA to share student education records with MicroCampus for these purposes.

MicroCampus will process Student Data only for the following purposes:

• Providing and supporting the platform features (attendance, messaging, records, payments, etc.) as directed by the School
• Diagnosing and fixing technical issues
• Complying with applicable law or legal process
• As otherwise explicitly authorized in writing by the School

MicroCampus will not:

• Sell Student Data to any third party
• Use Student Data for advertising, marketing, or to build advertising profiles
• Create or maintain profiles of students for non-educational purposes
• Disclose Student Data to third parties other than the Sub-Processors listed in Section 5
• Use Student Data for any purpose not specified in this DPA without prior written consent from the School

MicroCampus uses the following Sub-Processors to deliver the platform. Each Sub-Processor is subject to data protection obligations no less protective than those in this DPA.

We will notify Schools of any material addition or replacement of Sub-Processors at least 14 days in advance.

MicroCampus implements and maintains the following security measures to protect Personal Data:

• Encryption in transit: All data transmitted between users and the platform is encrypted using HTTPS/TLS.
• Encryption at rest: Data stored in our database (Supabase) is encrypted at rest.
• Access controls: Role-based permissions ensure users (admin, teacher, parent) access only the data appropriate to their role.
• Authentication: Passwords are stored as cryptographic hashes (bcrypt). We support session-based authentication with secure tokens.
• Logical data isolation: Each school’s data is logically separated and scoped by a unique school identifier. No school can access another school’s data.
• Vendor security: We select Sub-Processors with industry-recognized security certifications (e.g., SOC 2, ISO 27001 where applicable).

In the event MicroCampus becomes aware of a confirmed unauthorized access, disclosure, or acquisition of Personal Data (“Security Incident”), we will:

• Notify the School within 72 hours of confirming the Security Incident
• Include in the notification: (a) the nature and scope of the incident, (b) the categories and approximate number of individuals and records affected, (c) the likely consequences, and (d) the measures taken or proposed to address the incident
• Cooperate with the School to investigate and remediate the incident
• Comply with applicable Florida breach notification law (FIPA, Fla. Stat. § 501.171)

MicroCampus retains Personal Data only for as long as the school’s account is active and as necessary to provide the platform services. Upon account termination:

• The School may request a full data export in a portable format prior to deletion
• All Personal Data will be deleted or anonymized within 90 days of account closure, unless retention is required by applicable law
• Backup copies may persist for up to 30 additional days before permanent removal

By using MicroCampus, the School represents and warrants that it:

• Has the legal authority and all necessary consents to share Personal Data, including Student Data, with MicroCampus
• Has complied with FERPA, COPPA, and any applicable state law in authorizing MicroCampus to process student education records
• Will only input data into the platform that it is lawfully permitted to share
• Will maintain appropriate privacy notices to students and parents regarding the use of MicroCampus
• Will promptly notify MicroCampus of any changes that affect the lawfulness of processing

MicroCampus complies with the Florida Student Data Privacy Act, F.S. § 1002.222, as an operator of a student data platform. Specifically, we:

• Use Student Data only for educational purposes as directed by the School
• Do not sell or share Student Data for commercial advertising purposes
• Do not create student profiles for non-educational purposes
• Maintain a publicly available privacy policy describing our data practices
• Delete Student Data upon school request or account termination

This DPA remains in effect for as long as MicroCampus processes Personal Data on behalf of the School, and terminates automatically upon the cancellation or termination of the School’s MicroCampus subscription, subject to the data deletion obligations in Section 8.

This DPA is governed by the laws of the State of Florida. Any disputes arising under this DPA shall be resolved in accordance with the dispute resolution provisions in the MicroCampus Terms of Service.

Questions about this DPA or to request a signed copy for your records:

Close to the Coast Creative / MicroCampus
Florida, United States
hello@microcampus.site