TeachPassport for Schools Data Processing Addendum

This is the text an organization accepted as admin-starter-dpa-2026-09-17, effective September 17, 2026. A later version is in use now: /legal/schools-dpa. This page is kept so an organization that accepted this version can read it. Every version is listed under agreement versions.

Scope and roles

This addendum applies when a TeachPassport for Schools organization directs Buddy Labs LLC (operating as TeachPassport) to process employee information for its certification register. The organization decides which employees, sites and authorized administrators belong in its register. TeachPassport processes that information only to provide, secure, maintain and support the register or to meet a binding legal obligation.

People and information covered

The people covered are the organization's authorized administrators and the employees in its register. Administrator information is limited to account identity, confirmed email address, organization role and security or audit events. Employee information is limited to name, role, site, jurisdiction, employment status, start date, an optional certificate number, and dated verification records: what an administrator saw on the official state lookup, the certificate type and status, effective and expiration dates, and an optional screenshot of the official result.

Administrators open the official state source and enter a record themselves. TeachPassport does not conduct a hidden lookup or receive the searched record. Records reflect the organization's administrative record-keeping; they do not establish an agency, assignment, employment, pay, legal-readiness or employability decision.

TeachPassport for Schools does not request or accept Social Security numbers, birth dates, state or employer portal passwords, fingerprint records, background reports, I-9 records, full identity documents, medical information, banking or tax information, uploaded employee files other than the optional lookup screenshot, or free-text employee notes. The organization must not place those items in the service.

Processing instructions

TeachPassport uses covered information to authenticate administrators, keep the register and its verification history, compute the recheck schedule and standing summary, prepare the included exports, provide requested support, protect the service and delete covered records on request. TeachPassport will tell the organization if an instruction cannot be followed within the released product.

Access and security

TeachPassport requires a confirmed email account and two-step verification for every administrator, organization-scoped authorization, restricted service credentials, encrypted transport and storage, private infrastructure, change records and least-privilege access. Administrators receive only the role assigned by the organization owner.

Service providers

TeachPassport uses contracted providers for hosting, database and authentication, private file storage and malware scanning, email delivery, payment processing and customer support, listed on the security page. A provider receives only the information needed for its assigned function and must handle it under contractual confidentiality and security obligations. TeachPassport remains responsible for its provider instructions under this addendum.

Security events and assistance

TeachPassport maintains a documented process to investigate suspected unauthorized access, contain it, preserve evidence and notify an affected organization when required. TeachPassport will provide information reasonably available from the service to help the organization respond to a covered access, export, correction or deletion request.

Retention, recovery and deletion

Covered information remains available for the organization's register until the owner cancels or asks for deletion. After the paid period ends, the register becomes read-only; the organization can still export its data, and covered records are kept, not deleted, unless the owner separately asks for deletion. A deletion request deactivates the organization immediately, and TeachPassport deletes covered customer records 30 days after the request unless a documented legal hold or a narrow legal, security or completed-transaction obligation requires limited retention. The owner may cancel a pending deletion request at any time before then.

No sale or advertising use

TeachPassport does not sell or rent administrator or employee information, use it to build third-party advertising audiences, or rank a provider because it paid for placement.

Organization responsibilities

The organization must have authority to provide covered information, give any required notices, keep administrator access current and use the service only for lawful certification record-keeping. It must tell TeachPassport promptly about suspected account misuse and must not enter excluded information.

Term, governing law and contact

This addendum begins when an authorized organization signer accepts it and continues while TeachPassport processes covered organization information. It ends after covered information is deleted, subject to the limited retention described above. It is governed by the laws of the State of Georgia. Privacy or security questions may be submitted through the support inbox.

Countersignature

An organization accepts this agreement electronically in TeachPassport for Schools, and that acceptance is what governs. A superintendent or board clerk who wants a paper copy on file may print this page and sign below; nothing here is submitted back to TeachPassport.

Name

Title

Organization

Date

Signature