TeachPassport for Schools Data Processing Addendum

Scope and roles

This addendum applies when a TeachPassport for Schools organization directs Buddy Labs LLC (operating as TeachPassport) to process employee information for its certification register. The organization decides which employees, sites and authorized administrators belong in its register. TeachPassport processes that information only to provide, secure, maintain and support the register or to meet a binding legal obligation.

People and information covered

The people covered are the organization's authorized administrators and the employees in its register. Administrator information is limited to account identity, confirmed work email, organization role and security or audit events. Employee information is limited to name, role, site, jurisdiction, employment status, start date, an optional certificate number, and dated verification records: what an administrator saw on the official state lookup, the certificate type and status, effective and expiration dates, and an optional screenshot of the official result.

Administrators open the official state source and enter a record themselves. TeachPassport does not conduct a hidden lookup or receive the searched record. Records reflect the organization's administrative record-keeping; they do not establish an agency, assignment, employment, pay, legal-readiness or employability decision.

TeachPassport for Schools does not request or accept Social Security numbers, birth dates, state or employer portal passwords, fingerprint records, background reports, I-9 records, full identity documents, medical information, banking or tax information, uploaded employee files other than the optional lookup screenshot, or free-text employee notes. The organization must not place those items in the service.

Processing instructions

TeachPassport uses covered information to authenticate administrators, keep the register and its verification history, compute the recheck schedule and standing summary, prepare the included exports, provide requested support, protect the service and delete covered records on request. TeachPassport will tell the organization if an instruction cannot be followed within the released product.

Access and security

TeachPassport requires confirmed work-email accounts and multifactor authentication for every administrator, organization-scoped authorization, restricted service credentials, encrypted transport and storage, private infrastructure, change records and least-privilege access. Administrators receive only the role assigned by the organization owner.

Service providers

TeachPassport uses contracted providers for hosting, database and authentication, private file storage and malware scanning, email delivery, payment processing and customer support, listed on the security page. A provider receives only the information needed for its assigned function and must handle it under contractual confidentiality and security obligations. TeachPassport remains responsible for its provider instructions under this addendum.

Security events and assistance

TeachPassport maintains a documented process to investigate suspected unauthorized access, contain it, preserve evidence and notify an affected organization when required. TeachPassport will provide information reasonably available from the service to help the organization respond to a covered access, export, correction or deletion request.

Retention, recovery and deletion

Covered information remains available for the organization's register until the owner cancels or asks for deletion. After cancellation, the register stays read-only for 30 days, during which the organization can export its data. After that period, TeachPassport deletes covered customer records unless a documented legal hold or a narrow legal, security or completed-transaction obligation requires limited retention.

No sale or advertising use

TeachPassport does not sell or rent administrator or employee information, use it to build third-party advertising audiences, or rank a provider because it paid for placement.

Organization responsibilities

The organization must have authority to provide covered information, give any required notices, keep administrator access current and use the service only for lawful certification record-keeping. It must tell TeachPassport promptly about suspected account misuse and must not enter excluded information.

Term, governing law and contact

This addendum begins when an authorized organization signer accepts it and continues while TeachPassport processes covered organization information. It ends after covered information is deleted, subject to the limited retention described above. It is governed by the laws of the State of Georgia. Privacy or security questions may be submitted through the support inbox.