FERPA Compliance
Last updated: March 26, 2026
Overview
The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g) protects the privacy of student education records. Varsity Learning is committed to handling student data in compliance with FERPA requirements.
Our Role Under FERPA
When Varsity Learning is used by an educational institution, we act as a school official with a legitimate educational interest under FERPA § 99.31(a)(1)(i)(B). This means:
- We provide a service that the institution would otherwise perform itself
- We are under the direct control of the institution regarding use and maintenance of education records
- We use education records only for authorized purposes
- We do not re-disclose student information except as permitted by FERPA
Education Records We Process
In the course of providing our service, we may process the following education records:
- Student names and institutional email addresses
- Course enrollment information
- Assignment submissions and scores
- Gradebook data and academic progress
- LTI-exchanged identifiers and grade passback data
Our FERPA Commitments
Access Controls
Student education records are accessible only to the assigned instructor, institutional administrators with legitimate educational interest, and authorized Varsity Learning support personnel for troubleshooting purposes.
No Unauthorized Disclosure
We do not disclose education records to third parties without consent, except as permitted by FERPA (e.g., judicial order, health/safety emergency, authorized institutional officials).
No Commercial Use
Student education records are never used for marketing, advertising, profiling, or any purpose unrelated to the educational service we provide.
Data Security
Education records are protected with encryption in transit (TLS 1.3) and at rest (AES-256), access logging, and regular security assessments. See our Data Collection Practices for details.
Record Retention & Deletion
Education records are retained for the duration of the account plus 3 years, or as required by institutional agreement. Institutions may request deletion of student records at any time.
Institutional Agreements
Institutions may enter into a Data Processing Agreement (DPA) or FERPA-specific addendum with Varsity Learning to formalize data handling obligations. Contact support@varsitylearning.com to request an institutional agreement.
Parent & Student Rights
FERPA grants parents (and eligible students over 18) the right to:
- Inspect and review education records
- Request amendment of inaccurate records
- Consent to disclosure of personally identifiable information
- File a complaint with the U.S. Department of Education
To exercise these rights regarding data held by Varsity Learning, contact your institution's registrar or FERPA compliance officer, or email us directly.
Contact
FERPA inquiries: support@varsitylearning.com