Last Updated: November 2017
Gaggle.Net, Inc. (Gaggle) has been working with K-12 schools and school districts since 1998 and has always maintained clear terms regarding how we treat student and staff data. We reinforce our commitment through participation in a pledge created by the Future of Privacy Forum (FPF) and the Software & Information Industry Association (SIIA) to advance data privacy protection regarding the collection, maintenance and use of personal information.
Definition of Data
Data includes all Personally Identifiable Information (PII) and other non-public information. Data include, but are not limited to, student data, staff data, metadata, and user content.
Scope of Policy
This Policy describes the types of information we may collect, or that you may provide, when registering with, accessing or using Gaggle products. This Policy does not apply to information we collect offline or on Gaggle websites (such as our company website here) or to information that you may provide to, or is collected by, third parties.
Purpose of Data Collection & Ownership
We consider all school and district data to be confidential and do not use such data for any purpose other than to provide services on your behalf and as outlined in your Service Level Agreement or contract. Student data are the property of the school or district and remain in the school or district's control throughout the duration of any agreement/contract.
Role of School and School Officials
Although this Policy will focus mainly on what we do, and what we confirm we will not do, with student and staff data, we believe that schools and school officials are critical partners in our collective efforts to protect and ensure only appropriate use of student-related information entrusted to them and us. In that regard, schools and school officials using Gaggle products should be mindful that in granting or allowing access to Gaggle products, they are controlling who has access to student and staff information. When we reference “granting or allowing access,” we are referring to both intentional actions, such as an administrator authorizing a Gaggle account for a teacher or a student, as well as unintentional actions and consequences that may flow from, for example, a school's failure to maintain sufficient data governance or security practices.
In cases where the Family Educational Rights and Privacy Act (FERPA) applies, access to certain student information remains the legal responsibility of the applicable school. In all situations, it is incumbent upon our customers to make an affirmative determination before furnishing access to anyone that the party has a legitimate need for access to Gaggle products and the sensitive information that may be accessible to that party through Gaggle products.
Information About Students
FERPA and Education Records
Although the Family Educational Rights and Privacy Act (FERPA) was enacted decades ago, and certainly well before Internet-based services became ubiquitous in academic settings, one of its core tenets was and remains the protection of the privacy of Personally Identifiable Information (PII) in students' education records. As defined in FERPA, “education records” are “those records, files, documents and other materials which (i) contain information directly related to a student; and (ii) are maintained by an educational agency or institution or by a person acting for such agency or institution.” PII from education records includes information, such as a student's name or identification number, which can be used to distinguish or trace an individual's identity, either directly or indirectly through linkages with other information.
FERPA requires that educational institutions and agencies that receive certain federal funds (for example, public schools) get prior consent from a parent or legal guardian before disclosing any education records regarding that student to a third party. Consequently, before you enter, upload or access any data concerning a minor student, you must confirm that your agency or institution has (1) obtained appropriate consent from the parent or guardian of that student or (2) determined that one of the limited exceptions to the consent requirement applies.
Gaggle only uses PII from students' education records to enable the use of Gaggle products. Unless a school official expressly instructs otherwise, we will not share or reuse PII from education records for any other purpose. While we think those statements are clear, to avoid any doubt, we will not use student PII to target students or their families for advertising or marketing efforts or sell rosters of student PII to third parties.
COPPA and Children Under the Age of 13
The Children’s Online Privacy Protection Act (COPPA) is a federal law designed to protect the privacy of children under 13 years old. COPPA requires that Gaggle provide parents or legal guardians with notice concerning what personal information is collected from children and how it is used or shared.
Gaggle’s services are in compliance with the Children’s Online Privacy Protection Act of 1998.
Disclosure and Retention of PII
Gaggle will not distribute to third parties any staff data or student data without the consent of either a parent/guardian or a qualified educational institution except in cases of Possible Student Situations (PSS), which may be reported to law enforcement.
To protect your school or district against the risks involved in handling child pornography, Gaggle registers incidents containing pornographic videos and images of possible minors with the CyberTipline at the National Center for Missing and Exploited Children (“NCMEC”). It is NCMEC’s mission to prevent the spread of child pornography, as well as to prevent the sexual exploitation of children.
We may also disclose student or staff data to comply with a court order, law or legal process (including a government or regulatory request), but before doing so we will provide the applicable school with notice of the requirement so that, if the school so chooses, it could seek a protective order or another remedy. If after providing that notice we remain obligated to disclose the demanded student or staff data, we will disclose no more than that portion of data which, on the advice of our legal counsel, the order, law or process specifically requires us to disclose.
If a third-party purchases all or most of our ownership interests or assets, or we merge with another organization, it is possible that we would need to disclose data to the other organization following the transaction, for example, were we to integrate Gaggle with the other organization’s product offerings. To the extent any such transaction would alter our practices relative to this Policy, we will give schools notice of those changes and any choices they may have regarding student or staff data.
Finally, although we outlined earlier in this Policy what constitutes student or staff data, we also want to be clear what information is not student or staff data or PII. Once PII, whether relating a school or district employee or student has been de-identified, that information is no longer PII. PII may be de-identified through aggregation or various other means. The U.S. Department of Education has issued guidance on de-identifying PII in education records. In order to allow us to address proactively customer needs, we anticipate using de-identified information to improve Gaggle products and services. That said, we would use reasonable de-identification approaches to ensure that, in doing so, we are not compromising the privacy or security of the PII you entrust to us. We will not attempt to re-identify de-identified data and will not transfer de-identified data to any party unless that party agrees not to attempt re-identification.
Data Security and Protection of Data, Including PII
We have implemented measures designed to secure PII from accidental loss and unauthorized access, use, alteration and disclosure. Among other things, PII is encrypted in transit to and from Gaggle using SSL technology. In addition, all PII is stored in multiple databases with extensive redundancy and failover maintained at data centers located in two geographically dispersed states. Furthermore, consistent with guidance from the U.S. Department of Education that storing sensitive education records within the United States is a "best practice." That said, unfortunately, the transmission of information via the Internet is not completely secure and, although we do our best to protect PII, neither we nor any other hosted service provider can guarantee the security of all personally identifiable information.
Data integrity and accuracy is achieved through strict restrictions on how data may be accessed, and by whom. Audit logs are kept to be able to track data modification. Additional security measures are in place to prevent and identify data tampering. In the extremely rare case of a data breach, we will immediately notify all customers affected using the primary email address specified in their accounts. It is the responsibility of our customers to contact parents or legal guardians regarding a data breach.
Lastly, Gaggle successfully conducted a Service Organization Controls (SOC) 2 audit/examination of the Trust Service Principles: Security, Availability and Privacy. The main purpose of the SOC 2 Type 1 report is to show our customers that an independent third party has evaluated our systems and controls and our adherence to those systems and controls.
According to the American Institute of CPAs:
“A Software-as-a-Service (SaaS) or Cloud Service Organization that offers virtualized computing environments or services for user entities and wishes to assure its customers that the service organization maintains the confidentiality of its customers' information in a secure manner and that the information will be available when it is needed. A SOC 2 report addressing security, availability and confidentiality provides user entities with a description of the service organization's system and the controls that help achieve those objectives.”
Expiration of Agreement and Disposal of Data, Including PII
Upon the expiration or termination of any agreement/contract between a school or school district and Gaggle, we keep customer data for up to 30 days except in cases where state laws require a specific shorter or longer duration.
Any retained data will, of course, remain subject to the restrictions on disclosure and use outlined in this policy for as long as it resides with us.
Correction of Data
We only accept requests to change data from main contacts and administrators. Parents or legal guardians who request changes to student data should go through a school or district authorized main contact or administrator.
Changes to this Policy
We may update this Policy from time to time. If we make material changes, we will post the updated policy on this page (with a notice that the policy has been updated) and notify all customers by email using the primary email address specified in their accounts.
You can, and should, ask questions about this Policy and our privacy practices. You should always feel free to contact us at:Gaggle.net, Inc.