Data Processing Addendum

This summary describes the data processing addendum executed with every customer school before any records are synced. The signed DPA controls; this page is the plain-language version.

• Roles. The school is the controller of its education records. Institutional DataWorks, LLC acts as the school's service provider and, for FERPA purposes, as a school official with a legitimate educational interest under 34 CFR 99.31(a)(1), under the school's direct control with respect to those records.
• Scope. We process records solely to provide the contracted services. No sale of data, no advertising use, no use of school records to train AI models.
• Storage. The synced database resides in the school's own account. We retain operational logs (syncs, sign-ins, exports, overrides) and no more.
• Security. Encryption in transit and at rest, role-scoped access, audit logging, and breach notice to the school without undue delay.
• Subprocessors. Listed in the DPA and on the Security & Trust page, with notice before changes.
• Exit. On termination or request, we deliver the exit pack and delete what we hold on our side; the school's database remains the school's.

To receive the full DPA for signature, email hello@getrollbook.com.

Last updated August 25, 2026. Questions: hello@getrollbook.com.