Back to TSI Hub

Data Processing Agreement (Template)

A plain-English outline of what a signed DPA between TSI and a school or district would cover.

Draft template — not a signed agreement. This page is a starting point for TSI’s legal/compliance advisor to review and turn into an actual Data Processing Agreement with a school or district. It is not legal advice, and it is not itself binding on TSI or any school. Please have counsel finalize the real DPA before it is signed or relied upon.

Many districts require a signed Data Processing Agreement (DPA) before approving a classroom tool like TSI Hub. This page summarizes, in plain English, what that agreement is expected to cover, so a district reviewer can see the shape of it early in the procurement conversation. It is a template outline, not the executed document — the actual DPA will be drafted and signed separately, school by school.

Roles of the Parties

The school or district is expected to act as the Data Controller — it decides to use TSI Hub and directs what student and staff data is entered into it. TSI acts as the Data Processor — it processes that data solely to provide the TSI Hub service, on the school’s instructions and for no independent purpose of its own.

Data Processed

The DPA would cover the categories of data TSI Hub actually collects, namely:

  • name, email address, school, and role for every account;
  • grade level, for student accounts; and
  • activity logs — link clicks, resource views, and file downloads.

Purpose Limitation

TSI would agree to process this data only to operate TSI Hub for the school — not for advertising, not for building products for other customers, and not for any purpose the school has not authorized.

Subprocessors

The DPA would name TSI Hub’s subprocessors (currently MongoDB Atlas, DigitalOcean Spaces, Resend, and Google, as detailed on the Security & Data Handling page) and commit TSI to notifying the school before adding a new one that would touch the school’s data.

Breach Notification

The DPA would commit TSI to notifying the school promptly after becoming aware of a security incident affecting the school’s data — commonly within a fixed window such as 72 hours, though the exact timeline and notification method are a term for counsel to confirm — so the school can meet its own notification duties to students and parents.

Data Return and Deletion on Termination

When a school ends its use of TSI Hub, the DPA would give the school the option to request an export of its data and would commit TSI to deleting or de-identifying the school’s data within an agreed period after termination, except where limited retention is required for legal or security reasons.

Term and Amendment

The DPA would run for as long as the school uses TSI Hub and would be updated if the underlying subprocessors or data practices materially change, with notice to the school.

Next Steps

Districts that need a countersigned DPA as part of procurement should contact TSI at privacy@mytsi.org so TSI’s counsel can issue and finalize the actual agreement using this outline as a starting point.