FERPA & Student Data
How we protect student education records for the schools and districts we serve.
The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records. When your school uses Its1Ticket, any student information we process on your behalf is handled under FERPA and applicable state student-privacy laws. Here is our commitment.
In plain terms
- •Your school signs our FERPA Data Privacy Addendum alongside our Terms of Service. Doing so makes us a “school official” — a trusted extension of your own staff — so we can lawfully handle student data on your behalf.
- •You stay the owner and controller of the data. We use it only to run your ticketing — never to sell, market, profile students, or train AI.
- •If a data breach ever occurs, we notify your school in writing within 48 hours. If we ever change a vendor that touches student data, you get 30 days’ notice and the right to object.
- •Parent or student requests to view or delete records are routed to your school, which stays in control of those rights.
- •Ticket photos auto-delete after each event, and when our agreement ends we return or securely destroy your student data.
We act as a "School Official"
When a school or district uses Its1Ticket, we handle student information as a "school official" under the FERPA exception (34 CFR § 99.31(a)(1)) — performing a service the school would otherwise do itself, under the school’s direct control.
No selling. No marketing. No AI training.
We never sell, rent, or trade student data, never use it for advertising or profiling, and never use it to train third-party or general-purpose AI models. It is used only to provide the ticketing service.
Security built in
Encryption in transit (TLS 1.2+) and at rest (AES-256), row-level security and role-based access, an append-only access log recording who viewed rosters and photos, and a "sensitive field" marker for medical/DOB data.
A small, vetted set of subprocessors
Student data is processed only by the vendors listed in our Privacy Policy, each under a data-processing agreement, and only to provide the service to us.
Return or destroy on request
Ticket photos auto-purge after each event. On request or when a contract ends, we return or securely destroy student data — and can certify destruction.
Schools stay in control
The school owns the data, decides what is collected, and can access, export, or delete it at any time. Parent/eligible-student rights requests are referred to the school.
Our FERPA Data Privacy Addendum
Read and download our FERPA Data Privacy Addendum (DPA), which formally designates Its1Ticket as a “school official” and documents these commitments. When you are ready to execute it — or if your district requires its own DPA or a state-specific addendum — contact us and we will get it signed.
See also our Privacy Policy (including the full subprocessor list) and Data Management page.