Legal
School and Association Data Agreement
July 28, 2026
Jump to a section
This School and Association Data Agreement (“Agreement”) is entered into by Varsity Engine LLC (“Varsity Engine,” “we,” “us”) and the school, school district, or athletic association identified in the signature block (“Institution”). It governs any personal information that Institution or its authorized personnel submit to, or access through, the Varsity Engine platform (“Platform”), including any information drawn from a student's education records. It must be executed before Institution personnel enter transcript, grade, enrollment, eligibility, or other education-record data. This Agreement supplements the Terms of Service and the Privacy Policy and controls over either of those documents to the extent it concerns Institution data covered here.
1Definitions
“Education Records” has the meaning given in the Family Educational Rights and Privacy Act (FERPA) and its regulations. “Student Data” means personal information about a student that Institution or its personnel submit to or access through the Platform, including information derived from Education Records. “School Purpose” means a use that is directed by Institution, that furthers a legitimate educational or athletic-administration interest of Institution, and that is authorized under this Agreement. “Authorized Personnel” means the coaches, athletic directors, and administrators whom Institution designates and permits to submit or access Student Data on its behalf.
2Roles and direct control
With respect to Student Data derived from Education Records, Institution is the controlling party and Varsity Engine acts on Institution's behalf and under Institution's direct control. Varsity Engine processes such Student Data only on Institution's documented instructions, including the instructions expressed through the Platform's configuration and this Agreement. To the extent Varsity Engine receives Education Records or personally identifiable information from Education Records, it does so as a “school official” performing an institutional service or function for which Institution would otherwise use its own employees, consistent with FERPA. Varsity Engine will not determine the purposes of processing Education Records independently of Institution.
3Permitted purposes
Varsity Engine uses Student Data derived from Education Records only for the School Purpose and only to provide, maintain, and support the Platform features Institution enables. Varsity Engine will not use such Student Data to build or enrich a profile except in furtherance of the School Purpose, will not use it for advertising or to train models unrelated to providing the service to Institution, and will not sell it. Any use of Student Data outside the School Purpose requires Institution's prior written authorization or the direct consent of the parent or eligible student.
4Redisclosure
Varsity Engine will not redisclose Student Data derived from Education Records except as directed by Institution, as permitted under FERPA and this Agreement, or as required by law. Where Varsity Engine discloses such Student Data to a subcontractor under Section 8, it does so only under the School Purpose and only under written terms at least as protective as this Agreement. Varsity Engine will not redisclose to college programs, other users, or the public any Student Data derived from Education Records except the specific fields Institution or an authorized guardian directs to be shared, and subject to the consent requirements in the Privacy Policy and the NIL Consent and Authorization Agreement. Varsity Engine will maintain a record of redisclosures where FERPA requires one and make it available to Institution.
5Parent and eligible-student rights
Varsity Engine will support Institution in responding to a parent's or eligible student's request to inspect, review, correct, or delete Student Data, and will not respond to such a request directly except to direct the requester to Institution or to act on Institution's instruction. On Institution's direction, Varsity Engine will correct or delete Student Data derived from Education Records. Institution remains responsible for obtaining any consent, or applying any exception, that FERPA requires before its personnel submit Student Data.
6Ownership
As between the parties, Institution retains all right, title, and interest in Student Data derived from Education Records. This Agreement grants Varsity Engine only the limited rights necessary to provide the Platform under the School Purpose. Nothing here transfers ownership of Education Records to Varsity Engine.
7Security
Varsity Engine maintains a written information-security program with administrative, technical, and physical safeguards appropriate to the sensitivity of Student Data, including encryption of Student Data in transit and at rest, access controls limiting Student Data to Authorized Personnel and to Varsity Engine staff with a need to know, least-privilege provisioning, logging and periodic access review, and secure development and vendor-review practices. Varsity Engine applies heightened safeguards to the data of students known to be minors. Institution is responsible for managing its Authorized Personnel, including promptly removing access when a staff member leaves or changes roles.
8Subcontractors
Varsity Engine may engage subcontractors and service providers (for example, hosting, content delivery, identity verification, and communications) to process Student Data in furtherance of the School Purpose. Varsity Engine will impose on each such subcontractor written obligations no less protective than this Agreement, will permit a subcontractor to use Student Data only to provide services to Varsity Engine, and remains responsible for each subcontractor's performance. Varsity Engine will make available to Institution a current list of subcontractors that process Student Data on request.
9Breach response
Varsity Engine will maintain an incident-response process and, on becoming aware of a security incident affecting Institution's Student Data, will notify Institution without undue delay and in any event within [72] hours, will provide the information reasonably available about the nature and scope of the incident and the data involved, will take reasonable steps to contain and remediate, and will cooperate with Institution's notification obligations. The parties will coordinate on the content and timing of any notice to parents, students, or regulators, with Institution controlling notices that arise from its role over Education Records except where Varsity Engine has an independent legal obligation to notify.
10Return or destruction
On termination of this Agreement, on Institution's written request, or when Student Data is no longer needed for the School Purpose, Varsity Engine will return the Student Data derived from Education Records to Institution in a commonly used format, or securely destroy it, at Institution's election, and will destroy or de-identify remaining copies within [30] days, except for copies that Varsity Engine is required by law to retain or that reside in routine backups, which are destroyed on the ordinary backup cycle and remain protected under this Agreement until destroyed. Varsity Engine will confirm completion of return or destruction in writing on request. Aggregate or de-identified data that does not identify any student is not subject to this Section.
11Term, order of precedence, and general terms
This Agreement takes effect on the later signature date below and continues while Institution uses the Platform, or until terminated by either party on [30] days' written notice. The security, redisclosure, return-or-destruction, and breach provisions survive termination as to Student Data still held. To the extent this Agreement conflicts with the Terms of Service or Privacy Policy regarding Student Data derived from Education Records, this Agreement controls. This Agreement is governed by the law of the State of Mississippi, except that where the mandatory student-privacy law of the state in which a student is enrolled provides greater protection, that law applies to that student's data. Neither party may assign this Agreement without the other's consent, except to a successor that assumes these obligations in writing.
12Signatures
Institution name.
Authorized signer name and title.
Signature.
Date.
Varsity Engine LLC, authorized signer name and title.
Signature. Date.
By signing, each signer represents that they are authorized to bind their organization to this Agreement, and Institution represents that its Authorized Personnel are permitted under applicable law and Institution policy to submit the Student Data contemplated here.