Privacy and data protection

FERPA Privacy and Protection Addendum

Last updated: 26 September 2025

This FERPA Privacy & Data Protection Addendum (“Addendum”) forms part of the Services Agreement between Pamoja Education Ltd (“Pamoja” or “PMJ” or “we”) and the School. It applies only to Schools governed by the US Federal Family Educational Rights and Privacy Act (“FERPA”). It outlines specific data protection obligations relating to the handling of student education records by Pamoja when acting as a service provider to US educational institutions (“School”).

Protection of confidential data

Pamoja agrees to abide by the limitations on re-disclosure of personally identifiable information from education records set out in The Family Educational Rights and Privacy Act (34 CFR § 99.33 (a)(2)) and with the terms set out below. 34 CFR 99.33 (a)(2) states that the officers, employees, and agents of a party that receives education record information from the School may use the information, but only for the purposes for which the disclosure was made.

Definition

Covered data and information (“CDI”) includes electronic student education record information supplied by the School, as well as any data provided by the School’s students to Pamoja. 

Acknowledgment of access to CDI

Pamoja acknowledges that the Agreement allows it access to CDI.

Prohibition on unauthorised use or disclosure of CDI

Pamoja agrees to hold CDI in strict confidence. Pamoja shall not use or disclose CDI received from or on behalf of the School (or its students) except as permitted or required by the Agreement, as required by law, or as otherwise authorised in writing by the School. Pamoja agrees not to use CDI for any purpose other than the purpose for which the disclosure was made.

Return or destruction of CDI

Upon termination, cancellation, expiration or other conclusion of the Agreement, Pamoja shall return all CDI to the School or, if return is not feasible, destroy all CDI. If Pamoja destroys the information, it shall provide the School with a certificate confirming the date of destruction of the data.

Remedies

If the School reasonably determines in good faith that Pamoja has materially breached any of its obligations under this contract, the School, in its sole discretion, shall have the right to:

  • require Pamoja to submit to a plan of monitoring and reporting;
  • provide Pamoja with a fifteen (15) day period to cure the breach; or
  • terminate the Agreement immediately if cure is not possible. 

Before exercising any of these options, the School shall provide written notice to Pamoja describing the violation and the action it intends to take. If the Family Policy Compliance Office of the US Department of Education determines that Pamoja improperly disclosed personally identifiable information obtained from the School’s education records, it may not allow Pamoja access to education records for at least five years.

Maintenance of the security of electronic information

Pamoja shall develop, implement, maintain and use appropriate administrative, technical and physical security measures to preserve the confidentiality, integrity and availability of all electronically maintained or transmitted CDI received from, or on behalf of the School or its students. These measures will be extended by contract to all Sub-processors used by Pamoja. 

Reporting unauthorised disclosures or misuse of CDI

Pamoja shall, within one day of discovery, report to the School any use or disclosure of CDI not authorised by this agreement or in writing by the School. Pamoja’s report shall identify:

  1. the nature of the unauthorised use or disclosure,
  2. the CDI used or disclosed,
  3. who made the unauthorised use or received the unauthorised disclosure,
  4. what Pamoja has done or shall do to mitigate any deleterious effect of the unauthorised use or disclosure, and
  5. what corrective action Pamoja has taken or shall take to prevent future similar unauthorised use or disclosure. 

Pamoja shall provide such other information, including a written report, as reasonably requested by the School.

Indemnity

Pamoja will protect the School from any claims, costs, damages, or legal fees that result from Pamoja not meeting its obligations under this Addendum.