Trust & compliance

A school is trusting us with its families, its money, and its students. Everything your administration, business office, and counsel need to say yes is here.

The documents

You own your data

The school is the controller of its data; Jettova is a processor acting on the school's instructions. For family payments the school is the merchant of record, so the money settles into the school's own Stripe account and Jettova never holds it; the school receives 100% of the trip cost. And it is your data: you can request an export of your roster and records, or their deletion, at any time, without penalty.

We keep data to a minimum, never sell it, and never use student data for advertising. The optional student emergency and medical layer stays off unless the applicable education-privacy terms are agreed first.

The agreement we sign

Our standard student data agreement is the Student Data Privacy Consortium's National Data Privacy Agreement (NDPA), the same standardized agreement thousands of education vendors and districts already use. We sign your state's version with unmodified standard clauses, together with the General Offer of Privacy Terms (Exhibit E), so other districts in your state can adopt the same agreement without renegotiating. Your counsel reviews a document they already know instead of a vendor's custom contract.

The completed exhibits (description of services, schedule of data, and data security requirements) are prepared and available to your reviewers on request.

New York schools: Education Law 2-d

For New York districts we support Ed Law 2-d contracting, including a Parents' Bill of Rights supplement. Our standing commitments match what 2-d expects:

• Student data is used exclusively to provide the trip coordination service the school engaged us for, and for no other purpose.
• We do not sell student data and never use it for marketing or advertising.
• Sub-processors that touch school data are bound in writing to protections no less strict than ours.
• Data is encrypted in transit and at rest, and processed in the United States.
• Parents can see their own child's information in the product at any time, and can raise questions with the school or directly with us.
• Student emergency and medical records are deleted on a fixed schedule shortly after the trip ends, and on contract end we delete or return the school's data at the school's choice and certify it.
• If a breach affects school data, we notify the school promptly with what it needs to meet its own notification duties.

Accessibility

Jettova aims to conform to WCAG 2.1 AA on the surfaces schools and families use. We audit these surfaces, fix what the audits find, and treat reported barriers as bugs. How to report an issue, and our current conformance status, is on the accessibility statement. Security researchers can reach us via security.txt.