Purpose
Y.B.E., NFP is committed to safeguarding the privacy and security of all student, family, staff, and partner data. This policy outlines our practices to ensure that sensitive information is protected in compliance with applicable laws, ethical standards, and Public Schools (PS) requirements. Public Schools.
Scope
This policy applies to all Y.B.E., NFP staff, contractors, partners, and volunteers who access, collect, store, or manage confidential information in school-based or community settings.
Data We Protect
Y.B.E., NFP protects all forms of sensitive and personally identifiable information (PII), including but not limited to:
- Student records (academic, attendance, assessments)
- Personally identifiable information (names, addresses, contact details)
- Staff and family information
- Program participation data
- Digital records stored on devices or cloud systems
Compliance & Legal Standards
Y.B.E., NFP adheres to all applicable privacy laws and standards, including:
- Family Educational Rights and Privacy Act (FERPA)
- Children’s Online Privacy Protection Act (COPPA), where applicable
- PS data sharing and confidentiality requirements
- Applicable state and local data protection regulations
Data Collection & Use
- Data is collected only for legitimate educational and programmatic purposes
- Information is limited to what is necessary to deliver services effectively
- Data is used solely to support student learning, program evaluation, and reporting requirements
- We don’t sell data to 3rd Parties.
Data Security Measures
Y.B.E., NFP implements strong safeguards to protect data, including:
- Secure, password-protected systems and devices
- Limited access based on staff roles (“need-to-know” basis)
- Encrypted storage and secure data transfer methods where applicable
- Regular monitoring and updates to maintain system security
Confidentiality & Staff Responsibilities
- All staff and partners are required to sign confidentiality agreements
- Staff receive training on data privacy, security protocols, and compliance requirements
- Unauthorized access, sharing, or misuse of data is strictly prohibited
Data Sharing
- Data is shared only with authorized entities (e.g., PS) and only as required Public Schools
- No personal data is sold or used for non-educational purposes
- All data-sharing practices comply with PS agreements and legal standards
Data Retention & Disposal
- Data is retained only as long as necessary for program and compliance purposes
- Secure disposal methods (e.g., shredding, permanent digital deletion) are used when data is no longer needed
Incident Response
In the event of a data breach or security concern:
- Immediate action will be taken to contain and assess the issue
- Required parties (including PS) will be notified promptly
- Corrective measures will be implemented to prevent future incidents
