Parents' Bill of Rights — HallPal supplement

Suggested public route: /legal/parents-bill-of-rights Effective: {{EFFECTIVE_DATE}} Last updated: 2026-08-08

1. What this page is

New York Education Law § 2-d + 8 NYCRR Part 121 require every New York school district ("LEA") to publish a Parents' Bill of Rights for Data Privacy + Security. Third-party contractors (like HallPal) that receive student data must attach a vendor supplement to every LEA contract, spelling out how the contractor handles the data.

Sections 3–8 below are HallPal's vendor supplement. They attach to every executed contract with a New York LEA + are incorporated by reference into HallPal's Student Data Agreement and State Privacy Riders §2 (New York).

Section 2 below is a generic Parents' Bill of Rights that schools + districts outside New York may adopt or adapt. It is HallPal's good-faith baseline description of the rights parents and eligible students have with respect to data HallPal processes on their child's school's behalf.

---

2. Parents' Bill of Rights (generic baseline)

Any parent, legal guardian, or eligible student (age 18+) whose school uses HallPal has the following rights with respect to student data:

1. The right to be informed. Parents can review this page + the Privacy Policy to see what data HallPal collects + why.
2. The right of access. Parents may request to inspect the data HallPal holds about their child. Requests are directed to the school; HallPal will produce a copy within 15 days of school authorization.
3. The right to correction. Parents may request correction of inaccurate data. Directed to the school; HallPal applies school-authorized corrections within 5 business days.
4. The right to consent (or refuse) to disclosure. HallPal discloses student data only under the terms in STUDENT_DATA_AGREEMENT.md §5 (subprocessors + legally-required disclosures + LEA authorization).
5. The right to be free of profit-motivated data use. HallPal does not sell student data, does not use it for advertising, and does not use it to train machine-learning models — ours or a third party's.
6. The right to know who has the data. The full list of HallPal's subprocessors is at SUBPROCESSORS.md.
7. The right to secure storage + transmission. HallPal implements the technical + operational security controls described in SECURITY.md and PRIVACY.md §12.
8. The right to breach notification. In the event of a security incident affecting student data, HallPal notifies the school within 72 hours of confirmed detection; the school notifies parents per applicable law.
9. The right to file a complaint. Parents may complain to the school's designated Data Protection Officer, to the state department of education, or (for New York specifically) to the New York State Education Department's Chief Privacy Officer at privacy@nysed.gov.

---

3. Vendor supplement — HallPal's commitments to New York LEAs

The following sections attach to every executed HallPal contract with a New York LEA per 8 NYCRR § 121.3(c). Together with the LEA's own § 121.3(a)-(b) Parents' Bill of Rights, they form the notice that the LEA is required to provide to parents.

4. Exclusive purposes of data use

HallPal will collect, store, use, and process student data supplied by the LEA solely to provide the hallpass management service described in the LEA's operating agreement with HallPal. Specific purposes:

• Authenticate the student at the kiosk during a hallpass request.
• Open + close hallpass records associated with the student.
• Support NFC card pairing + auto-fill on card tap.
• Render analytics + reports about hallpass activity to LEA-authorized administrators + teachers.
• Maintain an audit log of administrative actions on the student's records.
• Debug + operate the service (using aggregate metrics only; no personally-identifiable student data for product improvement).

HallPal will not use student data:

• For any marketing, advertising, or commercial purpose beyond providing the service.
• To train any machine learning model — ours or a subprocessor's.
• To build a profile of a student except in furtherance of the hallpass service.
• To sell, rent, or otherwise transfer to a party outside the LEA-authorized subprocessor list.

5. Subcontractor + subprocessor oversight

HallPal engages the subprocessors listed at SUBPROCESSORS.md to help operate the service. For each:

• HallPal maintains a written contract binding the subprocessor to data-protection terms substantively equivalent to HallPal's own.
• HallPal completes a security review before onboarding + at least annually thereafter.
• HallPal provides the LEA with at least 30 days' advance notice before adding, removing, or materially changing a subprocessor. The subprocessor page includes a subscription mechanism for these notifications.

6. Data storage + security

• Student data is stored at {{DB_HOSTING_LOCATION}}, in the United States. No student data is stored outside the United States.
• All data at rest is encrypted using AES-256.
• All data in transit is encrypted using TLS 1.2 or higher.
• Row-Level Security at the database layer scopes every query to the LEA that owns the data.
• Every administrative mutation writes an immutable audit-log entry.
• Full security controls: SECURITY.md.
• HallPal implements a data-security-and-privacy plan aligned with the NIST Cybersecurity Framework at the level required by 8 NYCRR § 121.6.

7. Data retention + destruction

• HallPal retains student data only for the duration of the LEA's contract with HallPal + a {{POST_TERM_EXPORT_WINDOW_DAYS}}-day post-termination export window.
• Within {{POST_TERM_DELETION_DAYS}} days of contract termination, student data is permanently deleted from live systems.
• Backups containing student data are purged on the scheduled backup-rotation cycle (rolling {{BACKUP_RETENTION_DAYS}} days).
• HallPal provides a written Certificate of Destruction on completion — template: CERTIFICATE_OF_DESTRUCTION.md.
• Parents may request deletion of their child's individual records at any time by contacting the school; the school authorizes HallPal + HallPal completes the deletion within 30 days.

8. Parent + eligible-student rights (New York)

Under Ed Law § 2-d + Part 121, parents (or eligible students age 18+) have the right to:

• Challenge accuracy of student data + request correction. Directed to the LEA's designated Data Protection Officer; HallPal supports the LEA in applying corrections within 5 business days of authorization.

• File a complaint with the LEA. If unsatisfied with the LEA's response, parents may complain to the New York State Education Department's Chief Privacy Officer at privacy@nysed.gov or by mail to:

  New York State Education Department Chief Privacy Officer 89 Washington Avenue Albany, NY 12234

• Receive notification of a data breach affecting their child's data. HallPal notifies the LEA within 72 hours of confirmed detection; the LEA notifies affected parents per Ed Law § 2-d

  • Part 121.

9. Breach notification (New York specifics)

For any Security Incident affecting a New York LEA's student data, HallPal will notify the LEA:

• No later than 72 hours after confirmed detection (HallPal's default; stricter than the 7-calendar-day minimum in 8 NYCRR § 121.10).
• The initial notice will include the nature of the incident, categories + approximate number of records affected, initial containment steps, and the contact point for follow-up.
• Written incident report follows within 30 days.

HallPal cooperates with the LEA's own notifications to parents + regulatory bodies as required by Ed Law § 2-d + Part 121.

10. Contact

Parent / privacy questions (LEAs + parents): privacy@hallpal.divz.io NY-specific vendor questions: legal@hallpal.divz.io Postal: {{COMPANY_ADDRESS}}