Swimcloud is compliant with New York Education Law 2-a, commonly referred to as the 2D Law, which governs the handling of student data by educational agencies and their third-party contractors.
After an audit of the data we collect on behalf of the New York State Public High School Athletic Association (NYSPHSAA) we have confirmed that Swimcloud only gathers directory information as defined by the Family Education Rights and Privacy Act (FERPA), 34 CFR Part 99.3. The specific data collected includes:
- Name
- Gender
- Participation in Athletics (i.e., competition results)
- Grade Level
- Awards Received (i.e., placement in competitions)
Directory information, as defined by FERPA, is publicly available and does not fall under the requirements of New York Ed Law 2-a unless additional, non-directory information is collected or disclosed. As Swimcloud only collects directory information from NYSPHSAA and its member schools, we believe that the 2D Law does not apply to our services in this context.
Swimcloud has been informed by the NYSPHSAA's counsel that:
The 2d Agreement is only required if additional information beyond directory information is collected or disclosed. Directory information is defined in the Family Education Rights and Privacy Act (FERPA) . 34 CFR Part 99.3. Directory information includes, but is not limited to name, address, electronic email address, photograph, date and place of birth, major field of study, grade level, participation in official school activities and athletics, height and weight on sports teams and awards received. Therefore, unless there is additional information being collected there does not need to be the agreement required under 2D.
If individual schools or districts seek further assurance, we are happy to provide a signed New York Ed Privacy Appendix, which references our data collection, privacy, retention, and training policies to affirm our commitment to protecting student privacy.
Should you have any further questions or require additional documentation, please do not hesitate to contact us.
New York Ed Privacy Appendix
This appendix serves as confirmation of Swimcloud’s adherence to privacy practices in compliance with FERPA and relevant New York State privacy laws, specifically regarding the handling of directory information for student-athletes.
1. Data Collection
Swimcloud collects only the following directory information as defined under FERPA (34 CFR Part 99.3):
- Name
- Gender
- Participation in Athletics (i.e., competition results)
- Grade Level
- Awards Received (i.e., placement in competitions)
No additional personally identifiable information (PII) is collected or disclosed without explicit consent from the student or their legal guardian.
2. Data Use
The data collected by Swimcloud is used solely for the following purposes:
- Displaying competition results
- Generating rankings and leaderboards
- Supporting team and individual performance analysis
- Sharing information within the Swimcloud platform for community engagement (with consent)
3. Data Protection & Retention
Swimcloud is committed to safeguarding student data through robust privacy and security measures:
- Encryption: All data is encrypted both in transit and at rest to prevent unauthorized access.
- Access Control: Access to data is restricted to authorized Swimcloud personnel and users with legitimate need based on role.
- Retention: Data will be retained for the duration of the student’s participation in school-sponsored athletics or until requested for deletion by the student or school.
4. Compliance with New York Ed Law 2-a
Based on our review and legal consultation, the data Swimcloud collects qualifies as directory information under FERPA and is not subject to the additional requirements of New York Ed Law 2-a. Therefore, no separate Data Privacy Agreement is necessary unless non-directory information is collected. If additional data is required in the future, Swimcloud will work with schools to ensure full compliance with the law.
5. Training & Oversight
All Swimcloud staff undergo regular training on data privacy practices and the proper handling of sensitive information. Swimcloud also performs regular audits of its data security measures to ensure compliance with applicable laws and best practices.
6. Amendments & Modifications
This appendix may be updated as necessary to reflect changes in applicable laws, school requirements, or Swimcloud’s data handling practices. Schools will be notified of any such changes to ensure continued compliance.
7. Contact Information
For further questions regarding our data privacy policies, please contact us at support@swimcloud.com.