Student Data Protection and FERPA Compliance

Last Updated: October 12, 2026

1. Purpose and Scope

Unifex Group is committed to protecting the confidentiality, privacy, and security of student information entrusted to it by educational institutions. This policy establishes the principals governing Unifex's collection, access, use, storage, disclosure, retention, and destruction of student information in connection with its consulting services.

Unifex will handle student information in accordance with applicable contractual obligations, institutional instructions, and applicable federal and state privacy and data-protection laws, including the Family Educational Rights and Privacy Act (FERPA), where applicable.

2. Data Minimization and Collection Limitations

Unifex will collect, access, and maintain only the student information reasonably necessary to perform the services expressly authorized by institutional partners.

Minimum necessary information. For student outreach, survey administration, interviews, and similar activities, Unifex will seek to limit identifiable student information to names, institutional email addresses, and other information demonstrably necessary for the authorized activity.
Use of de-identified or coded data. For historical data analysis, retention studies, student-success assessments, and related research, Unifex will prioritize data from which direct identifiers have been removed or replaced with project-specific identifiers.
Avoidance of unnecessary sensitive information. Unifex will not request Social Security numbers, personal addresses, dates of birth, or other sensitive identifiers unless the information is demonstrably necessary for the engagement and its provision has been expressly authorized in writing by the Institution.
Scope approval. Before receiving student-level information, Unifex and the Institution will establish the categories of data required, the purposes for which the data will be used, and any applicable restrictions on its use.

Whenever reasonably practicable, the Institution should prepare and transfer historical datasets with direct identifiers removed and retain any identifying crosswalk or re-identification key within its own systems.

A student number or other coded identifier will not, by itself, be presumed to render a dataset de-identified. Unifex will treat coded or pseudonymized student-level information as confidential and protected information unless the applicable de-identification standard has been satisfied.

3. Permitted Use and Confidentiality

Unifex will use student information solely to perform the services specified in contracted agreements or statement of work and in accordance with the Institution's documented instructions.

Unifex will not:

Sell, rent, license, or otherwise commercially distribute student information.
Use student information for advertising, marketing, commercial profiling, or purposes unrelated to the authorized engagement.
Disclose student information to unauthorized individuals or organizations.
Attempt to identify students from de-identified or coded datasets, except where specifically authorized and lawful.
Use student information to train, fine-tune, or improve general-purpose artificial intelligence models, or submit it to public generative AI services, without the Institution's prior written authorization and appropriate safeguards.

Unifex will maintain the confidentiality of student information and ensure that any individual authorized to access it is subject to appropriate confidentiality obligations.

4. Information Security and Cybersecurity

Unifex will maintain administrative, technical, and physical safeguards appropriate to the sensitivity and volume of student information being processed. These safeguards will include, as applicable:

Access controls: Access will be restricted to authorized individuals with a legitimate project-related need. Access rights will be limited to the minimum necessary and revoked when no longer required.
Authentication: Multi-factor authentication will be enabled for supported business accounts and systems containing student information. Strong, unique passwords will be maintained using a secure password-management process.
Encryption: Student information will be transmitted using encrypted channels and stored using encryption at rest where supported by the systems in use.
Secure devices: Devices used to process student information will be protected by device encryption, screen locking, current security updates, and appropriate endpoint security measures.
Secure transfer and storage: Student information will be transferred and stored using approved business systems. Unsecured email, personal cloud storage, and unauthorized removable media will not be used to transfer or store student-level datasets.
Security maintenance: Unifex will maintain appropriate procedures for managing access, updating software, protecting credentials, and securely disposing of information.
Confidential handling: Student information will not be disclosed or made accessible to personnel or service providers who lack authorization.

Unifex will periodically review its safeguards and address identified risks in a manner proportionate to the nature of the information and the services performed.

5. Third-Party Access and Disclosure

Unifex will not disclose student information to third parties except as authorized in writing by the Institution, as required by applicable law, or as otherwise expressly permitted by the applicable agreement and law. Before authorizing a third-party service provider to process student information, Unifex will ensure that the provider is subject to appropriate contractual confidentiality and security obligations and obtain the Institution's approval where required by the applicable agreement.

Where legally permitted, Unifex will notify the Institution promptly of any legally compelled request for student information before disclosing it, so that the Institution has an opportunity to respond.

6. Security Incidents

Unifex will maintain procedures for identifying, containing, investigating, and responding to suspected or confirmed unauthorized access, disclosure, loss, alteration, or acquisition of student information.

Unifex will notify its partners without undue delay and no later than 48 hours after discovering a suspected or confirmed security incident involving the Institution's student information. The notice will include the information reasonably available at the time regarding the nature of the incident, information potentially affected, and measures taken or proposed to contain and address it.

Unifex will cooperate with the Institution's investigation, remediation, and any legally required notifications.

7. Data Retention, Return, and Secure Destruction

Unifex will retain student-level information only for as long as reasonably necessary to perform the authorized services or meet a specific applicable legal requirement.

Upon completion of the relevant services, termination of the engagement, or an earlier written request from the Institution, Unifex will promptly return the information if requested or securely delete it from active systems. The return or deletion process will be completed no later than ten business days after the applicable trigger, unless a shorter period is agreed. Deletion will encompass student-level source files, contact lists, working datasets, exports, temporary files, and other copies held by Unifex.

Any residual copies contained in protected backup systems that cannot be immediately purged will be access-restricted, will not
be used for any other purpose, and will be deleted through the applicable backup-retention cycle within 30 calendar days. If a backup is restored, the applicable deletion requirements will be reapplied.

Unifex may retain final consulting deliverables that contain no student-level information and do not identify individual students. Student-level information will not be retained for future projects, general research, marketing, or convenience.

Where retention is expressly required by law, Unifex will retain only the minimum information required for the relevant period, restrict its use and access, and delete it when the requirement expires.

8. Institutional Control and Cooperation

Unifex will follow the Institution's documented requirements regarding authorized access, permitted uses, handling, disclosure, retention, and destruction of student information, subject to applicable law.

Upon reasonable request, Unifex will provide information sufficient to demonstrate its compliance with the applicable data-protection requirements and cooperate with reasonable institutional reviews relating to the engagement. Any additional or more stringent student-data requirements established in the applicable consulting agreement, statement of work, or institution-specific data-protection agreement will apply to the extent agreed by the parties and permitted by law

Contact Us
If you have questions about these Terms, contact us at:
Unifex Group 12608 Saint James Rd. Rockville, Maryland 20850 Email: info@unifexgroup.com Phone: 850-345-3439

Student Data Protection and FERPA Compliance

Last Updated: October 12, 2026

1. Purpose and Scope

Unifex will handle student information in accordance with applicable contractual obligations, institutional instructions, and applicable federal and state privacy and data-protection laws, including the Family Educational Rights and Privacy Act (FERPA), where applicable.

2. Data Minimization and Collection Limitations

Unifex will collect, access, and maintain only the student information reasonably necessary to perform the services expressly authorized by institutional partners.

Minimum necessary information. For student outreach, survey administration, interviews, and similar activities, Unifex will seek to limit identifiable student information to names, institutional email addresses, and other information demonstrably necessary for the authorized activity.

Use of de-identified or coded data. For historical data analysis, retention studies, student-success assessments, and related research, Unifex will prioritize data from which direct identifiers have been removed or replaced with project-specific identifiers.

Scope approval. Before receiving student-level information, Unifex and the Institution will establish the categories of data required, the purposes for which the data will be used, and any applicable restrictions on its use.

Whenever reasonably practicable, the Institution should prepare and transfer historical datasets with direct identifiers removed and retain any identifying crosswalk or re-identification key within its own systems.

A student number or other coded identifier will not, by itself, be presumed to render a dataset de-identified. Unifex will treat coded or pseudonymized student-level information as confidential and protected information unless the applicable de-identification standard has been satisfied.

3. Permitted Use and Confidentiality

Unifex will use student information solely to perform the services specified in contracted agreements or statement of work and in accordance with the Institution's documented instructions.

Unifex will not:

Sell, rent, license, or otherwise commercially distribute student information.

Use student information for advertising, marketing, commercial profiling, or purposes unrelated to the authorized engagement.

Disclose student information to unauthorized individuals or organizations.

Attempt to identify students from de-identified or coded datasets, except where specifically authorized and lawful.

Use student information to train, fine-tune, or improve general-purpose artificial intelligence models, or submit it to public generative AI services, without the Institution's prior written authorization and appropriate safeguards.

Unifex will maintain the confidentiality of student information and ensure that any individual authorized to access it is subject to appropriate confidentiality obligations.

4. Information Security and Cybersecurity

Unifex will maintain administrative, technical, and physical safeguards appropriate to the sensitivity and volume of student information being processed. These safeguards will include, as applicable:

Access controls: Access will be restricted to authorized individuals with a legitimate project-related need. Access rights will be limited to the minimum necessary and revoked when no longer required.

Authentication: Multi-factor authentication will be enabled for supported business accounts and systems containing student information. Strong, unique passwords will be maintained using a secure password-management process.

Encryption: Student information will be transmitted using encrypted channels and stored using encryption at rest where supported by the systems in use.

Secure devices: Devices used to process student information will be protected by device encryption, screen locking, current security updates, and appropriate endpoint security measures.

Secure transfer and storage: Student information will be transferred and stored using approved business systems. Unsecured email, personal cloud storage, and unauthorized removable media will not be used to transfer or store student-level datasets.

Security maintenance: Unifex will maintain appropriate procedures for managing access, updating software, protecting credentials, and securely disposing of information.

Confidential handling: Student information will not be disclosed or made accessible to personnel or service providers who lack authorization.

Unifex will periodically review its safeguards and address identified risks in a manner proportionate to the nature of the information and the services performed.

5. Third-Party Access and Disclosure

Where legally permitted, Unifex will notify the Institution promptly of any legally compelled request for student information before disclosing it, so that the Institution has an opportunity to respond.

6. Security Incidents

Unifex will maintain procedures for identifying, containing, investigating, and responding to suspected or confirmed unauthorized access, disclosure, loss, alteration, or acquisition of student information.

Unifex will cooperate with the Institution's investigation, remediation, and any legally required notifications.

7. Data Retention, Return, and Secure Destruction

Unifex will retain student-level information only for as long as reasonably necessary to perform the authorized services or meet a specific applicable legal requirement.

Unifex may retain final consulting deliverables that contain no student-level information and do not identify individual students. Student-level information will not be retained for future projects, general research, marketing, or convenience.

Where retention is expressly required by law, Unifex will retain only the minimum information required for the relevant period, restrict its use and access, and delete it when the requirement expires.

8. Institutional Control and Cooperation

Unifex will follow the Institution's documented requirements regarding authorized access, permitted uses, handling, disclosure, retention, and destruction of student information, subject to applicable law.