DATA PRIVACY AND SECURITY PLAN
The Power Player, Inc. — PowerPlayer
Prepared for: New York educational agencies (reusable, via the SDPC "General Offer of Privacy Terms") Provider: The Power Player, Inc. Address: 7 Austin Street, Buffalo, New York 14207 Contact: support@thepowerplayer.com Date: September 10, 2026 Security framework: NIST Cybersecurity Framework v1.1
The nine required elements (NYSED Model Plan / §2-d)
1. Implementing the contract's data-protection requirements over its life
The Power Player, Inc. implements and maintains the requirements of the applicable Data Privacy Agreement, New York Education Law § 2-d, 8 NYCRR Part 121, FERPA, and COPPA throughout the contract term. Student Data is used solely to deliver the contracted service — a one-way coach-to-athlete/parent communication and team-management application — is never sold or used for targeted advertising or any secondary purpose, and is returned or securely destroyed on termination. Safeguards are reviewed on a recurring basis (see element 9).
2. Administrative, operational, and technical safeguards
Administrative: access to Student Data is limited to authorized personnel on a least-privilege, need-to-know basis; recurring security reviews are performed; all personnel with access are bound by confidentiality obligations. Operational: data is hosted in a managed Amazon Web Services (United States) environment; vetted subprocessors (AWS for hosting, Stripe for payments) are engaged under written data-protection terms; the Company maintains monitoring and incident-response processes. Technical: role- and relationship-based access enforcement; multi-factor authentication for sensitive access; encryption of data in transit (TLS) and at rest (AWS KMS); secrets management and rotation; database hardening; and application input-handling controls.
3. Training on the laws governing PII confidentiality
Employees and any subprocessors with access to Student Data are informed of, and acknowledge in writing, their confidentiality obligations under FERPA, COPPA, and New York Education Law § 2-d, and the Company's data-handling requirements, before being granted access. The Company maintains a written Data Privacy & Security Training and a signed confirmation from each individual, retained as evidence, renewed annually.
4. Contracts binding officers, employees, and subprocessors
Employees are bound by confidentiality and acceptable-use obligations as a condition of access. Subprocessors are engaged only under written agreements with confidentiality and data-security obligations no less protective than the applicable Data Privacy Agreement. The Company examines a subprocessor's security before use and, on material non-compliance, notifies the educational agency, removes the subprocessor's access, and ensures the return or secure destruction of Student Data.
5. Managing data-security and privacy incidents; identifying breaches; notifying the agency
The Company maintains a written incident-response process, consistent with industry standards and applicable law, to detect, contain, investigate, and remediate security events affecting Student Data. Upon confirmation of a breach or unauthorized release of Student Data, the Company notifies the educational agency within seventy-two (72) hours of confirmation (or, where notification would disrupt a law-enforcement investigation, within a reasonable time thereafter), providing the reporting agency and a Company contact, the types of PII involved, the date or estimated date/range of the incident, any law-enforcement-delay note, and a general description of the incident and response.
6. Returning data to the educational agency when no longer needed
On the educational agency's written request, or on expiration or termination of the contract, the Company transfers the agency's Student Data back to the agency (or to a successor at the agency's direction) in a commonly readable electronic format, at no additional cost, before deletion.
7. Secure destruction practices and certification
After any required transfer, the Company securely deletes and destroys all Student Data — including archived and cloud copies — so that it cannot be retrieved, read, or reconstructed; redaction is not treated as valid destruction. The Company provides the educational agency with written certification of destruction. Confidentiality and security obligations survive termination until the Company certifies that it and its subprocessors no longer have access to, and have destroyed, the Student Data.
8. Alignment with the educational agency's policies
The Company complies with the educational agency's Data Security and Privacy Policy and its Parents' Bill of Rights (incorporated by reference and provided on execution): Student Data is used only for authorized purposes, access is restricted, and confidentiality is maintained under the applicable Data Privacy Agreement. The Company conforms its handling to the agency's applicable policies as provided to it.
9. Material alignment with the NIST Cybersecurity Framework v1.1
The maturity ratings reflected in the NIST CSF chart represent The Power Player, Inc.'s target security posture. To meet and substantiate these ratings, The Power Player, Inc. conducts structured reviews of the application against the security requirements underlying each NIST function.
Our review and remediation maps to the NIST functions as follows:
-
Identify — reviewing and documenting data assets, data flows, and third-party subprocessors (AWS, Stripe) to confirm scope and ownership of protected data.
-
Protect — reviewing and strengthening access control (role-based enforcement, multi-factor authentication), encryption in transit and at rest, secrets management and rotation, database hardening, and application input handling to meet the required protection standard.
-
Detect — reviewing application and infrastructure logging and monitoring to ensure anomalous or unauthorized access is identifiable.
-
Respond — confirming and documenting the incident-response process, including educational-agency notification.
-
Recover — confirming backup and restore capability to restore service and data integrity following an event. (A completed 23-category NIST CSF v1.1 maturity chart, reflecting the Company's target security posture, is maintained by The Power Player, Inc. and is available to an educational agency on request.)
Description of Services
PowerPlayer is a sports communication and team-management application that allows coaches to privately send developmental feedback, videos, schedules, and related information to athletes and their parents. The communication model is one-way (coach to athlete/parent); recipients acknowledge or ask a question rather than reply in a back-and-forth thread. For minor athletes, coach-to-minor communications are visible to the linked parent.
Schedule of Data (categories collected)
Collected by PowerPlayer:
Category / Element(s) / Collected
Student Name / First, Last / Yes
Student Contact Information/ Email (required); Phone (optional) / Yes
Parent/Guardian / Name First, Last / Yes
Parent/Guardian Contact Information / Email; Phone (as provided) / Yes
Demographics / Date of Birth (optional) / Yes
Student Identifiers / App username / login; app-assigned student ID / Yes
Student In-App Performance / (not collected) / No
Communications / Coach messages, videos, related content / Yes
Schedule / Team events / schedules / Yes
Student Program Membership / Team / roster participation / Yes
Other (athletic profile) / Height, weight, jersey number, position (all optional) / Yes
NOT collected (left unchecked): assessment/test data, attendance, conduct/discipline, enrollment, medical/health/special-indicator (IEP/504), transcript/grades, transportation/bus data, biometric, food-service, or student criminal records.
Note: required at roster invite = first name, last name, email. All other fields are optional and added later by the coach. Height, weight, and date of birth are treated as athletic-profile attributes, not health/medical records.
Security Framework
The Power Player, Inc. aligns its data security and privacy program to the NIST Cybersecurity Framework, Version 1.1.
Contact
Questions about this Data Privacy and Security Plan may be directed to:
The Power Player, Inc.
7 Austin Street
Buffalo, New York 14207
Email: support@thepowerplayer.com